| Group |
A group of controls, or of groups of controls |
yes |
| Control |
A structured object representing a requirement or guideline, which when imple… |
yes |
| Metadata |
Provides information about the containing document, and defines concepts shar… |
yes |
| Revision |
An entry in a sequential list of revisions to the containing document |
no |
| Role |
Defines a function, which might be assigned to a party in a specific situatio… |
yes |
| Location |
A physical point of presence, which may be associated with people, organizati… |
no |
| Resource |
A resource associated with content in the containing document instance |
yes |
| Part |
An annotated, markup-based textual element of a control’s or catalog group’s … |
yes |
| ProfileGroup |
A group of (selected) controls or of groups of controls within a profile cust… |
yes |
| Addition |
Specifies content to be added into controls in resolution |
no |
| SubjectReference |
A human-oriented identifier reference to a resource |
no |
| AssessmentPlatform |
Used to represent the toolset used to perform aspects of the assessment |
no |
| Activity |
Identifies an assessment or related process that can be performed |
no |
| Step |
Identifies an individual step in a series of steps related to an activity, su… |
no |
| Task |
Represents a scheduled event or milestone, which may be associated with a ser… |
yes |
| AssessmentPart |
A partition of an assessment plan or results or a child of another part |
no |
| ControlPart |
An annotated, markup-based textual element of a control’s or catalog group’s … |
no |
| SystemComponent |
A defined component that can be part of an implemented system |
yes |
| Protocol |
Information about the protocol used to provide a service |
no |
| SystemUser |
A type of user that interacts with the system based on an associated role |
no |
| AuthorizedPrivilege |
Identifies a specific system privilege held by the user, along with an associ… |
yes |
| Observation |
Describes an individual observation |
no |
| Finding |
Describes an individual finding |
yes |
| FindingTarget |
Captures an assessor’s conclusions regarding the degree to which an objective… |
no |
| Risk |
An identified risk |
yes |
| Response |
Describes either recommended or an actual plan for addressing the risk |
yes |
| RequiredAsset |
Identifies an asset required to achieve remediation |
no |
| RiskLogEntry |
Identifies an individual risk response that occurred as part of managing an i… |
no |
| InformationType |
Contains details about one information type that is stored, processed, or tra… |
yes |
| LeveragedAuthorization |
A description of another authorized system from which this system inherits ca… |
yes |
| Result |
Identifies all of the assessment observations and findings, initial and resid… |
yes |
| AssessmentLogEntry |
Identifies the result of an action and/or task that occurred as part of execu… |
no |
| DefinedComponent |
A defined component that can be part of an implemented system |
yes |
| PoamItem |
Describes an individual POA&M item |
yes |
| TermsAndConditionsPart |
A terms-and-conditions scoped assessment part |
no |
| SspSystemComponent |
SSP-scoped system component with allows-authenticated-scan property typing |
no |
