OSCAL Assessment Plan (AP)
1.0.4Schema URL
Properties
Definitions
An assessment plan, such as those provided by a FedRAMP assessor.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this assessment plan in this or other OSCAL instances. The locally defined UUID of the assessment plan can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.
6 nested properties
Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.
1 nested properties
Provides information about the publication and availability of the containing document.
A name given to the document, which may be used by a tool for display and navigation.
An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first).
A name given to the document revision, which may be used by a tool for display and navigation.
A location, with associated metadata that can be referenced.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this defined location elsewhere in this or other OSCAL instances. The locally defined UUID of the location can be used to reference the data item locally or globally (e.g., from an importing OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A name given to the location, which may be used by a tool for display and navigation.
A machine-oriented identifier reference to a location defined in the metadata section of this or another OSCAL instance. The UUID of the location in the source OSCAL instance is sufficient to reference the data item locally or globally (e.g., in an imported OSCAL instance).
A responsible entity which is either a person or an organization.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this defined party elsewhere in this or other OSCAL instances. The locally defined UUID of the party can be used to reference the data item locally or globally (e.g., from an importing OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A category describing the kind of party the object describes.
The full name of the party. This is typically the legal name associated with the party.
A short common name, abbreviation, or acronym for the party.
A machine-oriented identifier reference to another party defined in metadata. The UUID of the party in the source OSCAL instance is sufficient to reference the data item locally or globally (e.g., in an imported OSCAL instance).
Defines a function assumed or expected to be assumed by a party in a specific situation.
A human-oriented, locally unique identifier with cross-instance scope that can be used to reference this defined role elsewhere in this or other OSCAL instances. When referenced from another OSCAL instance, the locally defined ID of the Role from the imported OSCAL instance must be referenced in the context of the containing resource (e.g., import, import-component-definition, import-profile, import-ssp or import-ap). This ID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A name given to the role, which may be used by a tool for display and navigation.
A short common name, abbreviation, or acronym for the role.
A summary of the role's purpose and associated responsibilities.
A human-oriented identifier reference to roles served by the user.
A collection of resources, which may be included directly or by reference.
An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair. The value of a property is a simple scalar value, which may be expressed as a list of values.
A textual label that uniquely identifies a specific attribute, characteristic, or quality of the property's containing object.
Indicates the value of the attribute, characteristic, or quality.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this defined property elsewhere in this or other OSCAL instances. This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
A textual label that provides a sub-type or characterization of the property's name. This can be used to further distinguish or discriminate between the semantics of multiple properties of the same object with the same name and ns.
A reference to a local or remote resource
A resolvable URL reference to a resource.
Describes the type of relationship provided by the link. This can be an indicator of the link's purpose.
Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry.
A textual label to associate with the link, which may be used for presentation in a tool.
A reference to a set of organizations or persons that have responsibility for performing a referenced role in the context of the containing object.
A human-oriented identifier reference to roles served by the user.
A reference to one or more roles with responsibility for performing a function relative to the containing object.
A human-oriented identifier reference to roles responsible for the business function.
A representation of a cryptographic digest generated over a resource using a specified hash algorithm.
Method by which a hash is derived
Additional commentary on the containing object.
The date and time the document was published. The date-time value must be formatted according to RFC 3339 with full time and time zone included.
The date and time the document was last modified. The date-time value must be formatted according to RFC 3339 with full time and time zone included.
A string used to distinguish the current version of the document from other previous (and future) versions.
The OSCAL model version the document was authored against.
An email address as defined by RFC 5322 Section 3.4.1.
Contact number by telephone.
Indicates the type of phone number.
A postal address for the location.
Indicates the type of address.
City, town or geographical region for the mailing address.
State, province or analogous geographical region for mailing address
Postal or ZIP code for mailing address
The ISO 3166-1 alpha-2 country code for the mailing address.
A single line of an address.
A document identifier qualified by an identifier scheme. A document identifier provides a globally unique identifier with a cross-instance scope that is used for a group of documents that are to be treated as different versions of the same document. If this element does not appear, or if the value of this element is empty, the value of "document-id" is equal to the value of the "uuid" flag of the top-level root element.
Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.
Used by the assessment plan and POA&M to import information about the system.
A resolvable URL reference to the system security plan for the system being assessed.
A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.
A human-oriented identifier reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
A human-readable description of this control objective.
A local definition of a control objective. Uses catalog syntax for control objective and assessment activities.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this assessment method elsewhere in this or other OSCAL instances. The locally defined UUID of the assessment method can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A human-readable description of this assessment method.
Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this assessment activity elsewhere in this or other OSCAL instances. The locally defined UUID of the activity can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A human-readable description of this included activity.
The title for this included activity.
Represents a scheduled event or milestone, which may be associated with a series of assessment actions.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this task elsewhere in this or other OSCAL instances. The locally defined UUID of the task can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
The type of task.
The title for this task.
A human-readable description of this task.
The timing under which the task is intended to occur.
3 nested properties
The task is intended to occur on the specified date.
1 nested properties
The task must occur on the specified date.
The task is intended to occur within the specified date range.
2 nested properties
The task must occur on or after the specified date.
The task must occur on or before the specified date.
The task is intended to occur at the specified frequency.
2 nested properties
The task must occur after the specified period has elapsed.
The unit of time for the period.
Identifies the controls being assessed and their control objectives.
A human-readable description of control objectives.
Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
A human-oriented identifier reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Points to an assessment objective.
Used when the assessment subjects will be determined as part of one or more other assessment activities. These assessment subjects will be recorded in the assessment results in the assessment log.
A machine-oriented, globally unique identifier for a set of assessment subjects that will be identified by a task or an activity that is part of a task. The locally defined UUID of the assessment subject placeholder can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A human-readable description of intent of this assessment subject placeholder.
Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.
Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.
A human-readable description of the collection of subjects being included in this assessment.
Identifies a set of assessment subjects to include/exclude by UUID.
A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Used to indicate the type of object pointed to by the uuid-ref within a subject.
A human-oriented identifier reference to a resource. Use type to indicate whether the identified resource is a component, inventory item, location, user, or something else.
A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Used to indicate the type of object pointed to by the uuid-ref within a subject.
The title or name for the referenced subject.
Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.
Captures an assessor's conclusions regarding the degree to which an objective is satisfied.
Identifies the type of the target.
A machine-oriented identifier reference for a specific target qualified by the type.
A determination of if the objective is satisfied or not within a given system.
3 nested properties
An indication as to whether the objective is satisfied or not.
The reason the objective was given it's status.
The title for this objective status.
A human-readable description of the assessor's conclusions regarding the degree to which an objective is satisfied.
Describes an individual observation.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this observation elsewhere in this or other OSCAL instances. The locally defined UUID of the observation can be used to reference the data item locally or globally (e.g., in an imorted OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A human-readable description of this assessment observation.
Date/time stamp identifying when the finding information was collected.
The title for this observation.
Date/time identifying when the finding information is out-of-date and no longer valid. Typically used with continuous assessment scenarios.
Identifies the source of the finding, such as a tool, interviewed person, or activity.
The actor that produces an observation, a finding, or a risk. One or more actor type can be used to specify a person that is using a tool.
The kind of actor.
A machine-oriented identifier reference to the tool or person based on the associated type.
For a party, this can optionally be used to specify the role the actor was performing.
A pointer, by ID, to an externally-defined threat.
Specifies the source of the threat information.
An optional location for the threat data, from which this ID originates.
An identified risk.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this risk elsewhere in this or other OSCAL instances. The locally defined UUID of the risk can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
The title for this risk.
A human-readable summary of the identified risk, to include a statement of how the risk impacts the system.
An summary of impact for how the risk affects the system.
The date/time by which the risk must be resolved.
A log of all risk-related tasks taken.
1 nested properties
Used to indicate who created a log entry in what role.
A machine-oriented identifier reference to the party who is making the log entry.
A point to the role-id of the role in which the party is making the log entry.
Describes the status of the associated risk.
A collection of descriptive data about the containing object from a specific origin.
Describes either recommended or an actual plan for addressing the risk.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this remediation elsewhere in this or other OSCAL instances. The locally defined UUID of the risk response can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.
The title for this response activity.
A human-readable description of this response plan.
A partition of an assessment plan or results or a child of another part.
A textual label that uniquely identifies the part's semantic type.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this part elsewhere in this or other OSCAL instances. The locally defined UUID of the part can be used to reference the data item locally or globally (e.g., in an ported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.
A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of multiple parts of the same control with the same name and ns.
A name given to the part, which may be used by a tool for display and navigation.
Permits multiple paragraphs, lists, tables etc.
A partition of a control's definition or a child of another part.
A textual label that uniquely identifies the part's semantic type.
A human-oriented, locally unique identifier with cross-instance scope that can be used to reference this defined part elsewhere in this or other OSCAL instances. When referenced from another OSCAL instance, this identifier must be referenced in the context of the containing resource (e.g., import-profile). This id should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.
A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of multiple parts of the same control with the same name and ns.
A name given to the part, which may be used by a tool for display and navigation.
Permits multiple paragraphs, lists, tables etc.
Parameters provide a mechanism for the dynamic assignment of value(s) in a control.
A human-oriented, locally unique identifier with cross-instance scope that can be used to reference this defined parameter elsewhere in this or other OSCAL instances. When referenced from another OSCAL instance, this identifier must be referenced in the context of the containing resource (e.g., import-profile). This id should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A textual label that provides a characterization of the parameter.
(deprecated) Another parameter invoking this one. This construct has been deprecated and should not be used.
A short, placeholder name for the parameter, which can be used as a substitute for a value if no value is assigned.
Describes the purpose and use of a parameter
A formal or informal expression of a constraint or test
A textual summary of the constraint to be applied.
A prose statement that provides a recommendation for the use of a parameter.
Prose permits multiple paragraphs, lists, tables etc.
A parameter value or set of values.
Presenting a choice among alternatives
Describes the number of selections that must occur. Without this setting, only one value should be assumed to be permitted.
Include all controls from the imported catalog or profile resources.
A defined component that can be part of an implemented system.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this component elsewhere in this or other OSCAL instances. The locally defined UUID of the component can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A category describing the purpose of the component.
A human readable name for the system component.
A description of the component, including information about its function.
Describes the operational status of the system component.
2 nested properties
The operational status.
A summary of the technological or business purpose of the component.
Information about the protocol used to provide a service.
The common name of the protocol, which should be the appropriate "service name" from the IANA Service Name and Transport Protocol Port Number Registry.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this service protocol information elsewhere in this or other OSCAL instances. The locally defined UUID of the service protocol can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A human readable name for the protocol (e.g., Transport Layer Security).
Where applicable this is the IPv4 port range on which the service operates.
Indicates the starting port number in a port range
Indicates the ending port number in a port range
Indicates the transport type.
Indicates the degree to which the a given control is implemented.
Identifies the implementation status of the control or control objective.
A type of user that interacts with the system based on an associated role.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this user class elsewhere in this or other OSCAL instances. The locally defined UUID of the system user can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A name given to the user, which may be used by a tool for display and navigation.
A short common name, abbreviation, or acronym for the user.
A summary of the user's purpose within the system.
Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege.
A human readable name for the privilege.
A summary of the privilege's purpose within the system.
Describes a function performed for a given authorized privilege by this user class.
A single managed inventory item within the system.
A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this inventory item elsewhere in this or other OSCAL instances. The locally defined UUID of the inventory item can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
A summary of the inventory item stating its purpose within the system.
Identifies the parameter that will be set by the enclosed value.
A human-oriented reference to a parameter within a control, who's catalog has been imported into the current implementation context.
A human-oriented, globally unique identifier with cross-instance scope that can be used to reference this system identification property elsewhere in this or other OSCAL instances. When referencing an externally defined system identification, the system identification must be used in the context of the external / imported OSCAL instance (e.g., uri-reference). This string should be assigned per-subject, which means it should be consistently used to identify the same system across revisions of the document.
Identifies the identification system from which the provided identifier was assigned.