OSCAL Profile
1.0.1Schema URL
Properties
Definitions
Each OSCAL profile is defined by a Profile element
A globally unique identifier for this profile instance. This UUID should be changed when this document is revised.
The import designates a catalog, profile, or other resource to be included (referenced and potentially modified) by this profile. The import also identifies which controls to select using the include-all, include-controls, and exclude-controls directives.
A resolvable URL reference to the base catalog or profile that this profile is tailoring.
A Merge element merges controls in resolution.
A Combine element defines whether and how to combine multiple (competing) versions of the same control
How clashing controls should be handled
An As-is element indicates that the controls should be structured in resolution as they are structured in their source catalogs. It does not contain any elements or attributes.
A Custom element frames a structure for embedding represented controls in resolution.
A group of (selected) controls or of groups of controls
A name given to the group, which may be used by a tool for display and navigation.
A unique identifier for a specific group instance that can be used to reference the group within this and in other OSCAL documents. This identifier's uniqueness is document scoped and is intended to be consistent for the same group across minor revisions of the document.
A textual label that provides a sub-type or characterization of the group.
Set parameters or amend controls in resolution
Specifies which controls to use in the containing context.
A designation of how a selection of controls in a profile is to be ordered.
Insert all controls from the imported catalog or profile resources identified in the import directive.
Call a control by its ID
When a control is included, whether its child (dependent) controls are also included.
An Alter element specifies changes to be made to an included control when a profile is resolved.
A reference to a control with a corresponding id value.
Specifies objects to be removed from a control based on specific aspects of the object that must all match.
Identify items to remove by matching their assigned name
Identify items to remove by matching their class.
Identify items to remove indicated by their id.
Identify items to remove by the name of the item's information element name, e.g. title or prop
Identify items to remove by the item's ns, which is the namespace associated with a part, or prop.
Specifies contents to be added into controls, in resolution
Where to add the new content with respect to the targeted element (beside it or inside it)
Target location of the addition.
A name given to the control, which may be used by a tool for display and navigation.
Provides information about the publication and availability of the containing document.
A name given to the document, which may be used by a tool for display and navigation.
An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first).
A name given to the document revision, which may be used by a tool for display and navigation.
A location, with associated metadata that can be referenced.
A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document.
A name given to the location, which may be used by a tool for display and navigation.
References a location defined in metadata.
A responsible entity which is either a person or an organization.
A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistently used for a given party across revisions of the document.
A category describing the kind of party the object describes.
The full name of the party. This is typically the legal name associated with the party.
A short common name, abbreviation, or acronym for the party.
References a party defined in metadata.
Defines a function assumed or expected to be assumed by a party in a specific situation.
A unique identifier for a specific role instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same role across minor revisions of the document.
A name given to the role, which may be used by a tool for display and navigation.
A short common name, abbreviation, or acronym for the role.
A summary of the role's purpose and associated responsibilities.
A reference to the roles served by the user.
A collection of resources, which may be included directly or by reference.
An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair. The value of a property is a simple scalar value, which may be expressed as a list of values.
A textual label that uniquely identifies a specific attribute, characteristic, or quality of the property's containing object.
Indicates the value of the attribute, characteristic, or quality.
A unique identifier that can be used to reference this property elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document.
A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
A textual label that provides a sub-type or characterization of the property's name. This can be used to further distinguish or discriminate between the semantics of multiple properties of the same object with the same name and ns.
A reference to a local or remote resource
A resolvable URL reference to a resource.
Describes the type of relationship provided by the link. This can be an indicator of the link's purpose.
Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry.
A textual label to associate with the link, which may be used for presentation in a tool.
A reference to a set of organizations or persons that have responsibility for performing a referenced role in the context of the containing object.
The role that the party is responsible for.
A reference to one or more roles with responsibility for performing a function relative to the containing object.
The role that is responsible for the business function.
A representation of a cryptographic digest generated over a resource using a specified hash algorithm.
Method by which a hash is derived
Additional commentary on the containing object.
The date and time the document was published. The date-time value must be formatted according to RFC 3339 with full time and time zone included.
The date and time the document was last modified. The date-time value must be formatted according to RFC 3339 with full time and time zone included.
A string used to distinguish the current version of the document from other previous (and future) versions.
The OSCAL model version the document was authored against.
An email address as defined by RFC 5322 Section 3.4.1.
Contact number by telephone.
Indicates the type of phone number.
A postal address for the location.
Indicates the type of address.
City, town or geographical region for the mailing address.
State, province or analogous geographical region for mailing address
Postal or ZIP code for mailing address
The ISO 3166-1 alpha-2 country code for the mailing address.
A single line of an address.
A document identifier qualified by an identifier scheme. A document identifier provides a globally unique identifier for a group of documents that are to be treated as different versions of the same document. If this element does not appear, or if the value of this element is empty, the value of "document-id" is equal to the value of the "uuid" flag of the top-level root element.
Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.
A partition of a control's definition or a child of another part.
A textual label that uniquely identifies the part's semantic type.
A unique identifier for a specific part instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same part across minor revisions of the document.
A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.
A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of multiple parts of the same control with the same name and ns.
A name given to the part, which may be used by a tool for display and navigation.
Permits multiple paragraphs, lists, tables etc.
Parameters provide a mechanism for the dynamic assignment of value(s) in a control.
A unique identifier for a specific parameter instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same parameter across minor revisions of the document.
A textual label that provides a characterization of the parameter.
Another parameter invoking this one
A short, placeholder name for the parameter, which can be used as a substitute for a value if no value is assigned.
Describes the purpose and use of a parameter
A formal or informal expression of a constraint or test
A textual summary of the constraint to be applied.
A prose statement that provides a recommendation for the use of a parameter.
Prose permits multiple paragraphs, lists, tables etc.
A parameter value or set of values.
Presenting a choice among alternatives
Describes the number of selections that must occur. Without this setting, only one value should be assumed to be permitted.