domain

package
v0.0.0-...-fefcaee Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2024 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewId 

func NewId() string

Types

type Action 

type Action struct {
	Id primitive.ObjectID `json:"id" yaml:"id"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Date                  time.Time            `json:"date" yaml:"date"`
	ResponsiblePartyUuids []primitive.ObjectID `json:"responsiblePartyUuids" yaml:"responsiblePartyUuids"`
	System                string               `json:"system" yaml:"system"`
	Type                  string               `json:"type" yaml:"type"`
}

type Activity 

type Activity struct {
	Id               primitive.ObjectID `json:"id" yaml:"id"`
	Title            string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description      string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props            []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links            []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks          string             `json:"remarks,omitempty" yaml:"remarks,omitempty"`
	ResponsibleRoles []string           `json:"responsibleRoles" yaml:"responsibleRoles"`
	Subjects         SubjectSelection   `json:"subjects" yaml:"subjects"`
	Provider         Provider           `json:"provider" yaml:"provider"`
}

type ActivityInformation 

type ActivityInformation struct {
	Id       string           `json:"id" yaml:"id"`
	Title    string           `json:"title" yaml:"title"`
	Selector SubjectSelection `json:"selector" yaml:"selector"`
	Provider Provider         `json:"provider" yaml:"provider"`
}

type Actor 

type Actor struct {
	Uuid        Uuid       `json:"uuid" yaml:"uuid"`
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`

	Links   []Link `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	RoleId Uuid      `json:"roleId" yaml:"roleId"`
	Type   ActorType `json:"type" yaml:"type"`
}

type ActorType 

type ActorType string
const (
	ActorTypeTool               ActorType = "tool"
	ActorTypeAssessmentPlatform ActorType = "assessment-platform"
	ActorTypeParty              ActorType = "party"
)

type Assets 

type Assets struct {
	// Reference to component.Component
	Components []primitive.ObjectID `json:"components" yaml:"components"`

	// Used to represent the toolset used to perform aspects of the assessment.
	Platforms []primitive.ObjectID `json:"platforms" yaml:"platforms"`
}

Assets

Assets Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.

type Attestation 

type Attestation struct {
	Parts              []Part               `json:"parts" yaml:"parts"`
	ResponsibleParties []primitive.ObjectID `json:"responsibleParties" yaml:"responsibleParties"`
}

Attestation represents a formal assertion, declaration, or acknowledgment by an authoritative entity in the context of the OSCAL assessment schema. It confirms the accuracy or truth of assessment results, system configurations, or other relevant details. Each attestation is typically associated with specific assessment results, targets, or findings and may contain information about the party making the attestation and any relevant timestamps or metadata.

Example: 

Attestor: Jane Smith, Chief Security Officer
Date: 2023-10-31
Statement: I hereby attest to the accuracy and completeness of the assessment results
for the production server environment dated 2023-10-30.

type AuthorizationBoundary 

type AuthorizationBoundary struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Diagrams is an optional collection of visual representations of the boundary.
	Diagrams []Diagram `json:"diagrams,omitempty" yaml:"diagrams,omitempty"`
}

AuthorizationBoundary defines the system's authorization boundary. It includes a description and optional diagrams illustrating the boundary. It can also contain links to additional resources and arbitrary properties. For example, the boundary of a cloud-based service might include the cloud infrastructure, network components, and hosted applications.

type BackMatter 

type BackMatter struct {
	Resources []*Resource `json:"resources,omitempty" yaml:"resources,omitempty"`
}

BackMatter represents the back matter of a document with associated resources.

type Base64 

type Base64 struct {
	Filename  string `json:"filename,omitempty" yaml:"filename,omitempty"`     // Name of the file before it was encoded as Base64.
	MediaType string `json:"media-type,omitempty" yaml:"media-type,omitempty"` // A label that indicates the nature of a resource.
	Value     string `json:"value" yaml:"value"`                               // The Base64 encoded value.
}

Base64 represents a resource encoded using the Base64 alphabet defined by RFC 2045.

type Capability 

type Capability struct {
	Uuid Uuid   `json:"uuid" query:"uuid" yaml:"uuid"`
	Name string `json:"name" query:"name" yaml:"name"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`

	IncorporatesComponents []Uuid `json:"incorporated_components" query:"incorporated_components" yaml:"incorporated_components"`
	ControlImplementations []Uuid `json:"control_implementations" query:"control_implementations" yaml:"control_implementations"`

	Remarks string `json:"remarks" query:"remarks" yaml:"remarks"`
}

type Catalog 

type Catalog struct {
	Uuid  Uuid   `json:"uuid" yaml:"uuid"`
	Title string `json:"title" yaml:"title"` // Doesn't exist in OSCAL for some reason 🤷🏻

	Metadata Metadata `json:"metadata" yaml:"metadata"`

	Params     []Parameter `json:"params" yaml:"params"`
	Controls   []Control   `json:"controlUuids" yaml:"controlUuids"` // Reference to controls. Controls is an array of objects in the database
	Groups     []Uuid      `json:"groupUuids" yaml:"groupUuids"`     // Reference to groups
	BackMatter BackMatter  `json:"backMatter" yaml:"backMatter"`
}

func NewCatalog 

func NewCatalog(title string) Catalog

type Characterization 

type Characterization struct {
	Links  []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Props  []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Facets []Facet    `json:"facets" yaml:"facets"`

	// Actors / Tasks Identify the source of the finding, such as a tool, interviewed person, or activity
	Actors []primitive.ObjectID `json:"originActors" yaml:"originActors"`
	Tasks  []primitive.ObjectID `json:"relatedTasks" yaml:"relatedTasks"`
}

Characterization provides a classification or description of the nature of an observation or finding within the OSCAL assessment context. It helps in understanding the kind, type, or category of the observation.

Example: 

Characterization: Configuration Setting
Detail: Describes observations related to system configurations.

type Citation 

type Citation struct {
	Links []Link     `json:"links,omitempty" yaml:"links,omitempty"` // Links associated with the citation.
	Props []Property `json:"props,omitempty" yaml:"props,omitempty"` // Properties of the citation.
	Text  string     `json:"text" yaml:"text"`                       // A line of citation text.
}

Citation represents an optional citation consisting of end note text using structured markup.

type CommonAuthorizedPrivilege 

type CommonAuthorizedPrivilege struct {
	// A summary of the privilege's purpose within the system.
	Description        string   `json:"description,omitempty" yaml:"description,omitempty"`
	FunctionsPerformed []string `json:"functions-performed" yaml:"functions-performed"`

	// A human-readable name for the privilege.
	Title string `json:"title" yaml:"title"`
}

CommonAuthorizedPrivilege Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege. NOTE: This is subject to change if we decide to implement another type of identity system

type Component 

type Component struct {
	Uuid        Uuid          `json:"uuid" query:"uuid" yaml:"uuid"`
	Type        ComponentType `json:"type" query:"type" yaml:"type"`
	Title       string        `json:"title" query:"title" yaml:"title"`
	Description string        `json:"description" query:"description" yaml:"description"`

	// A summary of the technological or business purpose of the component.
	Purpose          string     `json:"purpose" query:"purpose" yaml:"purpose"`
	Props            []Property `json:"props" query:"props" yaml:"props"`
	Links            []Link     `json:"links" query:"links" yaml:"links"`
	Implementations  []Uuid     `json:"control_implementations" query:"control_implementations" yaml:"control_implementations"`
	ResponsibleRoles []Uuid     `json:"responsible_roles" query:"responsible_roles" yaml:"responsible_roles"`
}

Component A defined component that can be part of an implemented system. Notes: - Implemented Protocols from OSCAL is not implemented. They can always be added as props.

type ComponentType 

type ComponentType int
const (
	InterconnectionComponentType ComponentType = iota
	SoftwareComponentType
	HardwareComponentType
	ServiceComponentType
	PolicyComponentType
	PhysicalComponentType
	ProcessProcedureComponentType
	PlanComponentType
	GuidanceComponentType
	StandardComponentType
	ValidationComponentType
)

type Constraint 

type Constraint struct {
	Description string           `json:"description" yaml:"description"`
	Tests       []ConstraintTest `json:"tests" yaml:"tests"`
}

type ConstraintTest 

type ConstraintTest struct {
	Expression string `json:"expression" yaml:"expression"`
	Remarks    string `json:"remarks" yaml:"remarks"`
}

type Control 

type Control struct {
	Uuid Uuid `json:"uuid" yaml:"uuid"`

	Props []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Parts []Part     `json:"parts,omitempty" yaml:"parts,omitempty"`

	Class    string      `json:"class" yaml:"class"`
	Title    string      `json:"title" yaml:"title"`
	Params   []Parameter `json:"params" yaml:"params"`
	Controls []Uuid      `json:"controlUuids" yaml:"controlUuids"` // Reference to controls
}

type ControlDefinitionStatement 

type ControlDefinitionStatement struct {
	Uuid Uuid `json:"uuid" query:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`

	StatementId      string `json:"statement_id" query:"statement_id" yaml:"statement_id"`
	ResponsibleRoles []Uuid `json:"responsible_roles" query:"responsible_roles" yaml:"responsible_roles"`
	Remarks          string `json:"remarks" query:"remarks" yaml:"remarks"`
}

type ControlImplementation 

type ControlImplementation struct {
	Uuid Uuid `json:"uuid" query:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Source A reference to an OSCAL catalog or profile providing the referenced control or sub-control definition.
	// Should be in the format `catalog/{catalog_uuid}` or `profile/{profile_uuid}`.
	// TODO: Need to find a way to handle this in MongoDB. (Maybe add another field to store the source type?)
	Source                  string           `json:"source" query:"source" yaml:"source"`
	SetParameters           []ParameterValue `json:"set_parameters" query:"set_parameters" yaml:"set_parameters"`
	ImplementedRequirements []Uuid           `json:"implemented_requirements" query:"implemented_requirements" yaml:"implemented_requirements"`
	ResponsibleRoles        []Uuid           `json:"responsible_roles" query:"responsible_roles" yaml:"responsible_roles"`
}

ControlImplementation Control Implementation Set: Defines how the component or capability supports a set of controls.

type ControlsAndObjectives 

type ControlsAndObjectives struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`

	Links   []Link `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Objectives        []ObjectiveSelection `json:"objectives" yaml:"objectives"`
	ControlSelections Selection            `json:"controlSelections" yaml:"controlSelections"`
}

ControlsAndObjectives

The Controls and Control Objectives that are part of the Plan

type DataFlow 

type DataFlow struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Description is a summary of the system's data flow.
	Diagrams []Diagram `json:"diagrams,omitempty" yaml:"diagrams,omitempty"`
}

DataFlow describes the logical flow of information within the system and across its boundaries. For example, this could represent how data flows from user interfaces to backend services in a web application.

type Definition 

type Definition struct {
	Uuid     Uuid     `json:"uuid" query:"uuid" yaml:"uuid"`
	Metadata Metadata `yaml:"metadata"`

	// ImportedDefinitions Loads a component definition from another resource.
	// TODO: Does importing move all the definitions into the current definition or does it just reference them?
	ImportedDefinitions []Uuid `json:"imported_definitions" query:"imported_definitions" yaml:"imported_definitions"`

	Components   []Uuid     `json:"components" query:"components" yaml:"components"`
	Capabilities []Uuid     `json:"capabilities" query:"capabilities" yaml:"capabilities"`
	BackMatter   BackMatter `json:"backmatter" query:"backmatter" yaml:"backmatter"`
}

Definition A collection of component descriptions, which may optionally be grouped by capability.

type Diagram 

type Diagram struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Caption provides a brief annotation for the diagram.
	Caption string `json:"caption,omitempty" yaml:"caption,omitempty"`
	// Uuid is a machine-oriented, globally unique identifier that can be used to reference this diagram elsewhere in this or other OSCAL instances.
	Uuid string `json:"uuid" yaml:"uuid"`
}

Diagram provides a visual representation of the system, or some aspect of it. For example, a diagram could illustrate the system's network architecture.

type DocumentIdentifier 

type DocumentIdentifier struct {
	Identifier string      `json:"identifier" yaml:"identifier"`             // The document identifier.
	Scheme     interface{} `json:"scheme,omitempty" yaml:"scheme,omitempty"` // Qualifies the kind of document identifier using a URI.
}

DocumentIdentifier represents a document identifier qualified by an identifier scheme.

type Evidence 

type Evidence struct {
	Id          primitive.ObjectID `json:"id" yaml:"id"`
	Title       string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string             `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

Evidence represents data or records collected during an assessment to support findings, observations, or attestations within the OSCAL assessment context. Evidence can include documents, screenshots, logs, or any other proof that verifies the state or behavior of a system.

Example: 

Evidence Type: Screenshot
Description: Screenshot showing that the auto-update feature is enabled.
URL: path/to/screenshot.png

type Facet 

type Facet struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`
	Name        string     `json:"name" yaml:"name"`
	Value       string     `json:"value" yaml:"value"`
	// One of: http://fedramp.gov, http://fedramp.gov/ns/oscal, http://csrc.nist.gov/ns/oscal, http://csrc.nist.gov/ns/oscal/unknown, http://cve.mitre.org, http://www.first.org/cvss/v2.0, http://www.first.org/cvss/v3.0, http://www.first.org/cvss/v3.1
	System string `json:"system" yaml:"system"`
}

Facet represents specific aspects or dimensions of a characterization in the OSCAL assessment context. Facets offer more granular details about the nature, source, or implications of an observation or finding.

Example for a Configuration Setting Characterization: 

Facet: Update Frequency
Detail: Describes how often the configuration setting updates.

type Finding 

type Finding struct {
	Id          primitive.ObjectID `json:"id" yaml:"id"`
	Title       string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string             `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// ImplementationStatementId Reference to the implementation statement in the SSP to which this finding is related.
	ImplementationStatementId primitive.ObjectID `json:"implementationStatementId" yaml:"implementationStatementId"`

	// Actors / Tasks Identify the source of the finding, such as a tool, interviewed person, or activity
	// Maps to the OSCAL "origins" property
	Actors []primitive.ObjectID `json:"originActors" yaml:"originActors"`
	Tasks  []primitive.ObjectID `json:"relatedTasks" yaml:"relatedTasks"`

	TargetId primitive.ObjectID `json:"target" yaml:"target"`

	RelatedObservations []primitive.ObjectID `json:"relatedObservations" yaml:"relatedObservations"`
	RelatedRisks        []primitive.ObjectID `json:"relatedRisks" yaml:"relatedRisks"`
}

Finding represents a conclusion or determination drawn from one or more observations, typically indicating compliance or non-compliance with specific requirements. Findings often lead to recommendations or actions.

Example: 

Finding: The "auto-update" feature's activation goes against the organization's policy
of manually vetting and approving system updates. This poses a potential security risk
as unvetted updates could introduce vulnerabilities.

type Group 

type Group struct {
	Uuid Uuid `json:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Class  string      `json:"class" yaml:"class"`
	Params []Parameter `json:"params" yaml:"params"`
	Groups []Uuid      `json:"groups" yaml:"groups"`
}

type Guideline 

type Guideline struct {
	Prose string `json:"prose" yaml:"prose"`
}

type HowManyType 

type HowManyType int
const (
	AllOf HowManyType = iota
	OneOf
	OneOrMore
)

type Impact 

type Impact struct {
	Props                   []Property `json:"props" yaml:"props"`
	Links                   []Link     `json:"links" yaml:"links"`
	Base                    string     `json:"base" yaml:"base"`
	Selected                string     `json:"selected" yaml:"selected"`
	AdjustmentJustification string     `json:"adjustment_justification" yaml:"adjustment_justification"`
}

type ImplementedRequirement 

type ImplementedRequirement struct {
	Uuid Uuid `json:"uuid" query:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	ControlId        Uuid                         `json:"control_id" query:"control_id" yaml:"control_id"`
	SetParameters    []ParameterValue             `json:"set_parameters" query:"set_parameters" yaml:"set_parameters"`
	ResponsibleRoles []Uuid                       `json:"responsible_roles" query:"responsible_roles" yaml:"responsible_roles"`
	Statements       []ControlDefinitionStatement `json:"statements" query:"statements" yaml:"statements"`
}

ImplementedRequirement Describes how the containing component or capability implements an individual control.

type Import 

type Import struct {
	// Href is the URI of the source catalog or profile. Should be in the format `catalog/{catalog_uuid}` or `profile/{profile_uuid}`.
	Href            string      `json:"href" yaml:"href"`
	IncludeAll      bool        `json:"include_all" yaml:"include_all"`
	IncludeControls []Selection `json:"include_controls" yaml:"include_controls"`
	ExcludeControls []Selection `json:"exclude_controls" yaml:"exclude_controls"`
}

Import Designates a referenced source catalog or profile that provides a source of control information for use in creating a new overlay or baseline.

type InformationType 

type InformationType struct {
	Uuid        Uuid       `json:"uuid" yaml:"uuid"`
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	AvailabilityImpact    Impact                          `json:"availability_impact" yaml:"availability_impact"`
	Categorizations       []InformationTypeCategorization `json:"categorizations" yaml:"categorizations"`
	ConfidentialityImpact Impact                          `json:"confidentiality_impact" yaml:"confidentiality_impact"`
	IntegrityImpact       Impact                          `json:"integrity_impact" yaml:"integrity_impact"`
}

type InformationTypeCategorization 

type InformationTypeCategorization struct {
	Ids    []string `json:"ids" yaml:"ids"`       // NOTE: This part is a bit blurred
	System string   `json:"system" yaml:"system"` // This is an enum but right now it has only one value: http://doi.org/10.6028/NIST.SP.800-60v2r1
}

type InventoryItem 

type InventoryItem struct {
	Uuid Uuid `json:"uuid" yaml:"uuid"`

	// A summary of the inventory item stating its purpose within the system.
	ImplementedComponents []Component `json:"implemented-components,omitempty" yaml:"implemented-components,omitempty"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Reference to Party docs
	ResponsibleParties []Uuid `json:"responsible-parties,omitempty" yaml:"responsible-parties,omitempty"`
}

InventoryItem A single managed inventory item within the system.

type JobSpecification 

type JobSpecification struct {
	Id          string            `json:"id" yaml:"id"`
	Title       string            `json:"title" yaml:"title"`
	PlanId      string            `json:"assessment-plan-id" yaml:"assessment-plan-id"`
	ComponentId string            `json:"component-id" yaml:"component-id"`
	ControlId   string            `json:"control-id" yaml:"control-id"`
	Tasks       []TaskInformation `json:"tasks" yaml:"tasks"`
}

JobSpecification is the model used to communicate with the runtime It is used to publish a plan to the runtime. The runtime will then use the information to execute the activities and publish the results back to the control-plane. Here's an example tailored specifically for Azure Cloud: Task: "Assess Azure cloud's storage security configuration." Activities could include: - "Review the Azure Blob storage access policies and Private Endpoint settings." - "Check for encryption at rest and in transit for Azure storage accounts." - "Evaluate Azure Shared Access Signatures (SAS) and Azure Storage Service Encryption (SSE)." One more example: Task: "Verify Azure network security settings." Activities could include: - "Review Azure Network Security Groups (NSGs) to ensure least privilege access." - "Assess Virtual Private Network (VPN) and ExpressRoute configurations for secure connectivity." - "Check Azure DDoS Protection settings to ensure resilience against DDoS attacks." In this scenario, the task provides the overall direction for the assessment (e.g., assessing storage security or network security on Azure), while the activities break this task down into smaller, concrete steps to follow.

type LeveragedAuthorization 

type LeveragedAuthorization struct {
	Uuid Uuid `json:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	DateAuthorized string `json:"date-authorized" yaml:"date-authorized"`

	// A machine-oriented identifier reference to the party that manages the leveraged system.
	Party Uuid `json:"party-uuid" yaml:"party-uuid"`
}

LeveragedAuthorization A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common catalog provider. 

type Link struct {
	Href             string `json:"href" yaml:"href"`
	MediaType        string `json:"mediaType" yaml:"mediaType"`
	Rel              string `json:"rel" yaml:"rel"`
	ResourceFragment string `json:"resourceFragment" yaml:"resourceFragment"`
	Text             string `json:"text" yaml:"text"`
}

Link

Hyperlink

type LocalDefinition 

type LocalDefinition struct {
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Reference to Activity
	Activities []string `json:"activities" yaml:"activities"`

	// Reference to component.Component
	Components []primitive.ObjectID `json:"components" yaml:"components"`

	// Reference to ssp.InventoryItem
	InventoryItems []primitive.ObjectID `json:"inventoryItems" yaml:"inventoryItems"`

	Objectives []Objective `json:"objectives" yaml:"objectives"`

	// Reference to identity.User
	Users []primitive.ObjectID `json:"users" yaml:"users"`
}

LocalDefinition

See Plan

type LogEntry 

type LogEntry struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Identifies the start date and time of an event.
	Start time.Time `json:"start" yaml:"start"`

	// Identifies the end date and time of an event. If the event is a point in time, the start and end will be the same date and time.
	End      time.Time            `json:"end" yaml:"end"`
	LoggedBy []primitive.ObjectID `json:"loggedBy" yaml:"loggedBy"`
}

LogEntry represents a record in an assessment log that documents a specific event or action during the assessment. A log entry can contain various information, including observations or findings, but it's essentially a chronological record.

Example: 

Date/Time: 2023-10-30 10:00 AM
Activity: Review of system configuration settings.
Actor: Jane Smith
Notes: Started the review of system settings as per the assessment plan. No anomalies observed at this time.

type Metadata 

type Metadata struct {
	Revisions             []Revision `json:"revisions" yaml:"revisions"`
	PartyUuids            []string   `json:"partyUuids" yaml:"partyUuids"`
	ResponsiblePartyUuids []string   `json:"responsiblePartyUuids" yaml:"responsiblePartyUuids"`
	RoleUuids             []string   `json:"roleUuids" yaml:"roleUuids"`
	Actions               []Action   `json:"actions" yaml:"actions"`
}

type MitigatingFactor 

type MitigatingFactor struct {
	Id               primitive.ObjectID   `json:"id" yaml:"id"`
	ImplementationId primitive.ObjectID   `json:"implementationId" yaml:"implementationId"`
	Description      string               `json:"description" yaml:"description"`
	Props            []Property           `json:"props,omitempty" yaml:"props,omitempty"`
	Links            []Link               `json:"links,omitempty" yaml:"links,omitempty"`
	Subjects         []primitive.ObjectID `json:"subjects" yaml:"subjects"`
}

MitigatingFactor Describes an existing mitigating factor that may affect the overall determination of the risk, with an optional link to an implementation statement in the SSP.

type NetworkArchitecture 

type NetworkArchitecture struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Diagrams []Diagram `json:"diagrams,omitempty" yaml:"diagrams,omitempty"`
}

NetworkArchitecture A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture.

type Objective 

type Objective struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`

	Links      []Link   `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks    string   `json:"remarks,omitempty" yaml:"remarks,omitempty"`
	IncludeAll bool     `json:"includeAll" yaml:"includeAll"`
	Exclude    []string `json:"exclude" yaml:"exclude"`
	Include    []string `json:"include" yaml:"include"`

	// Reference to Activity
	Activities []string `json:"activities" yaml:"activities"`

	// Reference to component.Component
	Components []primitive.ObjectID `json:"components" yaml:"components"`

	// Reference to ssp.InventoryItem
	InventoryItems []primitive.ObjectID `json:"inventoryItems" yaml:"inventoryItems"`

	Objectives []Objective `json:"objectives" yaml:"objectives"`

	// Reference to identity.User
	Users []primitive.ObjectID `json:"users" yaml:"users"`
}

Objective

An Objective is a local objective: a security control or requirement that is specific to the system or organization under assessment.

type ObjectiveSelection 

type ObjectiveSelection struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`

	Links      []Link   `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks    string   `json:"remarks,omitempty" yaml:"remarks,omitempty"`
	IncludeAll bool     `json:"includeAll" yaml:"includeAll"`
	Exclude    []string `json:"exclude" yaml:"exclude"`
	Include    []string `json:"include" yaml:"include"`
}

ObjectiveSelection

Objectives included and excluded.

type Observation 

type Observation struct {
	Id          primitive.ObjectID  `json:"id" yaml:"id"`
	Title       string              `json:"title,omitempty" yaml:"title,omitempty"`
	Description string              `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property          `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link              `json:"links,omitempty" yaml:"links,omitempty"`
	Methods     []ObservationMethod `json:"methods" yaml:"methods"`
	Types       []ObservationType   `json:"types" yaml:"types"`

	// Actors / Tasks Identify the source of the finding, such as a tool, interviewed person, or activity
	Actors []primitive.ObjectID `json:"originActors" yaml:"originActors"`
	Tasks  []primitive.ObjectID `json:"relatedTasks" yaml:"relatedTasks"`

	Subjects         []primitive.ObjectID `json:"subjects" yaml:"subjects"`
	RelevantEvidence []Evidence           `json:"evidences" yaml:"evidences"`
	Collected        time.Time            `json:"collected" yaml:"collected"`
	Expires          time.Time            `json:"expires" yaml:"expires"`
	Remarks          string               `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

Observation represents a note or remark made by an assessor about something they noticed during the assessment. It is a neutral statement that captures what was seen or understood without necessarily assigning a value judgment.

Example: 

During the system configuration review, it was observed that the "auto-update" feature was enabled.

type ObservationMethod 

type ObservationMethod string
const (
	ObservationMethodExamine   ObservationMethod = "examine"
	ObservationMethodInterview ObservationMethod = "interview"
	ObservationMethodTest      ObservationMethod = "test"
	ObservationMethodUnknown   ObservationMethod = "unknown"
)

type ObservationType 

type ObservationType string
const (
	ObservationTypeSSPStatementIssue ObservationType = "ssp-statement-issue"
	ObservationTypeControlObjective  ObservationType = "control-objective"
	ObservationTypeMitigation        ObservationType = "mitigation"
	ObservationTypeFinding           ObservationType = "finding"
	ObservationTypeHistoric          ObservationType = "historic"
)

type OperationalStatus 

type OperationalStatus int
const (
	Disposition OperationalStatus = iota
	Operational
	Other
	UnderDevelopment
	UnderMajorModification
)

func (OperationalStatus) String 

func (os OperationalStatus) String() string

type Parameter 

type Parameter struct {
	Uuid        Uuid               `json:"uuid" yaml:"uuid"`
	Class       string             `json:"class" yaml:"class"`
	Props       []Property         `json:"props" yaml:"props"`
	Links       []Link             `json:"links" yaml:"links"`
	Label       string             `json:"label" yaml:"label"`
	Usage       string             `json:"usage" yaml:"usage"`
	Constraints []Constraint       `json:"constraints" yaml:"constraints"`
	Guidelines  []Guideline        `json:"guidelines" yaml:"guidelines"`
	Values      []string           `json:"values" yaml:"values"`
	Select      ParameterSelection `json:"select" yaml:"select"`
	Remarks     string             `json:"remarks" yaml:"remarks"`
}

type ParameterSelection 

type ParameterSelection struct {
	HowMany HowManyType
	Choices []string
}

type ParameterValue 

type ParameterValue struct {
	ParamId Uuid     `json:"parameter" query:"parameter" yaml:"parameter"`
	Values  []string `json:"values" query:"values" yaml:"values"`
	Remarks string   `json:"remarks" query:"remarks" yaml:"remarks"`
}

type Part 

type Part struct {
	// An optional textual providing a sub-type or characterization of the part's name, or a category to which the part belongs.
	Class string `json:"class,omitempty" yaml:"class,omitempty"`

	// A unique identifier for the part.
	Id    string `json:"id,omitempty" yaml:"id,omitempty"`
	Links []Link `json:"links,omitempty" yaml:"links,omitempty"`

	// A textual label that uniquely identifies the part's semantic type, which exists in a value space qualified by the ns.
	Name string `json:"name" yaml:"name"`

	// An optional namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.
	Ns    string     `json:"ns,omitempty" yaml:"ns,omitempty"`
	Props []Property `json:"props,omitempty" yaml:"props,omitempty"`

	// Permits multiple paragraphs, lists, tables etc.
	Prose string `json:"prose,omitempty" yaml:"prose,omitempty"`

	// An optional name given to the part, which may be used by a tool for display and navigation.
	Title string `json:"title,omitempty" yaml:"title,omitempty"`
}

Part An annotated, markup-based textual element of a catalog's or catalog group's definition, or a child of another part.

type Party 

type Party struct {
	Uuid string `json:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Parties represents the UUIDs of the child `Party` data
	Parties []Uuid `json:"parties" yaml:"parties"`

	// Roles represents the UUIDs of the `Role` responsible for the action.
	Roles []Uuid    `json:"roles" yaml:"roles"`
	Type  PartyType `json:"type" yaml:"type"`
}

type PartyType 

type PartyType int
const (
	PersonPartyType PartyType = iota
	GroupPartyType
	OrganizationPartyType
)

type Plan 

type Plan struct {
	Id primitive.ObjectID `bson:"_id,omitempty" json:"id" yaml:"id"`

	// Status The status of the assessment plan, such as "active" or "inactive".
	// These statuses are subject to change.
	Status string `json:"status,omitempty" yaml:"status,omitempty"`

	// We might switch to struct embedding for fields like Metadata, Props, etc.
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// Tasks Represents a scheduled event or milestone, which may be associated with a series of assessment actions.
	Tasks []Task `json:"tasks" yaml:"tasks"`

	// Title A name given to the assessment plan. OSCAL doesn't have this, but we need it for our use case.
	Title string `json:"title,omitempty" yaml:"title,omitempty"`

	// The following fields are part of the OSCAL spec, but we don't use them yet.
	// Assets Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions. Mostly CF in our case.
	Assets Assets `json:"assets" yaml:"assets"`
	// BackMatter A collection of resources that may be referenced from within the OSCAL document instance.
	BackMatter BackMatter `json:"backMatter" yaml:"backMatter"`
	// Reference to a System Security Plan
	ImportSSP string `json:"importSSP" yaml:"importSSP"`
	// LocalDefinitions Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.
	// Reference to LocalDefinition
	LocalDefinitions LocalDefinition `json:"localDefinitions" yaml:"localDefinitions"`
	// ReviewedControls Identifies the controls being assessed and their control objectives.
	ReviewedControls []ControlsAndObjectives `json:"reviewedControls" yaml:"reviewedControls"`
	// TermsAndConditions Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.
	TermsAndConditions []Part `json:"termsAndConditions" yaml:"termsAndConditions"`

	Results []Result `json:"results" yaml:"results"`
}

Plan

An assessment plan, such as those provided by a FedRAMP assessor. Here are some real-world examples for Assets, Platforms, Subjects and Inventory Items within an OSCAL Assessment Plan:

1. Assets: This could be something like a customer database within a retail company. It's an asset because it's crucial to the business operation, storing all the essential customer details such as addresses, contact information, and purchase history. 2. Platforms: This could be the retail company's online E-commerce platform which hosts their online store, and where transactions occur. The platform might involve web servers, database servers, or a cloud environment. 3. Subjects: If the company is performing a security assessment, the subject could be the encryption method or security protocols used to protect the customer data while in transit or at rest in the database. 4. Inventory Items: These could be the individual servers or workstations used within the company. Inventory workstations are the physical machines or software applications used by employees that may have vulnerabilities or exposure to risk that need to be tracked and mitigated.

Relation between Tasks, Activities and Steps:

Scenario: Conducting a cybersecurity assessment of an organization's systems.

1. Task: The major task could be "Conduct vulnerability scanning on servers." 2. Activity: Within this task, an activity could be "Prepare servers for vulnerability scan." 3. Step: The steps that make up this activity could be things like:

  • "Identify all servers"
  • "Ensure necessary permissions are in place for scanning"
  • "Check that scanning software is properly installed and updated."

Another activity under the same task could be "Execute vulnerability scanning," and steps for that activity might include:

1. "Begin scanning process through scanning software." 2. "Monitor progress of scan." 3. "Document any issues or vulnerabilities identified."

The process would continue like this with tasks broken down into activities, and activities broken down into steps.

These concepts still apply in the context of automated tools or systems. In fact, the OSCAL model is designed to support both manual and automated processes. 1. Task: The major task could be “Automated Compliance Checking” 2. Activity: This task could have multiple activities such as: ▪ “Configure Automated Tool with necessary parameters” ▪ “Run Compliance Check” ▪ “Collect and Analyze Compliance Data” 3. Step: In each of these activities, there are several subprocesses or actions (Steps). For example, under “Configure Automated Tool with necessary parameters”, the steps could be: ▪ “Define the criteria based on selected standards” ▪ “Set the scope or target systems for the assessment” ▪ “Specify the output (report) format” In context of an automated compliance check, the description of Task, Activity, and Step provides a systematic plan or procedure that the tool is expected to follow. This breakdown of tasks, activities, and steps could also supply useful context and explain the tool’s operation and results to system admins, auditors or other stakeholders. It also allows for easier troubleshooting in the event of problems.

func NewPlan 

func NewPlan() *Plan

func (*Plan) AddAsset 

func (p *Plan) AddAsset(assetId string, assetType string) error

func (*Plan) GetTask 

func (p *Plan) GetTask(id string) *Task

func (*Plan) JobSpecification 

func (p *Plan) JobSpecification() JobSpecification

func (*Plan) Ready 

func (p *Plan) Ready() bool

type PlanPrecis 

type PlanPrecis struct {
	Id primitive.ObjectID `bson:"_id,omitempty" json:"id" yaml:"id"`
	// Title A name given to the assessment plan. OSCAL doesn't have this, but we need it for our use case.
	Title string `json:"title,omitempty" yaml:"title,omitempty"`
}

A PlanPrecis is a cut down version of a plan limited to one level so user can get a view of what the plan is about.

type Platform 

type Platform struct {
	Id          primitive.ObjectID `json:"id" yaml:"id"`
	Title       string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property         `json:"props,omitempty" yaml:"props,omitempty"`

	Links   []Link `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// Reference to component.Component
	UsesComponents []string `json:"usesComponents" yaml:"usesComponents"`
}

Platform

See Plan above

type Profile 

type Profile struct {
	Uuid Uuid `json:"uuid" yaml:"uuid"`

	Metadata

	Imports    []Import   `json:"imports" yaml:"imports"`
	BackMatter BackMatter `json:"backmatter" yaml:"backmatter"`
}

Profile is a collection of controls and metadata that can be used to create a new overlay or baseline. Note: The "Merge" and "Modify" are being skipped for now, as it doesn't make any sense to store the instructions for merging and modifying, rather than the result of applying them. They can be added as audit logs, holding all the details of the merge and modify operations.

type ProfileSelection 

type ProfileSelection struct {
	WithChildControls bool   `json:"with_child_controls" yaml:"with_child_controls"`
	WithIds           []Uuid `json:"with_ids" yaml:"with_ids"`
	Matching          []struct {
		Pattern string `json:"pattern" yaml:"pattern"`
	} `json:"matching" yaml:"matching"`
}

ProfileSelection Selects a control or controls from an imported control set (Profile | Catalog).

type Property 

type Property struct {
	Name    string `json:"name" yaml:"name"`
	Class   string `json:"class" yaml:"class"`
	Group   string `json:"group" yaml:"group"`
	Ns      string `json:"ns" yaml:"ns"`
	Remarks string `json:"remarks" yaml:"remarks"`
	Value   string `json:"value" yaml:"value"`
}

type Provider 

type Provider struct {
	Name          string            `json:"name" yaml:"name"`
	Image         string            `json:"image" yaml:"image"`
	Tag           string            `json:"tag" yaml:"tag"`
	Configuration map[string]string `json:"configuration" yaml:"configuration"`
}

type Resource 

type Resource struct {
	Base64      *Base64              `json:"base64,omitempty" yaml:"base64,omitempty"`             // A resource encoded using the Base64 alphabet.
	Citation    *Citation            `json:"citation,omitempty" yaml:"citation,omitempty"`         // An optional citation associated with the resource.
	Description string               `json:"description,omitempty" yaml:"description,omitempty"`   // An optional short summary of the resource.
	DocumentIds []DocumentIdentifier `json:"document-ids,omitempty" yaml:"document-ids,omitempty"` // Document identifiers associated with the resource.
	Props       []Property           `json:"props,omitempty" yaml:"props,omitempty"`               // Properties of the resource.
	Remarks     string               `json:"remarks,omitempty" yaml:"remarks,omitempty"`           // Remarks about the resource.
	Rlinks      []Link               `json:"rlinks,omitempty" yaml:"rlinks,omitempty"`             // Related links of the resource.
	Title       string               `json:"title,omitempty" yaml:"title,omitempty"`               // An optional name given to the resource.
	Uuid        Uuid                 `json:"uuid" yaml:"uuid"`                                     // A unique identifier for a resource.
}

Resource represents a resource associated with content in the containing document instance.

type Response 

type Response struct {
	Id primitive.ObjectID `json:"id" yaml:"id"`

	// Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.
	// One of: recommendation, planned, completed
	Lifecycle string `json:"lifecycle" yaml:"lifecycle"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`

	// Actors / Tasks Identify the source of the finding, such as a tool, interviewed person, or activity
	Actors []primitive.ObjectID `json:"originActors" yaml:"originActors"`
	Tasks  []primitive.ObjectID `json:"relatedTasks" yaml:"relatedTasks"`
}

Response Describes either recommended or an actual plan for addressing the risk. TODO: Needs more work

type Result 

type Result struct {
	Id               primitive.ObjectID      `json:"id" yaml:"id"`
	Title            string                  `json:"title,omitempty" yaml:"title,omitempty"`
	Description      string                  `json:"description,omitempty" yaml:"description,omitempty"`
	Start            time.Time               `json:"start" yaml:"start"`
	End              time.Time               `json:"end" yaml:"end"`
	Props            []Property              `json:"props,omitempty" yaml:"props,omitempty"`
	Links            []Link                  `json:"links,omitempty" yaml:"links,omitempty"`
	LocalDefinitions LocalDefinition         `json:"localDefinitions" yaml:"localDefinitions"`
	ReviewedControls []ControlsAndObjectives `json:"reviewedControls" yaml:"reviewedControls"`
	AssessmentLog    []LogEntry              `json:"assessmentLogEntries" yaml:"assessmentLogEntries"`
	Attestations     []Attestation           `json:"attestations" yaml:"attestations"`
	Observations     []Observation           `json:"observations" yaml:"observations"`
	Risks            []Risk                  `json:"risks" yaml:"risks"`
	Findings         []Finding               `json:"findings" yaml:"findings"`
	Remarks          string                  `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type Revision 

type Revision struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Published    time.Time `json:"published" yaml:"published"`
	LastModified time.Time `json:"lastModified" yaml:"lastModified"`
	Version      string    `json:"version" yaml:"version"`
	OscalVersion string    `json:"oscalVersion" yaml:"oscalVersion"`
}

func NewRevision 

func NewRevision(title string, description string, remarks string) Revision

func (*Revision) BumpMajor 

func (r *Revision) BumpMajor(title string, description string, remarks string) Revision

func (*Revision) BumpMinor 

func (r *Revision) BumpMinor(title string, description string, remarks string) Revision

func (*Revision) BumpPatch 

func (r *Revision) BumpPatch(title string, description string, remarks string) Revision

type Risk 

type Risk struct {
	Id primitive.ObjectID `json:"id" yaml:"id"`

	// The title for this risk.
	Title string `json:"title,omitempty" yaml:"title,omitempty"`

	// A human-readable summary of the identified risk, to include a statement of how the risk impacts the system.
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// A summary of impact for how the risk affects the system.
	Statement string `json:"statement,omitempty" yaml:"statement,omitempty"`

	Props []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links []Link     `json:"links,omitempty" yaml:"links,omitempty"`

	// Describes the status of the risk.
	Status RiskStatus `json:"status" yaml:"status"`

	// Actors / Tasks Identify the source of the finding, such as a tool, interviewed person, or activity
	Actors []primitive.ObjectID `json:"originActors" yaml:"originActors"`
	Tasks  []primitive.ObjectID `json:"relatedTasks" yaml:"relatedTasks"`

	Threats             []primitive.ObjectID `json:"threats" yaml:"threats"`
	Characterizations   []Characterization   `json:"characterizations" yaml:"characterizations"`
	MitigatingFactors   []primitive.ObjectID `json:"mitigatingFactors" yaml:"mitigatingFactors"`
	Deadline            time.Time            `json:"deadline" yaml:"deadline"`
	Remediations        []Response           `json:"remediations" yaml:"remediations"`
	Log                 []RiskLogEntry       `json:"riskLog" yaml:"riskLog"`
	RelatedObservations []primitive.ObjectID `json:"relatedObservations" yaml:"relatedObservations"`
}

Risk represents a potential event or circumstance that may exploit a vulnerability in a system or its environment. Risks often have associated impacts and likelihoods, which help in determining their severity and priority.

A risk is typically identified from findings and can lead to recommendations or mitigating actions to address or reduce the potential impact.

Example: 

Risk: Due to the "auto-update" feature being enabled, there's a chance that
unvetted system updates could introduce vulnerabilities.
Impact: High - This could compromise the integrity of the system.
Likelihood: Medium - Based on past updates and the frequency of potentially harmful updates.

type RiskLogEntry 

type RiskLogEntry struct {
	Id          primitive.ObjectID `json:"id" yaml:"id"`
	Title       string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description string             `json:"description,omitempty" yaml:"description,omitempty"`
	Start       time.Time          `json:"start" yaml:"start"`
	End         time.Time          `json:"end" yaml:"end"`
	Props       []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	LoggedBy    Actor              `json:"loggedBy" yaml:"loggedBy"`
}

type RiskStatus 

type RiskStatus string
const (
	RiskStatusOpen               RiskStatus = "open"
	RiskStatusInvestigating      RiskStatus = "investigating"
	RiskStatusRemediating        RiskStatus = "remediating"
	RiskStatusDeviationRequested RiskStatus = "deviation-requested"
	RiskStatusDeviationApproved  RiskStatus = "deviation-approved"
	RiskStatusClosed             RiskStatus = "closed"
)

type Role 

type Role struct {
	Uuid string `json:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	// PartyUuids holds the UUIDs of the `Party` data. Supports many-to-many relationship.
	PartyUuids []string `json:"partyUuids" yaml:"partyUuids"`
}

type SecurityImpactLevel 

type SecurityImpactLevel struct {
	ObjectiveAvailability    string `json:"objective_availability" yaml:"objective_availability"`
	ObjectiveConfidentiality string `json:"objective_confidentiality" yaml:"objective_confidentiality"`
	ObjectiveIntegrity       string `json:"objective_integrity" yaml:"objective_integrity"`
}

type Selection 

type Selection struct {
	IncludeAll bool   `json:"includeAll" yaml:"includeAll"`
	Exclude    []Uuid `json:"exclude" yaml:"exclude"`
	Include    []Uuid `json:"include" yaml:"include"`
}

type Statement 

type Statement struct {
	// TODO: By-components
	Uuid Uuid   `json:"uuid" yaml:"uuid"`
	Id   string `json:"id" yaml:"id"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	ResponsibleRoles []Uuid `json:"responsibleRoles" yaml:"responsibleRoles"`
}

type Subject 

type Subject struct {
	Id          primitive.ObjectID `json:"id" yaml:"id"`
	SubjectId   string             `json:"subjectId" yaml:"subjectId"`
	Type        SubjectType        `json:"type" yaml:"type"`
	Title       string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string             `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

Subject

Subject Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment.

type SubjectMatchExpression 

type SubjectMatchExpression struct {
	Key      string   `json:"key" yaml:"key"`
	Operator string   `json:"operator" yaml:"operator"`
	Values   []string `json:"values" yaml:"values"`
}

type SubjectSelection 

type SubjectSelection struct {
	Title       string                   `json:"title,omitempty" yaml:"title,omitempty"`
	Description string                   `json:"description,omitempty" yaml:"description,omitempty"`
	Query       string                   `json:"query,omitempty" yaml:"query,omitempty"`
	Labels      map[string]string        `json:"labels,omitempty" yaml:"labels,omitempty"`
	Expressions []SubjectMatchExpression `json:"expressions,omitempty" yaml:"expressions,omitempty"`
	Ids         []string                 `json:"ids,omitempty" yaml:"ids,omitempty"`
}

SubjectSelection

SubjectSelection Identifies system elements being assessed, such as components, inventory items, and locations by specifying a selection criteria. We do not directly store SubjectIds as we might not know the actual subjects before running the assessment. The assessment runtime evaluates the selection by running the providers and returns back with subject ids.

func (*SubjectSelection) Valid 

func (s *SubjectSelection) Valid() bool

type SubjectType 

type SubjectType string
const (
	SubjectTypeComponent     SubjectType = "component"
	SubjectTypeInventoryItem SubjectType = "inventoryItem"
	SubjectTypeLocation      SubjectType = "location"
	SubjectTypeParty         SubjectType = "party"
	SubjectTypeUser          SubjectType = "user"
)

type SystemCharacteristics 

type SystemCharacteristics struct {
	Uuid Uuid `json:"uuid" yaml:"uuid"`

	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Metadata `yaml:",inline"`

	AuthorizationBoundary AuthorizationBoundary `json:"authorization_boundary" yaml:"authorization_boundary"`
	ControlImplementation []Uuid                `json:"control_implementation" yaml:"control_implementation"`
	DataFlow              DataFlow              `json:"data_flow" yaml:"data_flow"`
	DateAuthorized        time.Time             `json:"date_authorized" yaml:"date_authorized"`
	ImportProfile         []Uuid                `json:"import_profile" yaml:"import_profile"`
	NetworkArchitecture   NetworkArchitecture   `json:"network_architecture" yaml:"network_architecture"`
	ResponsibleParties    []Uuid                `json:"responsible_parties" yaml:"responsible_parties"`
	SecurityImpactLevel   SecurityImpactLevel   `json:"security_impact_level" yaml:"security_impact_level"`

	// The overall information system sensitivity categorization, such as defined by FIPS-199.
	SecuritySensitivityLevel string            `json:"security_sensitivity_level" yaml:"security_sensitivity_level"`
	Status                   OperationalStatus `json:"status" yaml:"status"`

	// One of http://fedramp.gov/ns/oscal, https://fedramp.gov", http://ietf.org/rfc/rfc4122", https://ietf.org/rfc/rfc4122
	SystemIds         []string          `json:"system_ids" yaml:"system_ids"`
	SystemInformation SystemInformation `json:"system_information" yaml:"system_information"`

	// The full name of the system.
	SystemName string `json:"system_name" yaml:"system_name"`

	// A short name for the system, such as an acronym, that is suitable for display in a data table or summary list.
	SystemNameShort string `json:"system_name_short" yaml:"system_name_short"`
}

SystemCharacteristics Contains the characteristics of the system, such as its name, purpose, and security impact level.

type SystemImplementation 

type SystemImplementation struct {
	Title       string     `json:"title,omitempty" yaml:"title,omitempty"`
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	Components              []Component              `json:"components" yaml:"components"`
	InventoryItems          []InventoryItem          `json:"inventory-items,omitempty" yaml:"inventory-items,omitempty"`
	LeveragedAuthorizations []LeveragedAuthorization `json:"leveraged-authorizations,omitempty" yaml:"leveraged-authorizations,omitempty"`
	Users                   []User                   `json:"users" yaml:"users"`
}

SystemImplementation Provides information as to how the system is implemented.

type SystemInformation 

type SystemInformation struct {
	// Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60.
	InformationTypes []InformationType `json:"information_types" yaml:"information_types"`
	Links            []Link            `json:"links" yaml:"links"`
	Props            []Property        `json:"props" yaml:"props"`
	Uuid             Uuid              `json:"uuid" yaml:"uuid"`
}

type SystemSecurityPlan 

type SystemSecurityPlan struct {
	Title      string     `json:"title" yaml:"title"`
	Uuid       Uuid       `json:"uuid" yaml:"uuid"`
	BackMatter BackMatter `json:"backmatter" yaml:"backmatter"`
	Metadata   `yaml:",inline"`

	// Reference to the control implementation
	ControlImplementation []Uuid `json:"control_implementation" yaml:"control_implementation"`

	// Reference to a profile
	ImportProfile         Uuid                  `json:"import_profile" yaml:"import_profile"`
	SystemCharacteristics SystemCharacteristics `json:"system_characteristics" yaml:"system_characteristics"`
}

type Target 

type Target struct {
	TargetId    primitive.ObjectID `json:"targetId" yaml:"targetId"`
	Title       string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string             `json:"remarks,omitempty" yaml:"remarks,omitempty"`
	Status      TargetStatus       `json:"status" yaml:"status"`
}

Target Captures an assessor's conclusions regarding the degree to which an objective is satisfied. It represents an item or entity that is the subject of an assessment within the OSCAL context. It can be a system component, process, configuration, or any other element that has undergone assessment. Each target has a unique identifier and may contain additional metadata or details relevant to the assessment.

Example: 

TargetId ID: server-1234
Type: System Component
Description: Primary web server running in the production environment.

type TargetStatus 

type TargetStatus struct {
	// An indication whether the objective is satisfied or not. [Pass/Fail/Other]
	State   string `json:"state" yaml:"state"`
	Reason  string `json:"reason" yaml:"reason"`
	Remarks string `json:"remarks" yaml:"remarks"`
}

type Task 

type Task struct {
	Id               primitive.ObjectID `json:"id" yaml:"id"`
	Title            string             `json:"title,omitempty" yaml:"title,omitempty"`
	Description      string             `json:"description,omitempty" yaml:"description,omitempty"`
	Props            []Property         `json:"props,omitempty" yaml:"props,omitempty"`
	Links            []Link             `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks          string             `json:"remarks,omitempty" yaml:"remarks,omitempty"`
	Type             TaskType           `json:"type" yaml:"type"`
	Activities       []Activity         `json:"activities" yaml:"activities"`
	Dependencies     []TaskDependency   `json:"dependencies" yaml:"dependencies"`
	ResponsibleRoles []Uuid             `json:"responsibleRoles" yaml:"responsibleRoles"`
	// Subjects hold all the subjects that the activities act upon.
	// TODO: Should this be []Subject?
	Subjects []primitive.ObjectID `json:"subjects" yaml:"subjects"`
	Tasks    []Uuid               `json:"tasks" yaml:"tasks"`
	Schedule string               `json:"schedule" yaml:"schedule"`
}

Task

See Plan above

func (*Task) AddActivity 

func (t *Task) AddActivity(activity Activity) error

type TaskDependency 

type TaskDependency struct {
	TaskId  primitive.ObjectID `json:"taskUuid" yaml:"taskUuid"`
	Remarks string             `json:"remarks" yaml:"remarks"`
}

TaskDependency

A dependency for a Task

type TaskInformation 

type TaskInformation struct {
	Id         string                `json:"id" yaml:"id"`
	Title      string                `json:"title" yaml:"title"`
	Schedule   string                `json:"schedule" yaml:"schedule"`
	Activities []ActivityInformation `json:"activities" yaml:"activities"`
}

type TaskType 

type TaskType string
const (
	TaskTypeMilestone TaskType = "milestone"
	TaskTypeAction    TaskType = "action"
)

type Threat 

type Threat struct {
	Id     primitive.ObjectID `json:"id" yaml:"id"`
	System string             `json:"system" yaml:"system"`
	Href   string             `json:"href" yaml:"href"`
}

type User 

type User struct {
	AuthorizedPrivileges []CommonAuthorizedPrivilege `json:"authorized-privileges,omitempty" yaml:"authorized-privileges,omitempty"`

	// A summary of the user's purpose within the system.
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	Props       []Property `json:"props,omitempty" yaml:"props,omitempty"`
	Links       []Link     `json:"links,omitempty" yaml:"links,omitempty"`
	Remarks     string     `json:"remarks,omitempty" yaml:"remarks,omitempty"`

	RoleIds []string `json:"role-ids,omitempty" yaml:"role-ids,omitempty"`

	// A short common name, abbreviation, or acronym for the user.
	ShortName string `json:"short-name,omitempty" yaml:"short-name,omitempty"`

	// A name given to the user, which may be used by a tool for display and navigation.
	Title string `json:"title,omitempty" yaml:"title,omitempty"`

	// A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this user class elsewhere in this or other OSCAL instances. The locally defined UUID of the system user can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
	Uuid string `json:"uuid" yaml:"uuid"`
}

User A type of user that interacts with the system based on an associated role.

type Uuid 

type Uuid string

func NewUuid 

func NewUuid() Uuid

func (Uuid) String 

func (u Uuid) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.