Skip to content

POAM Item should have a related-finding assembly #1120

@vmangat

Description

@vmangat

User Story:

As an OSCAL tool developer, it is a challenge to identify a "target" or the implementation-statement-uuid for a specific poam-item without traversing through the observations of the poam-item and then correlating these observations with the related-observations in the findings

Goals:

This can be implemented by including an assembly in poam-items as follows:

related-findings [0 or 1]: [
        An array of related-findings objects [1 to ∞] {
              finding-uuid [1]: uuid
        }
], 

or

by use of a link with rel='related-finding'.

  • Develop a proposal for implementing this as an assembly and a link
  • Socialize both approaches at an OSCAL model review
  • Implement the consensus approach.

Dependencies:

None. This would be a backward compatible change that could be added in v1.0.2

Acceptance Criteria

  • A link rel has been added to support this in the poam-item.
  • An example has been created to illustrate this.
  • All OSCAL website and readme documentation affected by the changes in this issue have been updated. Changes to the OSCAL website can be made in the docs/content directory of your branch.
  • A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
  • The CI-CD build process runs without any reported errors on the PR. This can be confirmed by reviewing that all checks have passed in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

Metadata

Metadata

Labels

Discussion NeededThis issues needs to be reviewed by the OSCAL development team.Model EngineeringAn issue to be discussed during the bi-weekly Model Engineering MeetingUser Storyenhancement

Type

No type
No fields configured for issues without a type.

Projects

Status
Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions