Requests for Topics and Feedback on OSCAL Lunch with the Devs Meeting on 20221020

[aj-stein-nist]

Hello everyone, we just wanted to offer community members a way to propose topics or give feedback for the OSCAL Model Review Meeting on October 20, 2022. Below is the tentative agenda.

• Review Meeting Ground Rules
• OSCAL Status Summary
• Review current active issues
• Open discussion

Most importantly, the team wants your feedback, fellow community member! Here are issues scoped for development during the current sprint (which runs the month of October). Please comment on them before, during, or after the meeting.

https://github.com/orgs/usnistgov/projects/25/views/2

Don't see something here or ☝️ in the list? Feel free to either post a comment here, vote up existing comments, or reply to the email in our [email protected] mailing list (signup instructions on our website) with your topic ideas or ongoing feedback. Thanks in advance!

[GaryGapinski]

Caveat: I will miss the first 30 minutes of the 2022-10-20 meeting and thus this could/should be relegated to a subsequent meeting.

The subject of OSCAL representations of SP 800-53 and SP 800-53A recently received additional attention in the FedRAMP OSCAL venue. The (ill-advised, in my opinion) changes to the main branch of https://github.com/usnistgov/oscal-content vs the v1.0.0 version caused harm when an attempt to accommodate and integrate SP 800-53A was made. Implementation difficulties ensue. I will review the changes (ideally within a week) with an intent to isolate the 800-53A considerations so that the 800-53A pseudo-parameters and assessment objectives can be derived from, mapped to, and separated from the SP 800-53 content. This will provide bijective mapping between OSCAL SSP and OSCAL catalog (and OSCAL catalog and SP 800-53).

This will (ultimately) likely require a formal definition of the 800-53A derivation from 800-53 so that changes to the former can be predicted from changes to the latter — not the other way around.

Related:
usnistgov/oscal-content#86
usnistgov/oscal-content#123
usnistgov/oscal-content#147
#1069

[david-waltermire]

@GaryGapinski I'd like to discuss what we can do to support your request. @aj-stein-nist Perhaps we can discuss this in the second half of the meeting when Gary joins?

[aj-stein-nist]

Sounds like a plan to me!