From aba9a26000869e1be2526b8759a6397888cfd1de Mon Sep 17 00:00:00 2001
From: DimitriZhurkin <dimitri.zhurkin@noblis.org>
Date: Fri, 22 Nov 2024 13:17:36 -0700
Subject: [PATCH 1/3] Add external-system-nature-of-agreement

---
 features/fedramp_extensions.feature           |  3 +++
 .../constraints/content/ssp-all-VALID.xml     | 11 ++++++++++
 ...nal-system-nature-of-agreement-INVALID.xml | 22 +++++++++++++++++++
 .../fedramp-external-allowed-values.xml       | 13 +++++++++++
 ...ernal-system-nature-of-agreement-FAIL.yaml |  8 +++++++
 ...ernal-system-nature-of-agreement-PASS.yaml |  8 +++++++
 6 files changed, 65 insertions(+)
 create mode 100644 src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml
 create mode 100644 src/validations/constraints/unit-tests/external-system-nature-of-agreement-FAIL.yaml
 create mode 100644 src/validations/constraints/unit-tests/external-system-nature-of-agreement-PASS.yaml

diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
index cf7407a31..d260dd8bd 100644
--- a/features/fedramp_extensions.feature
+++ b/features/fedramp_extensions.feature
@@ -42,6 +42,7 @@ Examples:
   | data-center-primary |
   | data-center-us |
   | deployment-model |
+  | external-system-nature-of-agreement |
   | fedramp-version |
   | fully-operational-date-is-valid |
   | fully-operational-date-type |
@@ -181,6 +182,8 @@ Examples:
   | data-center-us-PASS.yaml |
   | deployment-model-FAIL.yaml |
   | deployment-model-PASS.yaml |
+  | external-system-nature-of-agreement-FAIL.yaml |
+  | external-system-nature-of-agreement-PASS.yaml |
   | fedramp-version-FAIL.yaml |
   | fedramp-version-PASS.yaml |
   | fully-operational-date-is-valid-FAIL.yaml |
diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml
index 65bfbc915..bfdb19693 100644
--- a/src/validations/constraints/content/ssp-all-VALID.xml
+++ b/src/validations/constraints/content/ssp-all-VALID.xml
@@ -327,6 +327,17 @@
         <p>This connection is used for secure data exchange with external systems.</p>
       </remarks>
     </component>
+
+    <component uuid="77777777-0000-4000-9000-000000000007" type="system">
+      <title>Name of External System</title>
+      <description>
+          <p>Briefly describe the external system.</p>
+      </description>
+      <prop name="inherited-uuid" value="11111111-0000-4000-9001-000000000001"/>
+      <prop name="implementation-point" value="external"/>
+      <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="isa"/>
+      <status state="operational"/>
+    </component>
     
     <inventory-item uuid="77777777-0000-4000-9000-000000000007">
       <description>
diff --git a/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml b/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml
new file mode 100644
index 000000000..beed271a3
--- /dev/null
+++ b/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  
+  <system-implementation>
+
+    <component uuid="77777777-0000-4000-9000-000000000007" type="system">
+      <title>Name of External System</title>
+      <description>
+          <p>Briefly describe the external system.</p>
+      </description>
+      <prop name="inherited-uuid" value="11111111-0000-4000-9001-000000000001"/>
+      <prop name="implementation-point" value="external"/>
+      <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="invalid"/>
+      <status state="operational"/>
+    </component>
+
+  </system-implementation>
+
+</system-security-plan>
\ No newline at end of file
diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml
index b7f01cf49..6ac2418ac 100644
--- a/src/validations/constraints/fedramp-external-allowed-values.xml
+++ b/src/validations/constraints/fedramp-external-allowed-values.xml
@@ -127,6 +127,19 @@
                 <enum value="other">Other</enum>
             </allowed-values>
 
+            <allowed-values id="external-system-nature-of-agreement" target="system-implementation/component[@type='system'][not(prop[@name='leveraged-authorization-uuid'])][prop[@name='implementation-point' and @value='external']]/prop[@name='nature-of-agreement' and @ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
+                <formal-name>Nature of Agreement for External Systems</formal-name>
+                <description>Identifies nature of agreement for external systems.</description>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems"/>
+                <enum value="contract">A contract between the CSP and the organization that owns the external system.</enum>
+                <enum value="eula">An end-user license agreement between the CSP and the organization that owns the external system.</enum>
+                <enum value="isa">An interconnection security agreement between the CSP and the organization that owns the external system.</enum>
+                <enum value="license">An application license agreement between the CSP and the organization that owns the external system.</enum>
+                <enum value="mou">A memorandum of understanding between the CSP and the organization that owns the external system.</enum>
+                <enum value="other">An non-typical agreement between the CSP and the organization that owns the external system. Explain in remarks.</enum>
+                <enum value="sla">A service-level agreement between the CSP and the organization that owns the external system.</enum>
+            </allowed-values>
+
             <allowed-values id="fedramp-version" target="metadata/prop[@name='fedramp-version'][@ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
                 <formal-name>FedRAMP Version</formal-name>
                 <description>Identifies the FedRAMP version of the document.</description>
diff --git a/src/validations/constraints/unit-tests/external-system-nature-of-agreement-FAIL.yaml b/src/validations/constraints/unit-tests/external-system-nature-of-agreement-FAIL.yaml
new file mode 100644
index 000000000..a24aa2405
--- /dev/null
+++ b/src/validations/constraints/unit-tests/external-system-nature-of-agreement-FAIL.yaml
@@ -0,0 +1,8 @@
+# Driver for the invalid external-system-nature-of-agreement constraint unit test.
+test-case:
+  name: The invalid external-system-nature-of-agreement constraint unit test.
+  description: Test that the FedRAMP SSP contains an invalid nature-of-agreement value for an external system.
+  content: ../content/ssp-external-system-nature-of-agreement-INVALID.xml
+  expectations:
+  - constraint-id: external-system-nature-of-agreement
+    result: fail
\ No newline at end of file
diff --git a/src/validations/constraints/unit-tests/external-system-nature-of-agreement-PASS.yaml b/src/validations/constraints/unit-tests/external-system-nature-of-agreement-PASS.yaml
new file mode 100644
index 000000000..9d62c3fb9
--- /dev/null
+++ b/src/validations/constraints/unit-tests/external-system-nature-of-agreement-PASS.yaml
@@ -0,0 +1,8 @@
+# Driver for the valid external-system-nature-of-agreement constraint unit test.
+test-case:
+  name: The valid external-system-nature-of-agreement constraint unit test.
+  description: Test that the FedRAMP SSP contains valid nature-of-agreement value for an external system.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+  - constraint-id: external-system-nature-of-agreement
+    result: pass
\ No newline at end of file

From 4fa7efaf6ae3880dfa89509647ce8b20a4c86542 Mon Sep 17 00:00:00 2001
From: DimitriZhurkin <dimitri.zhurkin@noblis.org>
Date: Fri, 22 Nov 2024 15:05:34 -0700
Subject: [PATCH 2/3] Update help-url

---
 src/validations/constraints/fedramp-external-allowed-values.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml
index 6ac2418ac..083f86f41 100644
--- a/src/validations/constraints/fedramp-external-allowed-values.xml
+++ b/src/validations/constraints/fedramp-external-allowed-values.xml
@@ -130,7 +130,7 @@
             <allowed-values id="external-system-nature-of-agreement" target="system-implementation/component[@type='system'][not(prop[@name='leveraged-authorization-uuid'])][prop[@name='implementation-point' and @value='external']]/prop[@name='nature-of-agreement' and @ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
                 <formal-name>Nature of Agreement for External Systems</formal-name>
                 <description>Identifies nature of agreement for external systems.</description>
-                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems"/>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems-and-services-not-having-fedramp-authorization"/>
                 <enum value="contract">A contract between the CSP and the organization that owns the external system.</enum>
                 <enum value="eula">An end-user license agreement between the CSP and the organization that owns the external system.</enum>
                 <enum value="isa">An interconnection security agreement between the CSP and the organization that owns the external system.</enum>

From 50d321acc148237cf4b919c12075c87f05fc65ee Mon Sep 17 00:00:00 2001
From: DimitriZhurkin <dimitri.zhurkin@noblis.org>
Date: Mon, 25 Nov 2024 12:30:29 -0700
Subject: [PATCH 3/3] Modified Metapath as per #907

---
 src/validations/constraints/content/ssp-all-VALID.xml       | 6 +++---
 .../ssp-external-system-nature-of-agreement-INVALID.xml     | 6 +++---
 .../constraints/fedramp-external-allowed-values.xml         | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml
index bfdb19693..09088bda1 100644
--- a/src/validations/constraints/content/ssp-all-VALID.xml
+++ b/src/validations/constraints/content/ssp-all-VALID.xml
@@ -328,13 +328,13 @@
       </remarks>
     </component>
 
-    <component uuid="77777777-0000-4000-9000-000000000007" type="system">
+    <component uuid="77777777-0000-4000-9000-000000000007" type="software">
       <title>Name of External System</title>
       <description>
           <p>Briefly describe the external system.</p>
       </description>
-      <prop name="inherited-uuid" value="11111111-0000-4000-9001-000000000001"/>
-      <prop name="implementation-point" value="external"/>
+      <prop name="asset-type" value="cli"/>
+      <prop name="direction" value="in/out" ns="https://fedramp.gov/ns/oscal"/>
       <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="isa"/>
       <status state="operational"/>
     </component>
diff --git a/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml b/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml
index beed271a3..a5ebfb095 100644
--- a/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml
+++ b/src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml
@@ -6,13 +6,13 @@
   
   <system-implementation>
 
-    <component uuid="77777777-0000-4000-9000-000000000007" type="system">
+    <component uuid="77777777-0000-4000-9000-000000000007" type="software">
       <title>Name of External System</title>
       <description>
           <p>Briefly describe the external system.</p>
       </description>
-      <prop name="inherited-uuid" value="11111111-0000-4000-9001-000000000001"/>
-      <prop name="implementation-point" value="external"/>
+      <prop name="asset-type" value="cli"/>
+      <prop name="direction" value="in/out" ns="https://fedramp.gov/ns/oscal"/>
       <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="invalid"/>
       <status state="operational"/>
     </component>
diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml
index 083f86f41..11633ec44 100644
--- a/src/validations/constraints/fedramp-external-allowed-values.xml
+++ b/src/validations/constraints/fedramp-external-allowed-values.xml
@@ -127,7 +127,7 @@
                 <enum value="other">Other</enum>
             </allowed-values>
 
-            <allowed-values id="external-system-nature-of-agreement" target="system-implementation/component[@type='system'][not(prop[@name='leveraged-authorization-uuid'])][prop[@name='implementation-point' and @value='external']]/prop[@name='nature-of-agreement' and @ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
+            <allowed-values id="external-system-nature-of-agreement" target="system-implementation/component[(@type='service' and not(prop[@name='leveraged-authorization-uuid']) and prop[@name='implementation-point' and @value='external']) or (@type='interconnection') or (@type='service' and prop[@name='implementation-point' and @value='internal'] and prop[@name='direction']) or (@type='software' and prop[@name='asset-type' and @value='cli'] and prop[@name='direction'])]/prop[@name='nature-of-agreement' and @ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
                 <formal-name>Nature of Agreement for External Systems</formal-name>
                 <description>Identifies nature of agreement for external systems.</description>
                 <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems-and-services-not-having-fedramp-authorization"/>