Add external-system-nature-of-agreement

features/fedramp_extensions.feature

@@ -42,6 +42,7 @@ Examples:
   | data-center-primary |
   | data-center-us |
   | deployment-model |
+  | external-system-nature-of-agreement |
   | fedramp-version |
   | fully-operational-date-is-valid |
   | fully-operational-date-type |
@@ -181,6 +182,8 @@ Examples:
   | data-center-us-PASS.yaml |
   | deployment-model-FAIL.yaml |
   | deployment-model-PASS.yaml |
+  | external-system-nature-of-agreement-FAIL.yaml |
+  | external-system-nature-of-agreement-PASS.yaml |
   | fedramp-version-FAIL.yaml |
   | fedramp-version-PASS.yaml |
   | fully-operational-date-is-valid-FAIL.yaml |

src/validations/constraints/content/ssp-all-VALID.xml

@@ -327,6 +327,17 @@
         <p>This connection is used for secure data exchange with external systems.</p>
       </remarks>
     </component>
+
+    <component uuid="77777777-0000-4000-9000-000000000007" type="software">
+      <title>Name of External System</title>
+      <description>
+          <p>Briefly describe the external system.</p>
+      </description>
+      <prop name="asset-type" value="cli"/>
+      <prop name="direction" value="in/out" ns="https://fedramp.gov/ns/oscal"/>
+      <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="isa"/>
+      <status state="operational"/>
+    </component>
 
     <inventory-item uuid="77777777-0000-4000-9000-000000000007">
       <description>

src/validations/constraints/content/ssp-external-system-nature-of-agreement-INVALID.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+
+    <component uuid="77777777-0000-4000-9000-000000000007" type="software">
+      <title>Name of External System</title>
+      <description>
+          <p>Briefly describe the external system.</p>
+      </description>
+      <prop name="asset-type" value="cli"/>
+      <prop name="direction" value="in/out" ns="https://fedramp.gov/ns/oscal"/>
+      <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="invalid"/>
+      <status state="operational"/>
+    </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/fedramp-external-allowed-values.xml

@@ -127,6 +127,19 @@
                 <enum value="other">Other</enum>
             </allowed-values>
 
+            <allowed-values id="external-system-nature-of-agreement" target="system-implementation/component[(@type='service' and not(prop[@name='leveraged-authorization-uuid']) and prop[@name='implementation-point' and @value='external']) or (@type='interconnection') or (@type='service' and prop[@name='implementation-point' and @value='internal'] and prop[@name='direction']) or (@type='software' and prop[@name='asset-type' and @value='cli'] and prop[@name='direction'])]/prop[@name='nature-of-agreement' and @ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
+                <formal-name>Nature of Agreement for External Systems</formal-name>
+                <description>Identifies nature of agreement for external systems.</description>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems-and-services-not-having-fedramp-authorization"/>
+                <enum value="contract">A contract between the CSP and the organization that owns the external system.</enum>
+                <enum value="eula">An end-user license agreement between the CSP and the organization that owns the external system.</enum>
+                <enum value="isa">An interconnection security agreement between the CSP and the organization that owns the external system.</enum>
+                <enum value="license">An application license agreement between the CSP and the organization that owns the external system.</enum>
+                <enum value="mou">A memorandum of understanding between the CSP and the organization that owns the external system.</enum>
+                <enum value="other">An non-typical agreement between the CSP and the organization that owns the external system. Explain in remarks.</enum>
+                <enum value="sla">A service-level agreement between the CSP and the organization that owns the external system.</enum>
+            </allowed-values>
+
             <allowed-values id="fedramp-version" target="metadata/prop[@name='fedramp-version'][@ns='https://fedramp.gov/ns/oscal']/@value" allow-other="no" level="ERROR">
                 <formal-name>FedRAMP Version</formal-name>
                 <description>Identifies the FedRAMP version of the document.</description>

src/validations/constraints/unit-tests/external-system-nature-of-agreement-FAIL.yaml

@@ -0,0 +1,8 @@
+# Driver for the invalid external-system-nature-of-agreement constraint unit test.
+test-case:
+  name: The invalid external-system-nature-of-agreement constraint unit test.
+  description: Test that the FedRAMP SSP contains an invalid nature-of-agreement value for an external system.
+  content: ../content/ssp-external-system-nature-of-agreement-INVALID.xml
+  expectations:
+  - constraint-id: external-system-nature-of-agreement
+    result: fail

src/validations/constraints/unit-tests/external-system-nature-of-agreement-PASS.yaml

@@ -0,0 +1,8 @@
+# Driver for the valid external-system-nature-of-agreement constraint unit test.
+test-case:
+  name: The valid external-system-nature-of-agreement constraint unit test.
+  description: Test that the FedRAMP SSP contains valid nature-of-agreement value for an external system.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+  - constraint-id: external-system-nature-of-agreement
+    result: pass