Add system-characteristics 'has-security' constraints

features/fedramp_extensions.feature

@@ -103,6 +103,10 @@ Examples:
   | has-network-architecture-diagram-link-rel-allowed-value-PASS.yaml |
   | has-rules-of-behavior-FAIL.yaml |
   | has-rules-of-behavior-PASS.yaml |
+  | has-security-impact-level-FAIL.yaml |
+  | has-security-impact-level-PASS.yaml |
+  | has-security-sensitivity-level-FAIL.yaml |
+  | has-security-sensitivity-level-PASS.yaml |
   | has-separation-of-duties-matrix-FAIL.yaml |
   | has-separation-of-duties-matrix-PASS.yaml |
   | has-system-id-FAIL.yaml |
@@ -212,6 +216,8 @@ Examples:
   | has-network-architecture-diagram-link-rel |
   | has-network-architecture-diagram-link-rel-allowed-value |
   | has-rules-of-behavior |
+  | has-security-impact-level |
+  | has-security-sensitivity-level |
   | has-separation-of-duties-matrix |
   | has-system-id |
   | has-user-guide |

src/validations/constraints/content/ssp-has-security-impact-level-INVALID.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  <system-characteristics>
+  </system-characteristics>
+</system-security-plan>

src/validations/constraints/fedramp-external-constraints.xml

@@ -158,6 +158,14 @@
             <expect id="has-data-flow-diagram-link-rel-allowed-value" target="system-characteristics/data-flow/diagram/link" test="@rel eq 'diagram'" level="ERROR">
                 <message>Each FedRAMP SSP data flow diagram must have a link rel attribute with the value "diagram".</message>
             </expect>
+            <expect id="has-security-sensitivity-level" target="system-characteristics" test="security-sensitivity-level" level="ERROR">
+                <message>A FedRAMP SSP document MUST specify a FIPS 199 categorization.</message>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-sensitivity-level"/>
+            </expect>
+            <expect id="has-security-impact-level" target="system-characteristics" test="security-impact-level" level="ERROR">
+                <message>A FedRAMP SSP document MUST specify a security impact level.</message>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-sensitivity-level"/>
+            </expect>
             <expect id="has-system-id" target="system-characteristics" test="system-id[@identifier-type eq 'https://fedramp.gov']" level="ERROR">
                 <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-name-abbreviation-and-fedramp-unique-identifier"/>
                 <message>A FedRAMP SSP must have a FedRAMP system identifier.</message>
@@ -220,4 +228,4 @@
             </expect>
         </constraints>
     </context>
-</metaschema-meta-constraints>
+</metaschema-meta-constraints>

src/validations/constraints/unit-tests/has-security-impact-level-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-security-impact-level
+  description: Test that an SSP system-characteristics element does not have a security-impact-level element.
+  content: ../content/ssp-has-security-impact-level-INVALID.xml
+  expectations:
+    - constraint-id: has-security-impact-level
+      result: fail

src/validations/constraints/unit-tests/has-security-impact-level-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-security-impact-level
+  description: Test that an SSP system-characteristics element has a security-impact-level element.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-security-impact-level
+      result: pass

src/validations/constraints/unit-tests/has-security-sensitivity-level-FAIL.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for has-security-sensitivity-level
+  description: Test that an SSP system-characteristics element does not have a security-sensitivity-level element.
+  content: ../content/ssp-has-security-sensitivity-level-INVALID.xml
+  expectations:
+    - constraint-id: has-security-sensitivity-level
+      result: fail

src/validations/constraints/unit-tests/has-security-sensitivity-level-PASS.yaml

@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for has-security-sensitivity-level
+  description: Test that an SSP system-characteristics element has a security-sensitivity-level element.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-security-sensitivity-level
+      result: pass