{ "$schema" : "http://json-schema.org/draft-07/schema#", "$id" : "http://csrc.nist.gov/ns/oscal/1.0-schema.json", "$comment" : "OSCAL System Security Plan (SSP) Format: JSON Schema", "type" : "object", "definitions" : { "metadata" : { "title" : "Publication metadata", "description" : "Provides information about the publication and availability of the containing document.", "$id" : "#/definitions/metadata", "type" : "object", "properties" : { "title" : { "$ref" : "#/definitions/title" }, "published" : { "$ref" : "#/definitions/published" }, "last-modified" : { "$ref" : "#/definitions/last-modified" }, "version" : { "$ref" : "#/definitions/version" }, "oscal-version" : { "$ref" : "#/definitions/oscal-version" }, "revision-history" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/revision" } }, "document-ids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/doc-id" } }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "roles" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/role" } }, "locations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/location" } }, "parties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/party" } }, "responsible-parties" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-party" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "title", "last-modified", "version", "oscal-version" ], "additionalProperties" : false }, "back-matter" : { "title" : "Back matter", "description" : "A collection of citations and resource references.", "$id" : "#/definitions/back-matter", "type" : "object", "properties" : { "resources" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/resource" } } }, "additionalProperties" : false }, "revision" : { "title" : "Revision History Entry", "description" : "An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first).", "$id" : "#/definitions/revision", "type" : "object", "properties" : { "title" : { "$ref" : "#/definitions/title" }, "published" : { "$ref" : "#/definitions/published" }, "last-modified" : { "$ref" : "#/definitions/last-modified" }, "version" : { "$ref" : "#/definitions/version" }, "oscal-version" : { "$ref" : "#/definitions/oscal-version" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "additionalProperties" : false }, "link" : { "title" : "Link", "description" : "A reference to a local or remote resource", "$id" : "#/definitions/link", "type" : "object", "properties" : { "href" : { "title" : "hypertext reference", "description" : "A link to a document or document fragment (actual, nominal or projected)", "type" : "string", "format" : "uri-reference" }, "rel" : { "title" : "Relation", "description" : "Describes the type of relationship provided by the link. This can be an indicator of the link's purpose.", "type" : "string" }, "media-type" : { "title" : "Media type", "description" : "Describes the media type of the linked resource", "type" : "string" }, "text" : { "type" : "string" } }, "required" : [ "text", "href" ], "additionalProperties" : false }, "published" : { "title" : "Publication Timestamp", "description" : "The date and time this document was published.", "$id" : "#/definitions/published", "type" : "string", "format" : "date-time", "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$" }, "last-modified" : { "title" : "Last modified timestamp", "description" : "Date and time of last modification.", "$id" : "#/definitions/last-modified", "type" : "string", "format" : "date-time", "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$" }, "version" : { "title" : "Document version", "description" : "The version of the document content.", "$id" : "#/definitions/version", "type" : "string" }, "oscal-version" : { "title" : "OSCAL version", "description" : "OSCAL model version.", "$id" : "#/definitions/oscal-version", "type" : "string" }, "doc-id" : { "title" : "Document Identifier", "description" : "A document identifier qualified by an identifier type.", "$id" : "#/definitions/doc-id", "type" : "object", "properties" : { "type" : { "description" : "Qualifies the kind of document identifier.", "type" : "string" }, "identifier" : { "type" : "string" } }, "required" : [ "identifier", "type" ], "additionalProperties" : false }, "prop" : { "title" : "Property", "description" : "A value with a name, attributed to the containing control, part, or group.", "$id" : "#/definitions/prop", "type" : "object", "properties" : { "name" : { "title" : "Name", "description" : "Identifying the purpose and intended use of the property, part or other object.", "type" : "string" }, "id" : { "title" : "Identifier", "description" : "Unique identifier of the containing object", "type" : "string" }, "ns" : { "title" : "Namespace", "description" : "A namespace qualifying the name.", "type" : "string" }, "class" : { "title" : "Class", "description" : "Indicating the type or classification of the containing object", "type" : "string" }, "value" : { "type" : "string" } }, "required" : [ "value", "name" ], "additionalProperties" : false }, "annotation" : { "title" : "Annotation", "description" : "A name/value pair with optional explanatory remarks.", "$id" : "#/definitions/annotation", "type" : "object", "properties" : { "name" : { "title" : "Name", "description" : "Identifying the purpose and intended use of the property, part or other object.", "type" : "string" }, "id" : { "title" : "Identifier", "description" : "Unique identifier of the containing object", "type" : "string" }, "ns" : { "title" : "Namespace", "description" : "A namespace qualifying the name.", "type" : "string" }, "value" : { "title" : "Value", "description" : "Indicates the value of the characteristic.", "type" : "string" }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "name" ], "additionalProperties" : false }, "location" : { "title" : "Location", "description" : "A location, with associated metadata that can be referenced.", "$id" : "#/definitions/location", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "title" : { "$ref" : "#/definitions/title" }, "address" : { "$ref" : "#/definitions/address" }, "email-addresses" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/email" } }, "telephone-numbers" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/phone" } }, "URLs" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/url" } }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "uuid", "address" ], "additionalProperties" : false }, "location-uuid" : { "title" : "Location Reference", "description" : "References a location defined in metadata.", "$id" : "#/definitions/location-uuid", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "party" : { "title" : "Party (organization or person)", "description" : "A responsible entity, either singular (an organization or person) or collective (multiple persons)", "$id" : "#/definitions/party", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "type" : { "title" : "Party Type", "description" : "A category describing the kind of party the object describes.", "type" : "string", "enum" : [ "person", "organization" ] }, "party-name" : { "$ref" : "#/definitions/party-name" }, "short-name" : { "$ref" : "#/definitions/short-name" }, "external-ids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/external-id" } }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "addresses" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/address" } }, "email-addresses" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/email" } }, "telephone-numbers" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/phone" } }, "member-of-organizations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/member-of-organization" } }, "location-uuids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/location-uuid" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "uuid", "type", "party-name" ], "additionalProperties" : false }, "party-uuid" : { "title" : "Party Reference", "description" : "References a party defined in metadata.", "$id" : "#/definitions/party-uuid", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "external-id" : { "title" : "Personal Identifier", "description" : "An identifier for a person (such as an ORCID) using a designated scheme.", "$id" : "#/definitions/external-id", "type" : "object", "properties" : { "type" : { "title" : "Type", "description" : "Indicating the type of identifier, address, email or other data item.", "type" : "string" }, "id" : { "type" : "string" } }, "required" : [ "id", "type" ], "additionalProperties" : false }, "member-of-organization" : { "title" : "Organizational Affiliation", "description" : "Identifies that the containing object is a member of the organization associated with the provided UUID.", "$id" : "#/definitions/member-of-organization", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "rlink" : { "title" : "Resource link", "description" : "A pointer to an external copy of a document with optional hash for verification", "$id" : "#/definitions/rlink", "type" : "object", "properties" : { "href" : { "title" : "hypertext reference", "description" : "A link to a document or document fragment (actual, nominal or projected)", "type" : "string", "format" : "uri-reference" }, "media-type" : { "title" : "Media type", "description" : "Describes the media type of the linked resource", "type" : "string" }, "hashes" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/hash" } } }, "required" : [ "href" ], "additionalProperties" : false }, "party-name" : { "title" : "Party Name", "description" : "The full (legal) name of the party.", "$id" : "#/definitions/party-name", "type" : "string" }, "short-name" : { "title" : "short-name", "description" : "A common name, short name or acronym", "$id" : "#/definitions/short-name", "type" : "string" }, "address" : { "title" : "Address", "description" : "A postal address.", "$id" : "#/definitions/address", "type" : "object", "properties" : { "type" : { "description" : "Indicates the type of address.", "type" : "string" }, "postal-address" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/addr-line" } }, "city" : { "$ref" : "#/definitions/city" }, "state" : { "$ref" : "#/definitions/state" }, "postal-code" : { "$ref" : "#/definitions/postal-code" }, "country" : { "$ref" : "#/definitions/country" } }, "additionalProperties" : false }, "addr-line" : { "title" : "Address line", "description" : "A single line of an address.", "$id" : "#/definitions/addr-line", "type" : "string" }, "city" : { "title" : "City", "description" : "City, town or geographical region for mailing address", "$id" : "#/definitions/city", "type" : "string" }, "state" : { "title" : "State", "description" : "State, province or analogous geographical region for mailing address", "$id" : "#/definitions/state", "type" : "string" }, "postal-code" : { "title" : "Postal Code", "description" : "Postal or ZIP code for mailing address", "$id" : "#/definitions/postal-code", "type" : "string" }, "country" : { "title" : "Country", "description" : "Country for mailing address", "$id" : "#/definitions/country", "type" : "string" }, "email" : { "title" : "Email", "description" : "Email address", "$id" : "#/definitions/email", "type" : "string", "format" : "email", "pattern" : "^.+@.+" }, "phone" : { "title" : "Telephone", "description" : "Contact number by telephone", "$id" : "#/definitions/phone", "type" : "object", "properties" : { "type" : { "description" : "Indicates the type of phone number.", "type" : "string" }, "number" : { "type" : "string" } }, "required" : [ "number" ], "additionalProperties" : false }, "url" : { "title" : "URL", "description" : "URL for web site or Internet presence", "$id" : "#/definitions/url", "type" : "string", "format" : "uri" }, "desc" : { "title" : "Description", "description" : "A short textual description", "$id" : "#/definitions/desc", "type" : "string" }, "text" : { "title" : "Text", "description" : "A line of textual content whose semantic is determined by the context of use.", "$id" : "#/definitions/text", "type" : "string" }, "biblio" : { "title" : "Bibliographic Definition", "description" : "A container in which a set of bibliographic information can included. The model of this information is undefined by OSCAL.", "$id" : "#/definitions/biblio", "type" : "object", "additionalProperties" : false }, "resource" : { "title" : "Resource", "description" : "A resource associated with the present document, which may be a pointer to other data or a citation.", "$id" : "#/definitions/resource", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "title" : { "$ref" : "#/definitions/title" }, "desc" : { "$ref" : "#/definitions/desc" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "document-ids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/doc-id" } }, "citation" : { "$ref" : "#/definitions/citation" }, "rlinks" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/rlink" } }, "attachments" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/base64" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "uuid" ], "additionalProperties" : false }, "citation" : { "title" : "Citation", "description" : "A citation consisting of end note text and optional structured bibliographic data.", "$id" : "#/definitions/citation", "type" : "object", "properties" : { "text" : { "$ref" : "#/definitions/text" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "biblio" : { "$ref" : "#/definitions/biblio" } }, "required" : [ "text" ], "additionalProperties" : false }, "hash" : { "title" : "Hash", "description" : "A representation of a cryptographic digest generated over a resource using a hash algorithm.", "$id" : "#/definitions/hash", "type" : "object", "properties" : { "algorithm" : { "title" : "Hash algorithm", "description" : "Method by which a hash is derived", "type" : "string" }, "value" : { "type" : "string" } }, "required" : [ "value", "algorithm" ], "additionalProperties" : false }, "role" : { "title" : "Role", "description" : "Defining a role to be assigned to a party", "$id" : "#/definitions/role", "type" : "object", "properties" : { "id" : { "title" : "Identifier", "description" : "Unique identifier of the containing object", "type" : "string" }, "title" : { "$ref" : "#/definitions/title" }, "short-name" : { "$ref" : "#/definitions/short-name" }, "desc" : { "$ref" : "#/definitions/desc" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "id", "title" ], "additionalProperties" : false }, "responsible-party" : { "title" : "Responsible Party", "description" : "A reference to a set of organizations or persons that have responsibility for performing a referenced role relative to the parent context.", "$id" : "#/definitions/responsible-party", "type" : "object", "properties" : { "party-uuids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/party-uuid" } }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "party-uuids" ], "additionalProperties" : false }, "title" : { "title" : "Title", "description" : "A title for display and navigation", "$id" : "#/definitions/title", "type" : "string" }, "base64" : { "title" : "Base64", "description" : "", "$id" : "#/definitions/base64", "type" : "object", "properties" : { "filename" : { "title" : "File Name", "description" : "Name of the file before it was encoded as Base64 to be embedded in a resource. This is the name that will be assigned to the file when the file is decoded.", "type" : "string", "format" : "uri-reference" }, "media-type" : { "title" : "Media type", "description" : "Describes the media type of the linked resource", "type" : "string" }, "value" : { "type" : "string" } }, "required" : [ "value" ], "additionalProperties" : false }, "description" : { "title" : "Description", "description" : "A description supporting the parent item.", "$id" : "#/definitions/description", "type" : "string" }, "remarks" : { "title" : "Remarks", "description" : "Additional commentary on the parent item.", "$id" : "#/definitions/remarks", "type" : "string" }, "responsible-role" : { "title" : "Responsible Role", "description" : "A reference to one or more roles with responsibility for performing a function relative to the control.", "$id" : "#/definitions/responsible-role", "type" : "object", "properties" : { "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "party-ids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/party-uuid" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "additionalProperties" : false }, "set-parameter" : { "title" : "Set Parameter Value", "description" : "Identifies the parameter that will be filled in by the enclosed value element.", "$id" : "#/definitions/set-parameter", "type" : "object", "properties" : { "value" : { "$ref" : "#/definitions/value" } }, "required" : [ "value" ], "additionalProperties" : false }, "value" : { "title" : "Value", "description" : "The phrase or string that fills-in the parameter and completes the requirement statement.", "$id" : "#/definitions/value", "type" : "string" }, "system-security-plan" : { "title" : "System Security Plan (SSP)", "description" : "A system security plan, such as those described in NIST SP 800-18", "$id" : "#/definitions/system-security-plan", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "metadata" : { "$ref" : "#/definitions/metadata" }, "import-profile" : { "$ref" : "#/definitions/import-profile" }, "system-characteristics" : { "$ref" : "#/definitions/system-characteristics" }, "system-implementation" : { "$ref" : "#/definitions/system-implementation" }, "control-implementation" : { "$ref" : "#/definitions/control-implementation" }, "back-matter" : { "$ref" : "#/definitions/back-matter" } }, "required" : [ "uuid", "metadata", "import-profile", "system-characteristics", "system-implementation", "control-implementation" ], "additionalProperties" : false }, "import-profile" : { "title" : "Import Profile", "description" : "Used to import the OSCAL profile representing the system's control baseline.", "$id" : "#/definitions/import-profile", "type" : "object", "properties" : { "href" : { "title" : "hypertext reference", "description" : "A link to a document or document fragment (actual, nominal or projected)", "type" : "string", "format" : "uri-reference" }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "href" ], "additionalProperties" : false }, "system-characteristics" : { "title" : "System Characteristics", "description" : "Contains the characteristics of the system, such as its name, purpose, and security impact level.", "$id" : "#/definitions/system-characteristics", "type" : "object", "properties" : { "system-ids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/system-id" } }, "system-name" : { "$ref" : "#/definitions/system-name" }, "system-name-short" : { "$ref" : "#/definitions/system-name-short" }, "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "date-authorized" : { "$ref" : "#/definitions/date-authorized" }, "security-sensitivity-level" : { "$ref" : "#/definitions/security-sensitivity-level" }, "system-information" : { "$ref" : "#/definitions/system-information" }, "security-impact-level" : { "$ref" : "#/definitions/security-impact-level" }, "status" : { "$ref" : "#/definitions/status" }, "authorization-boundary" : { "$ref" : "#/definitions/authorization-boundary" }, "network-architecture" : { "$ref" : "#/definitions/network-architecture" }, "data-flow" : { "$ref" : "#/definitions/data-flow" }, "responsible-parties" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-party" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "system-ids", "system-name", "description", "security-sensitivity-level", "system-information", "security-impact-level", "status", "authorization-boundary" ], "additionalProperties" : false }, "system-id" : { "title" : "System Identification", "description" : "A unique identifier for the system described by this system security plan.", "$id" : "#/definitions/system-id", "type" : "object", "properties" : { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", "type" : "string", "format" : "uri" }, "id" : { "type" : "string" } }, "required" : [ "id" ], "additionalProperties" : false }, "system-name" : { "title" : "System Name (Full)", "description" : "The full name of the system.", "$id" : "#/definitions/system-name", "type" : "string" }, "system-name-short" : { "title" : "System Name (Short)", "description" : "A short name for the system, such as an acronym, that is suitable for display in a data table or summary list.", "$id" : "#/definitions/system-name-short", "type" : "string" }, "security-sensitivity-level" : { "title" : "Security Sensitivity Level", "description" : "The overall information system sensitivity categorization, such as defined by FIPS-199.", "$id" : "#/definitions/security-sensitivity-level", "type" : "string", "enum" : [ "low", "moderate", "high" ] }, "system-information" : { "title" : "System Information", "description" : "Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60.", "$id" : "#/definitions/system-information", "type" : "object", "properties" : { "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "information-types" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/information-type" } } }, "required" : [ "information-types" ], "additionalProperties" : false }, "information-type" : { "title" : "Information Type", "description" : "Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60.", "$id" : "#/definitions/information-type", "type" : "object", "properties" : { "id" : { "title" : "Identifier", "description" : "Unique identifier of the containing object", "type" : "string" }, "title" : { "$ref" : "#/definitions/title" }, "description" : { "$ref" : "#/definitions/description" }, "information-type-ids" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/information-type-id" }, { "not" : { "type" : "string" } } ] } }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "confidentiality-impact" : { "$ref" : "#/definitions/confidentiality-impact" }, "integrity-impact" : { "$ref" : "#/definitions/integrity-impact" }, "availability-impact" : { "$ref" : "#/definitions/availability-impact" } }, "required" : [ "title", "description", "confidentiality-impact", "integrity-impact", "availability-impact" ], "additionalProperties" : false }, "information-type-id" : { "title" : "Information Type Identifier", "description" : "An identifier qualified by the given identification system used, such as NIST SP 800-60.", "$id" : "#/definitions/information-type-id", "type" : "object", "properties" : { "id" : { "type" : "string" } }, "required" : [ "id" ], "additionalProperties" : false }, "confidentiality-impact" : { "title" : "Confidentiality Impact Level", "description" : "The expected level of impact resulting from the unauthorized disclosure of information.", "$id" : "#/definitions/confidentiality-impact", "type" : "object", "properties" : { "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "base" : { "$ref" : "#/definitions/base" }, "selected" : { "$ref" : "#/definitions/selected" }, "adjustment-justification" : { "$ref" : "#/definitions/adjustment-justification" } }, "required" : [ "base" ], "additionalProperties" : false }, "integrity-impact" : { "title" : "Integrity Impact Level", "description" : "The expected level of impact resulting from the unauthorized modification of information.", "$id" : "#/definitions/integrity-impact", "type" : "object", "properties" : { "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "base" : { "$ref" : "#/definitions/base" }, "selected" : { "$ref" : "#/definitions/selected" }, "adjustment-justification" : { "$ref" : "#/definitions/adjustment-justification" } }, "required" : [ "base" ], "additionalProperties" : false }, "availability-impact" : { "title" : "Availability Impact Level", "description" : "The expected level of impact resulting from the disruption of access to or use of information or the information system.", "$id" : "#/definitions/availability-impact", "type" : "object", "properties" : { "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "base" : { "$ref" : "#/definitions/base" }, "selected" : { "$ref" : "#/definitions/selected" }, "adjustment-justification" : { "$ref" : "#/definitions/adjustment-justification" } }, "required" : [ "base" ], "additionalProperties" : false }, "base" : { "title" : "Base Level (Confidentiality, Integrity, or Availability)", "description" : "The prescribed base (Confidentiality, Integrity, or Availability) security impact level.", "$id" : "#/definitions/base", "type" : "string", "enum" : [ "fips-199-low", "fips-199-moderate", "fips-199-high" ] }, "selected" : { "title" : "Selected Level (Confidentiality, Integrity, or Availability)", "description" : "The selected (Confidentiality, Integrity, or Availability) security impact level.", "$id" : "#/definitions/selected", "type" : "string", "enum" : [ "fips-199-low", "fips-199-moderate", "fips-199-high" ] }, "adjustment-justification" : { "title" : "Adjustment Justification", "description" : "If the selected security level is different from the base security level, this contains the justification for the change.", "$id" : "#/definitions/adjustment-justification", "type" : "string" }, "security-impact-level" : { "title" : "Security Impact Level", "description" : "The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information.", "$id" : "#/definitions/security-impact-level", "type" : "object", "properties" : { "security-objective-confidentiality" : { "$ref" : "#/definitions/security-objective-confidentiality" }, "security-objective-integrity" : { "$ref" : "#/definitions/security-objective-integrity" }, "security-objective-availability" : { "$ref" : "#/definitions/security-objective-availability" } }, "additionalProperties" : false }, "security-objective-confidentiality" : { "title" : "Security Objective: Confidentiality", "description" : "A target-level of confidentiality for the system, based on the sensitivity of information within the system.", "$id" : "#/definitions/security-objective-confidentiality", "type" : "string", "enum" : [ "fips-199-low", "fips-199-moderate", "fips-199-high" ] }, "security-objective-integrity" : { "title" : "Security Objective: Integrity", "description" : "A target-level of integrity for the system, based on the sensitivity of information within the system.", "$id" : "#/definitions/security-objective-integrity", "type" : "string", "enum" : [ "fips-199-low", "fips-199-moderate", "fips-199-high" ] }, "security-objective-availability" : { "title" : "Security Objective: Availability", "description" : "A target-level of availability for the system, based on the sensitivity of information within the system.", "$id" : "#/definitions/security-objective-availability", "type" : "string", "enum" : [ "fips-199-low", "fips-199-moderate", "fips-199-high" ] }, "status" : { "title" : "Status", "description" : "Describes the operational status of the system.", "$id" : "#/definitions/status", "type" : "object", "properties" : { "state" : { "title" : "State", "description" : "The current operating status.", "type" : "string", "enum" : [ "operational", "under-development", "under-major-modification", "disposition", "other" ] }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "state" ], "additionalProperties" : false }, "leveraged-authorization" : { "title" : "Leveraged Authorization", "description" : "A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common control provider.", "$id" : "#/definitions/leveraged-authorization", "type" : "object", "properties" : { "id" : { "title" : "Identifier", "description" : "Unique identifier of the containing object", "type" : "string" }, "title" : { "$ref" : "#/definitions/title" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "party-uuid" : { "$ref" : "#/definitions/party-uuid" }, "date-authorized" : { "$ref" : "#/definitions/date-authorized" }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "title", "party-uuid", "date-authorized" ], "additionalProperties" : false }, "date-authorized" : { "title" : "System Authorization Date", "description" : "The date this system received its authorization.", "$id" : "#/definitions/date-authorized", "type" : "string", "pattern" : "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))(Z|[+-][0-9]{2}:[0-9]{2})?$" }, "authorization-boundary" : { "title" : "Authorization Boundary", "description" : "A description of this system's authorization boundary, optionally supplemented by diagrams that illustrate the authorization boundary.", "$id" : "#/definitions/authorization-boundary", "type" : "object", "properties" : { "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "diagrams" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/diagram" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "description" ], "additionalProperties" : false }, "diagram" : { "title" : "Diagram", "description" : "A graphic that provides a visual representation the system, or some aspect of it.", "$id" : "#/definitions/diagram", "type" : "object", "properties" : { "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "caption" : { "$ref" : "#/definitions/caption" }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "additionalProperties" : false }, "caption" : { "title" : "Caption", "description" : "A brief caption to annotate the diagram.", "$id" : "#/definitions/caption", "type" : "string" }, "network-architecture" : { "title" : "Network Architecture", "description" : "A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture.", "$id" : "#/definitions/network-architecture", "type" : "object", "properties" : { "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "diagrams" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/diagram" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "description" ], "additionalProperties" : false }, "data-flow" : { "title" : "Data Flow", "description" : "A description of the logical flow of information within the system and across its boundaries, optionally supplemented by diagrams that illustrate these flows.", "$id" : "#/definitions/data-flow", "type" : "object", "properties" : { "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "diagrams" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/diagram" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "description" ], "additionalProperties" : false }, "system-implementation" : { "title" : "System Implementation", "description" : "Provides information as to how the system is implemented.", "$id" : "#/definitions/system-implementation", "type" : "object", "properties" : { "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "leveraged-authorizations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/leveraged-authorization" } }, "users" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/user" }, { "not" : { "type" : "string" } } ] } }, "components" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/component" }, { "not" : { "type" : "string" } } ] } }, "system-inventory" : { "$ref" : "#/definitions/system-inventory" }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "users" ], "additionalProperties" : false }, "user" : { "title" : "System User Class", "description" : "A type of user that interacts with the system based on an associated role.", "$id" : "#/definitions/user", "type" : "object", "properties" : { "title" : { "$ref" : "#/definitions/title" }, "short-name" : { "$ref" : "#/definitions/short-name" }, "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "role-ids" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/role-id" } }, "authorized-privileges" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/authorized-privilege" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "role-ids" ], "additionalProperties" : false }, "role-id" : { "title" : "Role Identifier Reference", "description" : "A reference to the roles served by the user.", "$id" : "#/definitions/role-id", "type" : "string" }, "authorized-privilege" : { "title" : "Privilege", "description" : "Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege.", "$id" : "#/definitions/authorized-privilege", "type" : "object", "properties" : { "title" : { "$ref" : "#/definitions/title" }, "description" : { "$ref" : "#/definitions/description" }, "functions-performed" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/function-performed" } } }, "required" : [ "title", "functions-performed" ], "additionalProperties" : false }, "function-performed" : { "title" : "Functions Performed", "description" : "Describes a function performed for a given authorized privilege by this user class.", "$id" : "#/definitions/function-performed", "type" : "string" }, "component" : { "title" : "Component", "description" : "A defined component that can be part of an implemented system.", "$id" : "#/definitions/component", "type" : "object", "properties" : { "component-type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", "type" : "string" }, "title" : { "$ref" : "#/definitions/title" }, "description" : { "$ref" : "#/definitions/description" }, "purpose" : { "$ref" : "#/definitions/purpose" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "status" : { "$ref" : "#/definitions/status" }, "responsible-roles" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-role" }, { "not" : { "type" : "string" } } ] } }, "protocols" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/protocol" } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "component-type", "title", "description", "status" ], "additionalProperties" : false }, "protocol" : { "title" : "Protocol", "description" : "Information about the protocol used to provide a service.", "$id" : "#/definitions/protocol", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "name" : { "description" : "The short name of the protocol (e.g., TLS).", "type" : "string" }, "title" : { "$ref" : "#/definitions/title" }, "port-ranges" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/port-range" } } }, "required" : [ "name" ], "additionalProperties" : false }, "port-range" : { "title" : "Port Range", "description" : "Where applicable this is the IPv4 port range on which the service operates.", "$id" : "#/definitions/port-range", "type" : "object", "properties" : { "start" : { "title" : "Start", "description" : "Indicates the starting port number in a port range", "type" : "integer", "multipleOf" : 1, "minimum" : 0 }, "end" : { "title" : "End", "description" : "Indicates the ending port number in a port range", "type" : "integer", "multipleOf" : 1, "minimum" : 0 }, "transport" : { "title" : "Transport", "description" : "Indicates the transport type.", "type" : "string", "enum" : [ "TCP", "UDP" ] } }, "additionalProperties" : false }, "purpose" : { "title" : "Purpose", "description" : "Describes the purpose for the service within the system.", "$id" : "#/definitions/purpose", "type" : "string" }, "system-inventory" : { "title" : "System Inventory", "description" : "A set of inventory-item entries that represent the managed inventory instances of the system.", "$id" : "#/definitions/system-inventory", "type" : "object", "properties" : { "inventory-items" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/inventory-item" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "inventory-items" ], "additionalProperties" : false }, "inventory-item" : { "title" : "Inventory Item", "description" : "A single managed inventory item within the system.", "$id" : "#/definitions/inventory-item", "type" : "object", "properties" : { "asset-id" : { "title" : "Asset Identifier", "description" : "Organizational asset identifier that is unique in the context of the system. This may be a reference to the identifier used in an asset tracking system or a vulnerability scanning tool.", "type" : "string" }, "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "responsible-parties" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-party" }, { "not" : { "type" : "string" } } ] } }, "implemented-components" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/implemented-component" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "asset-id", "description" ], "additionalProperties" : false }, "implemented-component" : { "title" : "Implemented Component", "description" : "The set of componenets that are implemented in a given system inventory item.", "$id" : "#/definitions/implemented-component", "type" : "object", "properties" : { "use" : { "title" : "Implementation Use Type", "description" : "The type of implementation", "type" : "string" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "responsible-parties" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-party" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "additionalProperties" : false }, "control-implementation" : { "title" : "Control Implementation", "description" : "Describes how the system satisfies a set of controls.", "$id" : "#/definitions/control-implementation", "type" : "object", "properties" : { "description" : { "$ref" : "#/definitions/description" }, "implemented-requirements" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/implemented-requirement" } } }, "required" : [ "description", "implemented-requirements" ], "additionalProperties" : false }, "implemented-requirement" : { "title" : "Control-based Requirement", "description" : "Describes how the system satisfies an individual control.", "$id" : "#/definitions/implemented-requirement", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "control-id" : { "title" : "Control Identifier Reference", "description" : "A reference to a control identifier.", "type" : "string" }, "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "by-components" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/by-component" }, { "not" : { "type" : "string" } } ] } }, "responsible-roles" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-role" }, { "not" : { "type" : "string" } } ] } }, "parameter-settings" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/set-parameter" }, { "not" : { "type" : "string" } } ] } }, "statements" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/statement" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "uuid", "control-id" ], "additionalProperties" : false }, "statement" : { "title" : "Specific Statement", "description" : "Identifies which statements within a control are addressed.", "$id" : "#/definitions/statement", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "anyOf" : [ { "$ref" : "#/definitions/annotation" }, { "type" : "array", "items" : { "$ref" : "#/definitions/annotation" }, "minItems" : 2 } ] }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "responsible-roles" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-role" }, { "not" : { "type" : "string" } } ] } }, "by-components" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/by-component" }, { "not" : { "type" : "string" } } ] } }, "remarks" : { "$ref" : "#/definitions/remarks" } }, "required" : [ "uuid" ], "additionalProperties" : false }, "by-component" : { "title" : "Component Control Implementation", "description" : "Defines how the referenced component implements a set of controls.", "$id" : "#/definitions/by-component", "type" : "object", "properties" : { "uuid" : { "title" : "Universally Unique Identifier", "description" : "A RFC 4122 version 4 Universally Unique Identifier (UUID) for the containing object.", "type" : "string", "pattern" : "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$" }, "description" : { "$ref" : "#/definitions/description" }, "properties" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/prop" } }, "annotations" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/annotation" } }, "links" : { "type" : "array", "minItems" : 1, "items" : { "$ref" : "#/definitions/link" } }, "responsible-roles" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/responsible-role" }, { "not" : { "type" : "string" } } ] } }, "parameter-settings" : { "type" : "object", "minProperties" : 1, "additionalProperties" : { "allOf" : [ { "type" : "object", "$ref" : "#/definitions/set-parameter" }, { "not" : { "type" : "string" } } ] } } }, "required" : [ "uuid", "description" ], "additionalProperties" : false } }, "properties" : { "system-security-plan" : { "$ref" : "#/definitions/system-security-plan" } }, "required" : [ "system-security-plan" ] }