001package gov.nist.secauto.oscal.lib.model; 002 003import gov.nist.secauto.metaschema.core.datatype.adapter.UuidAdapter; 004import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultiline; 005import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultilineAdapter; 006import gov.nist.secauto.metaschema.core.model.IBoundObject; 007import gov.nist.secauto.metaschema.core.model.IMetaschemaData; 008import gov.nist.secauto.metaschema.core.model.JsonGroupAsBehavior; 009import gov.nist.secauto.metaschema.core.model.constraint.IConstraint; 010import gov.nist.secauto.metaschema.core.util.ObjectUtils; 011import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValue; 012import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValues; 013import gov.nist.secauto.metaschema.databind.model.annotations.AssemblyConstraints; 014import gov.nist.secauto.metaschema.databind.model.annotations.BoundAssembly; 015import gov.nist.secauto.metaschema.databind.model.annotations.BoundField; 016import gov.nist.secauto.metaschema.databind.model.annotations.BoundFlag; 017import gov.nist.secauto.metaschema.databind.model.annotations.GroupAs; 018import gov.nist.secauto.metaschema.databind.model.annotations.IsUnique; 019import gov.nist.secauto.metaschema.databind.model.annotations.KeyField; 020import gov.nist.secauto.metaschema.databind.model.annotations.MetaschemaAssembly; 021import gov.nist.secauto.metaschema.databind.model.annotations.ValueConstraints; 022import java.lang.Override; 023import java.lang.String; 024import java.util.LinkedList; 025import java.util.List; 026import java.util.UUID; 027import org.apache.commons.lang3.builder.ReflectionToStringBuilder; 028import org.apache.commons.lang3.builder.ToStringStyle; 029 030/** 031 * An assessment plan, such as those provided by a FedRAMP assessor. 032 */ 033@MetaschemaAssembly( 034 formalName = "Security Assessment Plan (SAP)", 035 description = "An assessment plan, such as those provided by a FedRAMP assessor.", 036 name = "assessment-plan", 037 moduleClass = OscalApModule.class, 038 rootName = "assessment-plan" 039) 040public class AssessmentPlan extends AbstractOscalInstance implements IBoundObject { 041 private final IMetaschemaData __metaschemaData; 042 043 /** 044 * "A <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented\">machine-oriented</a>, <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique\">globally unique</a> identifier with <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance\">cross-instance</a> scope that can be used to reference this assessment plan in <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#ap-identifiers\">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>assessment plan</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency\">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document." 045 */ 046 @BoundFlag( 047 formalName = "Assessment Plan Universally Unique Identifier", 048 description = "A [machine-oriented](https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented), [globally unique](https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique) identifier with [cross-instance](https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance) scope that can be used to reference this assessment plan in [this or other OSCAL instances](https://pages.nist.gov/OSCAL/concepts/identifier-use/#ap-identifiers). The locally defined *UUID* of the `assessment plan` can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned [per-subject](https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency), which means it should be consistently used to identify the same subject across revisions of the document.", 049 name = "uuid", 050 required = true, 051 typeAdapter = UuidAdapter.class 052 ) 053 private UUID _uuid; 054 055 @BoundAssembly( 056 formalName = "Document Metadata", 057 description = "Provides information about the containing document, and defines concepts that are shared across the document.", 058 useName = "metadata", 059 minOccurs = 1 060 ) 061 private Metadata _metadata; 062 063 @BoundAssembly( 064 formalName = "Import System Security Plan", 065 description = "Used by the assessment plan and POA\\&M to import information about the system.", 066 useName = "import-ssp", 067 remarks = "Used by the SAP to import information about the system being assessed.", 068 minOccurs = 1 069 ) 070 private ImportSsp _importSsp; 071 072 @BoundAssembly( 073 formalName = "Local Definitions", 074 description = "Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.", 075 useName = "local-definitions" 076 ) 077 private LocalDefinitions _localDefinitions; 078 079 @BoundAssembly( 080 formalName = "Assessment Plan Terms and Conditions", 081 description = "Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.", 082 useName = "terms-and-conditions" 083 ) 084 private TermsAndConditions _termsAndConditions; 085 086 @BoundAssembly( 087 formalName = "Reviewed Controls and Control Objectives", 088 description = "Identifies the controls being assessed and their control objectives.", 089 useName = "reviewed-controls", 090 minOccurs = 1 091 ) 092 private ReviewedControls _reviewedControls; 093 094 @BoundAssembly( 095 formalName = "Subject of Assessment", 096 description = "Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.", 097 useName = "assessment-subject", 098 maxOccurs = -1, 099 groupAs = @GroupAs(name = "assessment-subjects", inJson = JsonGroupAsBehavior.LIST) 100 ) 101 private List<AssessmentSubject> _assessmentSubjects; 102 103 @BoundAssembly( 104 formalName = "Assessment Assets", 105 description = "Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.", 106 useName = "assessment-assets" 107 ) 108 private AssessmentAssets _assessmentAssets; 109 110 @BoundAssembly( 111 formalName = "Task", 112 description = "Represents a scheduled event or milestone, which may be associated with a series of assessment actions.", 113 useName = "task", 114 maxOccurs = -1, 115 groupAs = @GroupAs(name = "tasks", inJson = JsonGroupAsBehavior.LIST) 116 ) 117 private List<Task> _tasks; 118 119 @BoundAssembly( 120 formalName = "Back matter", 121 description = "A collection of resources that may be referenced from within the OSCAL document instance.", 122 useName = "back-matter" 123 ) 124 private BackMatter _backMatter; 125 126 public AssessmentPlan() { 127 this(null); 128 } 129 130 public AssessmentPlan(IMetaschemaData data) { 131 this.__metaschemaData = data; 132 } 133 134 @Override 135 public IMetaschemaData getMetaschemaData() { 136 return __metaschemaData; 137 } 138 139 public UUID getUuid() { 140 return _uuid; 141 } 142 143 public void setUuid(UUID value) { 144 _uuid = value; 145 } 146 147 public Metadata getMetadata() { 148 return _metadata; 149 } 150 151 public void setMetadata(Metadata value) { 152 _metadata = value; 153 } 154 155 public ImportSsp getImportSsp() { 156 return _importSsp; 157 } 158 159 public void setImportSsp(ImportSsp value) { 160 _importSsp = value; 161 } 162 163 public LocalDefinitions getLocalDefinitions() { 164 return _localDefinitions; 165 } 166 167 public void setLocalDefinitions(LocalDefinitions value) { 168 _localDefinitions = value; 169 } 170 171 public TermsAndConditions getTermsAndConditions() { 172 return _termsAndConditions; 173 } 174 175 public void setTermsAndConditions(TermsAndConditions value) { 176 _termsAndConditions = value; 177 } 178 179 public ReviewedControls getReviewedControls() { 180 return _reviewedControls; 181 } 182 183 public void setReviewedControls(ReviewedControls value) { 184 _reviewedControls = value; 185 } 186 187 public List<AssessmentSubject> getAssessmentSubjects() { 188 return _assessmentSubjects; 189 } 190 191 public void setAssessmentSubjects(List<AssessmentSubject> value) { 192 _assessmentSubjects = value; 193 } 194 195 /** 196 * Add a new {@link AssessmentSubject} item to the underlying collection. 197 * @param item the item to add 198 * @return {@code true} 199 */ 200 public boolean addAssessmentSubject(AssessmentSubject item) { 201 AssessmentSubject value = ObjectUtils.requireNonNull(item,"item cannot be null"); 202 if (_assessmentSubjects == null) { 203 _assessmentSubjects = new LinkedList<>(); 204 } 205 return _assessmentSubjects.add(value); 206 } 207 208 /** 209 * Remove the first matching {@link AssessmentSubject} item from the underlying collection. 210 * @param item the item to remove 211 * @return {@code true} if the item was removed or {@code false} otherwise 212 */ 213 public boolean removeAssessmentSubject(AssessmentSubject item) { 214 AssessmentSubject value = ObjectUtils.requireNonNull(item,"item cannot be null"); 215 return _assessmentSubjects != null && _assessmentSubjects.remove(value); 216 } 217 218 public AssessmentAssets getAssessmentAssets() { 219 return _assessmentAssets; 220 } 221 222 public void setAssessmentAssets(AssessmentAssets value) { 223 _assessmentAssets = value; 224 } 225 226 public List<Task> getTasks() { 227 return _tasks; 228 } 229 230 public void setTasks(List<Task> value) { 231 _tasks = value; 232 } 233 234 /** 235 * Add a new {@link Task} item to the underlying collection. 236 * @param item the item to add 237 * @return {@code true} 238 */ 239 public boolean addTask(Task item) { 240 Task value = ObjectUtils.requireNonNull(item,"item cannot be null"); 241 if (_tasks == null) { 242 _tasks = new LinkedList<>(); 243 } 244 return _tasks.add(value); 245 } 246 247 /** 248 * Remove the first matching {@link Task} item from the underlying collection. 249 * @param item the item to remove 250 * @return {@code true} if the item was removed or {@code false} otherwise 251 */ 252 public boolean removeTask(Task item) { 253 Task value = ObjectUtils.requireNonNull(item,"item cannot be null"); 254 return _tasks != null && _tasks.remove(value); 255 } 256 257 public BackMatter getBackMatter() { 258 return _backMatter; 259 } 260 261 public void setBackMatter(BackMatter value) { 262 _backMatter = value; 263 } 264 265 @Override 266 public String toString() { 267 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 268 } 269 270 /** 271 * Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP. 272 */ 273 @MetaschemaAssembly( 274 formalName = "Local Definitions", 275 description = "Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.", 276 name = "local-definitions", 277 moduleClass = OscalApModule.class, 278 modelConstraints = @AssemblyConstraints(unique = {@IsUnique(id = "unique-ap-local-definitions-component", level = IConstraint.Level.ERROR, target = "component", keyFields = @KeyField(target = "@uuid"), remarks = "Since multiple `component` entries can be provided, each component must have a unique `uuid`."), @IsUnique(id = "unique-ap-local-definitions-user", level = IConstraint.Level.ERROR, target = "user", keyFields = @KeyField(target = "@uuid"), remarks = "A given `uuid` must be assigned only once to a user.")}) 279 ) 280 public static class LocalDefinitions implements IBoundObject { 281 private final IMetaschemaData __metaschemaData; 282 283 @BoundAssembly( 284 formalName = "Component", 285 description = "A defined component that can be part of an implemented system.", 286 useName = "component", 287 remarks = "Used to add any components, not defined via the System Security Plan (AR-\\>AP-\\>SSP)", 288 maxOccurs = -1, 289 groupAs = @GroupAs(name = "components", inJson = JsonGroupAsBehavior.LIST) 290 ) 291 private List<SystemComponent> _components; 292 293 @BoundAssembly( 294 formalName = "Inventory Item", 295 description = "A single managed inventory item within the system.", 296 useName = "inventory-item", 297 remarks = "Used to add any inventory-items, not defined via the System Security Plan (AR-\\>AP-\\>SSP)", 298 maxOccurs = -1, 299 groupAs = @GroupAs(name = "inventory-items", inJson = JsonGroupAsBehavior.LIST) 300 ) 301 private List<InventoryItem> _inventoryItems; 302 303 @BoundAssembly( 304 formalName = "System User", 305 description = "A type of user that interacts with the system based on an associated role.", 306 useName = "user", 307 remarks = "Used to add any users, not defined via the System Security Plan (AR-\\>AP-\\>SSP)", 308 maxOccurs = -1, 309 groupAs = @GroupAs(name = "users", inJson = JsonGroupAsBehavior.LIST) 310 ) 311 private List<SystemUser> _users; 312 313 @BoundAssembly( 314 formalName = "Assessment-Specific Control Objective", 315 description = "A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.", 316 useName = "objectives-and-methods", 317 maxOccurs = -1, 318 groupAs = @GroupAs(name = "objectives-and-methods", inJson = JsonGroupAsBehavior.LIST) 319 ) 320 private List<LocalObjective> _objectivesAndMethods; 321 322 @BoundAssembly( 323 formalName = "Activity", 324 description = "Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.", 325 useName = "activity", 326 maxOccurs = -1, 327 groupAs = @GroupAs(name = "activities", inJson = JsonGroupAsBehavior.LIST) 328 ) 329 private List<Activity> _activities; 330 331 @BoundField( 332 formalName = "Remarks", 333 description = "Additional commentary about the containing object.", 334 useName = "remarks", 335 typeAdapter = MarkupMultilineAdapter.class 336 ) 337 private MarkupMultiline _remarks; 338 339 public LocalDefinitions() { 340 this(null); 341 } 342 343 public LocalDefinitions(IMetaschemaData data) { 344 this.__metaschemaData = data; 345 } 346 347 @Override 348 public IMetaschemaData getMetaschemaData() { 349 return __metaschemaData; 350 } 351 352 public List<SystemComponent> getComponents() { 353 return _components; 354 } 355 356 public void setComponents(List<SystemComponent> value) { 357 _components = value; 358 } 359 360 /** 361 * Add a new {@link SystemComponent} item to the underlying collection. 362 * @param item the item to add 363 * @return {@code true} 364 */ 365 public boolean addComponent(SystemComponent item) { 366 SystemComponent value = ObjectUtils.requireNonNull(item,"item cannot be null"); 367 if (_components == null) { 368 _components = new LinkedList<>(); 369 } 370 return _components.add(value); 371 } 372 373 /** 374 * Remove the first matching {@link SystemComponent} item from the underlying collection. 375 * @param item the item to remove 376 * @return {@code true} if the item was removed or {@code false} otherwise 377 */ 378 public boolean removeComponent(SystemComponent item) { 379 SystemComponent value = ObjectUtils.requireNonNull(item,"item cannot be null"); 380 return _components != null && _components.remove(value); 381 } 382 383 public List<InventoryItem> getInventoryItems() { 384 return _inventoryItems; 385 } 386 387 public void setInventoryItems(List<InventoryItem> value) { 388 _inventoryItems = value; 389 } 390 391 /** 392 * Add a new {@link InventoryItem} item to the underlying collection. 393 * @param item the item to add 394 * @return {@code true} 395 */ 396 public boolean addInventoryItem(InventoryItem item) { 397 InventoryItem value = ObjectUtils.requireNonNull(item,"item cannot be null"); 398 if (_inventoryItems == null) { 399 _inventoryItems = new LinkedList<>(); 400 } 401 return _inventoryItems.add(value); 402 } 403 404 /** 405 * Remove the first matching {@link InventoryItem} item from the underlying collection. 406 * @param item the item to remove 407 * @return {@code true} if the item was removed or {@code false} otherwise 408 */ 409 public boolean removeInventoryItem(InventoryItem item) { 410 InventoryItem value = ObjectUtils.requireNonNull(item,"item cannot be null"); 411 return _inventoryItems != null && _inventoryItems.remove(value); 412 } 413 414 public List<SystemUser> getUsers() { 415 return _users; 416 } 417 418 public void setUsers(List<SystemUser> value) { 419 _users = value; 420 } 421 422 /** 423 * Add a new {@link SystemUser} item to the underlying collection. 424 * @param item the item to add 425 * @return {@code true} 426 */ 427 public boolean addUser(SystemUser item) { 428 SystemUser value = ObjectUtils.requireNonNull(item,"item cannot be null"); 429 if (_users == null) { 430 _users = new LinkedList<>(); 431 } 432 return _users.add(value); 433 } 434 435 /** 436 * Remove the first matching {@link SystemUser} item from the underlying collection. 437 * @param item the item to remove 438 * @return {@code true} if the item was removed or {@code false} otherwise 439 */ 440 public boolean removeUser(SystemUser item) { 441 SystemUser value = ObjectUtils.requireNonNull(item,"item cannot be null"); 442 return _users != null && _users.remove(value); 443 } 444 445 public List<LocalObjective> getObjectivesAndMethods() { 446 return _objectivesAndMethods; 447 } 448 449 public void setObjectivesAndMethods(List<LocalObjective> value) { 450 _objectivesAndMethods = value; 451 } 452 453 /** 454 * Add a new {@link LocalObjective} item to the underlying collection. 455 * @param item the item to add 456 * @return {@code true} 457 */ 458 public boolean addObjectivesAndMethods(LocalObjective item) { 459 LocalObjective value = ObjectUtils.requireNonNull(item,"item cannot be null"); 460 if (_objectivesAndMethods == null) { 461 _objectivesAndMethods = new LinkedList<>(); 462 } 463 return _objectivesAndMethods.add(value); 464 } 465 466 /** 467 * Remove the first matching {@link LocalObjective} item from the underlying collection. 468 * @param item the item to remove 469 * @return {@code true} if the item was removed or {@code false} otherwise 470 */ 471 public boolean removeObjectivesAndMethods(LocalObjective item) { 472 LocalObjective value = ObjectUtils.requireNonNull(item,"item cannot be null"); 473 return _objectivesAndMethods != null && _objectivesAndMethods.remove(value); 474 } 475 476 public List<Activity> getActivities() { 477 return _activities; 478 } 479 480 public void setActivities(List<Activity> value) { 481 _activities = value; 482 } 483 484 /** 485 * Add a new {@link Activity} item to the underlying collection. 486 * @param item the item to add 487 * @return {@code true} 488 */ 489 public boolean addActivity(Activity item) { 490 Activity value = ObjectUtils.requireNonNull(item,"item cannot be null"); 491 if (_activities == null) { 492 _activities = new LinkedList<>(); 493 } 494 return _activities.add(value); 495 } 496 497 /** 498 * Remove the first matching {@link Activity} item from the underlying collection. 499 * @param item the item to remove 500 * @return {@code true} if the item was removed or {@code false} otherwise 501 */ 502 public boolean removeActivity(Activity item) { 503 Activity value = ObjectUtils.requireNonNull(item,"item cannot be null"); 504 return _activities != null && _activities.remove(value); 505 } 506 507 public MarkupMultiline getRemarks() { 508 return _remarks; 509 } 510 511 public void setRemarks(MarkupMultiline value) { 512 _remarks = value; 513 } 514 515 @Override 516 public String toString() { 517 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 518 } 519 } 520 521 /** 522 * Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition. 523 */ 524 @MetaschemaAssembly( 525 formalName = "Assessment Plan Terms and Conditions", 526 description = "Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.", 527 name = "terms-and-conditions", 528 moduleClass = OscalApModule.class, 529 valueConstraints = @ValueConstraints(allowedValues = @AllowedValues(level = IConstraint.Level.ERROR, target = "part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name", values = {@AllowedValue(value = "rules-of-engagement", description = "Defines the circumstances, conditions, degree, and manner in which the use of cyber-attack techniques or actions may be applied to the assessment."), @AllowedValue(value = "disclosures", description = "Any information the assessor should make known to the system owner or authorizing official. Has child 'item' parts for each individual disclosure."), @AllowedValue(value = "assessment-inclusions", description = "Defines any assessment activities which the system owner or authorizing official wishes to ensure are performed as part of the assessment."), @AllowedValue(value = "assessment-exclusions", description = "Defines any assessment activities which the system owner or authorizing official explicitly prohibits from being performed as part of the assessment."), @AllowedValue(value = "results-delivery", description = "Defines conditions related to the delivery of the assessment results, such as when to deliver, how, and to whom."), @AllowedValue(value = "assumptions", description = "Defines any supposition made by the assessor. Has child 'item' parts for each assumption."), @AllowedValue(value = "methodology", description = "An explanation of practices, procedures, and rules used in the course of the assessment.")})) 530 ) 531 public static class TermsAndConditions implements IBoundObject { 532 private final IMetaschemaData __metaschemaData; 533 534 @BoundAssembly( 535 formalName = "Assessment Part", 536 description = "A partition of an assessment plan or results or a child of another part.", 537 useName = "part", 538 maxOccurs = -1, 539 groupAs = @GroupAs(name = "parts", inJson = JsonGroupAsBehavior.LIST) 540 ) 541 private List<AssessmentPart> _parts; 542 543 public TermsAndConditions() { 544 this(null); 545 } 546 547 public TermsAndConditions(IMetaschemaData data) { 548 this.__metaschemaData = data; 549 } 550 551 @Override 552 public IMetaschemaData getMetaschemaData() { 553 return __metaschemaData; 554 } 555 556 public List<AssessmentPart> getParts() { 557 return _parts; 558 } 559 560 public void setParts(List<AssessmentPart> value) { 561 _parts = value; 562 } 563 564 /** 565 * Add a new {@link AssessmentPart} item to the underlying collection. 566 * @param item the item to add 567 * @return {@code true} 568 */ 569 public boolean addPart(AssessmentPart item) { 570 AssessmentPart value = ObjectUtils.requireNonNull(item,"item cannot be null"); 571 if (_parts == null) { 572 _parts = new LinkedList<>(); 573 } 574 return _parts.add(value); 575 } 576 577 /** 578 * Remove the first matching {@link AssessmentPart} item from the underlying collection. 579 * @param item the item to remove 580 * @return {@code true} if the item was removed or {@code false} otherwise 581 */ 582 public boolean removePart(AssessmentPart item) { 583 AssessmentPart value = ObjectUtils.requireNonNull(item,"item cannot be null"); 584 return _parts != null && _parts.remove(value); 585 } 586 587 @Override 588 public String toString() { 589 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 590 } 591 } 592}