001package gov.nist.secauto.oscal.lib.model;
002
003import gov.nist.secauto.metaschema.core.datatype.adapter.UuidAdapter;
004import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultiline;
005import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultilineAdapter;
006import gov.nist.secauto.metaschema.core.model.IBoundObject;
007import gov.nist.secauto.metaschema.core.model.IMetaschemaData;
008import gov.nist.secauto.metaschema.core.model.JsonGroupAsBehavior;
009import gov.nist.secauto.metaschema.core.model.constraint.IConstraint;
010import gov.nist.secauto.metaschema.core.util.ObjectUtils;
011import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValue;
012import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValues;
013import gov.nist.secauto.metaschema.databind.model.annotations.AssemblyConstraints;
014import gov.nist.secauto.metaschema.databind.model.annotations.BoundAssembly;
015import gov.nist.secauto.metaschema.databind.model.annotations.BoundField;
016import gov.nist.secauto.metaschema.databind.model.annotations.BoundFlag;
017import gov.nist.secauto.metaschema.databind.model.annotations.GroupAs;
018import gov.nist.secauto.metaschema.databind.model.annotations.IsUnique;
019import gov.nist.secauto.metaschema.databind.model.annotations.KeyField;
020import gov.nist.secauto.metaschema.databind.model.annotations.MetaschemaAssembly;
021import gov.nist.secauto.metaschema.databind.model.annotations.ValueConstraints;
022import java.lang.Override;
023import java.lang.String;
024import java.util.LinkedList;
025import java.util.List;
026import java.util.UUID;
027import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
028import org.apache.commons.lang3.builder.ToStringStyle;
029
030/**
031 * An assessment plan, such as those provided by a FedRAMP assessor.
032 */
033@MetaschemaAssembly(
034    formalName = "Security Assessment Plan (SAP)",
035    description = "An assessment plan, such as those provided by a FedRAMP assessor.",
036    name = "assessment-plan",
037    moduleClass = OscalApModule.class,
038    rootName = "assessment-plan"
039)
040public class AssessmentPlan extends AbstractOscalInstance implements IBoundObject {
041  private final IMetaschemaData __metaschemaData;
042
043  /**
044   * "A <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented\">machine-oriented</a>, <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique\">globally unique</a> identifier with <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance\">cross-instance</a> scope that can be used to reference this assessment plan in <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#ap-identifiers\">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>assessment plan</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency\">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document."
045   */
046  @BoundFlag(
047      formalName = "Assessment Plan Universally Unique Identifier",
048      description = "A [machine-oriented](https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented), [globally unique](https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique) identifier with [cross-instance](https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance) scope that can be used to reference this assessment plan in [this or other OSCAL instances](https://pages.nist.gov/OSCAL/concepts/identifier-use/#ap-identifiers). The locally defined *UUID* of the `assessment plan` can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned [per-subject](https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency), which means it should be consistently used to identify the same subject across revisions of the document.",
049      name = "uuid",
050      required = true,
051      typeAdapter = UuidAdapter.class
052  )
053  private UUID _uuid;
054
055  @BoundAssembly(
056      formalName = "Document Metadata",
057      description = "Provides information about the containing document, and defines concepts that are shared across the document.",
058      useName = "metadata",
059      minOccurs = 1
060  )
061  private Metadata _metadata;
062
063  @BoundAssembly(
064      formalName = "Import System Security Plan",
065      description = "Used by the assessment plan and POA\\&M to import information about the system.",
066      useName = "import-ssp",
067      remarks = "Used by the SAP to import information about the system being assessed.",
068      minOccurs = 1
069  )
070  private ImportSsp _importSsp;
071
072  @BoundAssembly(
073      formalName = "Local Definitions",
074      description = "Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.",
075      useName = "local-definitions"
076  )
077  private LocalDefinitions _localDefinitions;
078
079  @BoundAssembly(
080      formalName = "Assessment Plan Terms and Conditions",
081      description = "Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.",
082      useName = "terms-and-conditions"
083  )
084  private TermsAndConditions _termsAndConditions;
085
086  @BoundAssembly(
087      formalName = "Reviewed Controls and Control Objectives",
088      description = "Identifies the controls being assessed and their control objectives.",
089      useName = "reviewed-controls",
090      minOccurs = 1
091  )
092  private ReviewedControls _reviewedControls;
093
094  @BoundAssembly(
095      formalName = "Subject of Assessment",
096      description = "Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.",
097      useName = "assessment-subject",
098      maxOccurs = -1,
099      groupAs = @GroupAs(name = "assessment-subjects", inJson = JsonGroupAsBehavior.LIST)
100  )
101  private List<AssessmentSubject> _assessmentSubjects;
102
103  @BoundAssembly(
104      formalName = "Assessment Assets",
105      description = "Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.",
106      useName = "assessment-assets"
107  )
108  private AssessmentAssets _assessmentAssets;
109
110  @BoundAssembly(
111      formalName = "Task",
112      description = "Represents a scheduled event or milestone, which may be associated with a series of assessment actions.",
113      useName = "task",
114      maxOccurs = -1,
115      groupAs = @GroupAs(name = "tasks", inJson = JsonGroupAsBehavior.LIST)
116  )
117  private List<Task> _tasks;
118
119  @BoundAssembly(
120      formalName = "Back matter",
121      description = "A collection of resources that may be referenced from within the OSCAL document instance.",
122      useName = "back-matter"
123  )
124  private BackMatter _backMatter;
125
126  public AssessmentPlan() {
127    this(null);
128  }
129
130  public AssessmentPlan(IMetaschemaData data) {
131    this.__metaschemaData = data;
132  }
133
134  @Override
135  public IMetaschemaData getMetaschemaData() {
136    return __metaschemaData;
137  }
138
139  public UUID getUuid() {
140    return _uuid;
141  }
142
143  public void setUuid(UUID value) {
144    _uuid = value;
145  }
146
147  public Metadata getMetadata() {
148    return _metadata;
149  }
150
151  public void setMetadata(Metadata value) {
152    _metadata = value;
153  }
154
155  public ImportSsp getImportSsp() {
156    return _importSsp;
157  }
158
159  public void setImportSsp(ImportSsp value) {
160    _importSsp = value;
161  }
162
163  public LocalDefinitions getLocalDefinitions() {
164    return _localDefinitions;
165  }
166
167  public void setLocalDefinitions(LocalDefinitions value) {
168    _localDefinitions = value;
169  }
170
171  public TermsAndConditions getTermsAndConditions() {
172    return _termsAndConditions;
173  }
174
175  public void setTermsAndConditions(TermsAndConditions value) {
176    _termsAndConditions = value;
177  }
178
179  public ReviewedControls getReviewedControls() {
180    return _reviewedControls;
181  }
182
183  public void setReviewedControls(ReviewedControls value) {
184    _reviewedControls = value;
185  }
186
187  public List<AssessmentSubject> getAssessmentSubjects() {
188    return _assessmentSubjects;
189  }
190
191  public void setAssessmentSubjects(List<AssessmentSubject> value) {
192    _assessmentSubjects = value;
193  }
194
195  /**
196   * Add a new {@link AssessmentSubject} item to the underlying collection.
197   * @param item the item to add
198   * @return {@code true}
199   */
200  public boolean addAssessmentSubject(AssessmentSubject item) {
201    AssessmentSubject value = ObjectUtils.requireNonNull(item,"item cannot be null");
202    if (_assessmentSubjects == null) {
203      _assessmentSubjects = new LinkedList<>();
204    }
205    return _assessmentSubjects.add(value);
206  }
207
208  /**
209   * Remove the first matching {@link AssessmentSubject} item from the underlying collection.
210   * @param item the item to remove
211   * @return {@code true} if the item was removed or {@code false} otherwise
212   */
213  public boolean removeAssessmentSubject(AssessmentSubject item) {
214    AssessmentSubject value = ObjectUtils.requireNonNull(item,"item cannot be null");
215    return _assessmentSubjects != null && _assessmentSubjects.remove(value);
216  }
217
218  public AssessmentAssets getAssessmentAssets() {
219    return _assessmentAssets;
220  }
221
222  public void setAssessmentAssets(AssessmentAssets value) {
223    _assessmentAssets = value;
224  }
225
226  public List<Task> getTasks() {
227    return _tasks;
228  }
229
230  public void setTasks(List<Task> value) {
231    _tasks = value;
232  }
233
234  /**
235   * Add a new {@link Task} item to the underlying collection.
236   * @param item the item to add
237   * @return {@code true}
238   */
239  public boolean addTask(Task item) {
240    Task value = ObjectUtils.requireNonNull(item,"item cannot be null");
241    if (_tasks == null) {
242      _tasks = new LinkedList<>();
243    }
244    return _tasks.add(value);
245  }
246
247  /**
248   * Remove the first matching {@link Task} item from the underlying collection.
249   * @param item the item to remove
250   * @return {@code true} if the item was removed or {@code false} otherwise
251   */
252  public boolean removeTask(Task item) {
253    Task value = ObjectUtils.requireNonNull(item,"item cannot be null");
254    return _tasks != null && _tasks.remove(value);
255  }
256
257  public BackMatter getBackMatter() {
258    return _backMatter;
259  }
260
261  public void setBackMatter(BackMatter value) {
262    _backMatter = value;
263  }
264
265  @Override
266  public String toString() {
267    return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString();
268  }
269
270  /**
271   * Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.
272   */
273  @MetaschemaAssembly(
274      formalName = "Local Definitions",
275      description = "Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.",
276      name = "local-definitions",
277      moduleClass = OscalApModule.class,
278      modelConstraints = @AssemblyConstraints(unique = {@IsUnique(id = "unique-ap-local-definitions-component", level = IConstraint.Level.ERROR, target = "component", keyFields = @KeyField(target = "@uuid"), remarks = "Since multiple `component` entries can be provided, each component must have a unique `uuid`."), @IsUnique(id = "unique-ap-local-definitions-user", level = IConstraint.Level.ERROR, target = "user", keyFields = @KeyField(target = "@uuid"), remarks = "A given `uuid` must be assigned only once to a user.")})
279  )
280  public static class LocalDefinitions implements IBoundObject {
281    private final IMetaschemaData __metaschemaData;
282
283    @BoundAssembly(
284        formalName = "Component",
285        description = "A defined component that can be part of an implemented system.",
286        useName = "component",
287        remarks = "Used to add any components, not defined via the System Security Plan (AR-\\>AP-\\>SSP)",
288        maxOccurs = -1,
289        groupAs = @GroupAs(name = "components", inJson = JsonGroupAsBehavior.LIST)
290    )
291    private List<SystemComponent> _components;
292
293    @BoundAssembly(
294        formalName = "Inventory Item",
295        description = "A single managed inventory item within the system.",
296        useName = "inventory-item",
297        remarks = "Used to add any inventory-items, not defined via the System Security Plan (AR-\\>AP-\\>SSP)",
298        maxOccurs = -1,
299        groupAs = @GroupAs(name = "inventory-items", inJson = JsonGroupAsBehavior.LIST)
300    )
301    private List<InventoryItem> _inventoryItems;
302
303    @BoundAssembly(
304        formalName = "System User",
305        description = "A type of user that interacts with the system based on an associated role.",
306        useName = "user",
307        remarks = "Used to add any users, not defined via the System Security Plan (AR-\\>AP-\\>SSP)",
308        maxOccurs = -1,
309        groupAs = @GroupAs(name = "users", inJson = JsonGroupAsBehavior.LIST)
310    )
311    private List<SystemUser> _users;
312
313    @BoundAssembly(
314        formalName = "Assessment-Specific Control Objective",
315        description = "A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.",
316        useName = "objectives-and-methods",
317        maxOccurs = -1,
318        groupAs = @GroupAs(name = "objectives-and-methods", inJson = JsonGroupAsBehavior.LIST)
319    )
320    private List<LocalObjective> _objectivesAndMethods;
321
322    @BoundAssembly(
323        formalName = "Activity",
324        description = "Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.",
325        useName = "activity",
326        maxOccurs = -1,
327        groupAs = @GroupAs(name = "activities", inJson = JsonGroupAsBehavior.LIST)
328    )
329    private List<Activity> _activities;
330
331    @BoundField(
332        formalName = "Remarks",
333        description = "Additional commentary about the containing object.",
334        useName = "remarks",
335        typeAdapter = MarkupMultilineAdapter.class
336    )
337    private MarkupMultiline _remarks;
338
339    public LocalDefinitions() {
340      this(null);
341    }
342
343    public LocalDefinitions(IMetaschemaData data) {
344      this.__metaschemaData = data;
345    }
346
347    @Override
348    public IMetaschemaData getMetaschemaData() {
349      return __metaschemaData;
350    }
351
352    public List<SystemComponent> getComponents() {
353      return _components;
354    }
355
356    public void setComponents(List<SystemComponent> value) {
357      _components = value;
358    }
359
360    /**
361     * Add a new {@link SystemComponent} item to the underlying collection.
362     * @param item the item to add
363     * @return {@code true}
364     */
365    public boolean addComponent(SystemComponent item) {
366      SystemComponent value = ObjectUtils.requireNonNull(item,"item cannot be null");
367      if (_components == null) {
368        _components = new LinkedList<>();
369      }
370      return _components.add(value);
371    }
372
373    /**
374     * Remove the first matching {@link SystemComponent} item from the underlying collection.
375     * @param item the item to remove
376     * @return {@code true} if the item was removed or {@code false} otherwise
377     */
378    public boolean removeComponent(SystemComponent item) {
379      SystemComponent value = ObjectUtils.requireNonNull(item,"item cannot be null");
380      return _components != null && _components.remove(value);
381    }
382
383    public List<InventoryItem> getInventoryItems() {
384      return _inventoryItems;
385    }
386
387    public void setInventoryItems(List<InventoryItem> value) {
388      _inventoryItems = value;
389    }
390
391    /**
392     * Add a new {@link InventoryItem} item to the underlying collection.
393     * @param item the item to add
394     * @return {@code true}
395     */
396    public boolean addInventoryItem(InventoryItem item) {
397      InventoryItem value = ObjectUtils.requireNonNull(item,"item cannot be null");
398      if (_inventoryItems == null) {
399        _inventoryItems = new LinkedList<>();
400      }
401      return _inventoryItems.add(value);
402    }
403
404    /**
405     * Remove the first matching {@link InventoryItem} item from the underlying collection.
406     * @param item the item to remove
407     * @return {@code true} if the item was removed or {@code false} otherwise
408     */
409    public boolean removeInventoryItem(InventoryItem item) {
410      InventoryItem value = ObjectUtils.requireNonNull(item,"item cannot be null");
411      return _inventoryItems != null && _inventoryItems.remove(value);
412    }
413
414    public List<SystemUser> getUsers() {
415      return _users;
416    }
417
418    public void setUsers(List<SystemUser> value) {
419      _users = value;
420    }
421
422    /**
423     * Add a new {@link SystemUser} item to the underlying collection.
424     * @param item the item to add
425     * @return {@code true}
426     */
427    public boolean addUser(SystemUser item) {
428      SystemUser value = ObjectUtils.requireNonNull(item,"item cannot be null");
429      if (_users == null) {
430        _users = new LinkedList<>();
431      }
432      return _users.add(value);
433    }
434
435    /**
436     * Remove the first matching {@link SystemUser} item from the underlying collection.
437     * @param item the item to remove
438     * @return {@code true} if the item was removed or {@code false} otherwise
439     */
440    public boolean removeUser(SystemUser item) {
441      SystemUser value = ObjectUtils.requireNonNull(item,"item cannot be null");
442      return _users != null && _users.remove(value);
443    }
444
445    public List<LocalObjective> getObjectivesAndMethods() {
446      return _objectivesAndMethods;
447    }
448
449    public void setObjectivesAndMethods(List<LocalObjective> value) {
450      _objectivesAndMethods = value;
451    }
452
453    /**
454     * Add a new {@link LocalObjective} item to the underlying collection.
455     * @param item the item to add
456     * @return {@code true}
457     */
458    public boolean addObjectivesAndMethods(LocalObjective item) {
459      LocalObjective value = ObjectUtils.requireNonNull(item,"item cannot be null");
460      if (_objectivesAndMethods == null) {
461        _objectivesAndMethods = new LinkedList<>();
462      }
463      return _objectivesAndMethods.add(value);
464    }
465
466    /**
467     * Remove the first matching {@link LocalObjective} item from the underlying collection.
468     * @param item the item to remove
469     * @return {@code true} if the item was removed or {@code false} otherwise
470     */
471    public boolean removeObjectivesAndMethods(LocalObjective item) {
472      LocalObjective value = ObjectUtils.requireNonNull(item,"item cannot be null");
473      return _objectivesAndMethods != null && _objectivesAndMethods.remove(value);
474    }
475
476    public List<Activity> getActivities() {
477      return _activities;
478    }
479
480    public void setActivities(List<Activity> value) {
481      _activities = value;
482    }
483
484    /**
485     * Add a new {@link Activity} item to the underlying collection.
486     * @param item the item to add
487     * @return {@code true}
488     */
489    public boolean addActivity(Activity item) {
490      Activity value = ObjectUtils.requireNonNull(item,"item cannot be null");
491      if (_activities == null) {
492        _activities = new LinkedList<>();
493      }
494      return _activities.add(value);
495    }
496
497    /**
498     * Remove the first matching {@link Activity} item from the underlying collection.
499     * @param item the item to remove
500     * @return {@code true} if the item was removed or {@code false} otherwise
501     */
502    public boolean removeActivity(Activity item) {
503      Activity value = ObjectUtils.requireNonNull(item,"item cannot be null");
504      return _activities != null && _activities.remove(value);
505    }
506
507    public MarkupMultiline getRemarks() {
508      return _remarks;
509    }
510
511    public void setRemarks(MarkupMultiline value) {
512      _remarks = value;
513    }
514
515    @Override
516    public String toString() {
517      return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString();
518    }
519  }
520
521  /**
522   * Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.
523   */
524  @MetaschemaAssembly(
525      formalName = "Assessment Plan Terms and Conditions",
526      description = "Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.",
527      name = "terms-and-conditions",
528      moduleClass = OscalApModule.class,
529      valueConstraints = @ValueConstraints(allowedValues = @AllowedValues(level = IConstraint.Level.ERROR, target = "part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name", values = {@AllowedValue(value = "rules-of-engagement", description = "Defines the circumstances, conditions, degree, and manner in which the use of cyber-attack techniques or actions may be applied to the assessment."), @AllowedValue(value = "disclosures", description = "Any information the assessor should make known to the system owner or authorizing official. Has child 'item' parts for each individual disclosure."), @AllowedValue(value = "assessment-inclusions", description = "Defines any assessment activities which the system owner or authorizing official wishes to ensure are performed as part of the assessment."), @AllowedValue(value = "assessment-exclusions", description = "Defines any assessment activities which the system owner or authorizing official explicitly prohibits from being performed as part of the assessment."), @AllowedValue(value = "results-delivery", description = "Defines conditions related to the delivery of the assessment results, such as when to deliver, how, and to whom."), @AllowedValue(value = "assumptions", description = "Defines any supposition made by the assessor. Has child 'item' parts for each assumption."), @AllowedValue(value = "methodology", description = "An explanation of practices, procedures, and rules used in the course of the assessment.")}))
530  )
531  public static class TermsAndConditions implements IBoundObject {
532    private final IMetaschemaData __metaschemaData;
533
534    @BoundAssembly(
535        formalName = "Assessment Part",
536        description = "A partition of an assessment plan or results or a child of another part.",
537        useName = "part",
538        maxOccurs = -1,
539        groupAs = @GroupAs(name = "parts", inJson = JsonGroupAsBehavior.LIST)
540    )
541    private List<AssessmentPart> _parts;
542
543    public TermsAndConditions() {
544      this(null);
545    }
546
547    public TermsAndConditions(IMetaschemaData data) {
548      this.__metaschemaData = data;
549    }
550
551    @Override
552    public IMetaschemaData getMetaschemaData() {
553      return __metaschemaData;
554    }
555
556    public List<AssessmentPart> getParts() {
557      return _parts;
558    }
559
560    public void setParts(List<AssessmentPart> value) {
561      _parts = value;
562    }
563
564    /**
565     * Add a new {@link AssessmentPart} item to the underlying collection.
566     * @param item the item to add
567     * @return {@code true}
568     */
569    public boolean addPart(AssessmentPart item) {
570      AssessmentPart value = ObjectUtils.requireNonNull(item,"item cannot be null");
571      if (_parts == null) {
572        _parts = new LinkedList<>();
573      }
574      return _parts.add(value);
575    }
576
577    /**
578     * Remove the first matching {@link AssessmentPart} item from the underlying collection.
579     * @param item the item to remove
580     * @return {@code true} if the item was removed or {@code false} otherwise
581     */
582    public boolean removePart(AssessmentPart item) {
583      AssessmentPart value = ObjectUtils.requireNonNull(item,"item cannot be null");
584      return _parts != null && _parts.remove(value);
585    }
586
587    @Override
588    public String toString() {
589      return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString();
590    }
591  }
592}