001package gov.nist.secauto.oscal.lib.model; 002 003import gov.nist.secauto.metaschema.core.datatype.adapter.UuidAdapter; 004import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultiline; 005import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultilineAdapter; 006import gov.nist.secauto.metaschema.core.model.IBoundObject; 007import gov.nist.secauto.metaschema.core.model.IMetaschemaData; 008import gov.nist.secauto.metaschema.core.model.JsonGroupAsBehavior; 009import gov.nist.secauto.metaschema.core.util.ObjectUtils; 010import gov.nist.secauto.metaschema.databind.model.annotations.BoundAssembly; 011import gov.nist.secauto.metaschema.databind.model.annotations.BoundField; 012import gov.nist.secauto.metaschema.databind.model.annotations.BoundFlag; 013import gov.nist.secauto.metaschema.databind.model.annotations.GroupAs; 014import gov.nist.secauto.metaschema.databind.model.annotations.MetaschemaAssembly; 015import java.lang.Override; 016import java.lang.String; 017import java.util.LinkedList; 018import java.util.List; 019import java.util.UUID; 020import org.apache.commons.lang3.builder.ReflectionToStringBuilder; 021import org.apache.commons.lang3.builder.ToStringStyle; 022 023/** 024 * Security assessment results, such as those provided by a FedRAMP assessor in the FedRAMP Security Assessment Report. 025 */ 026@MetaschemaAssembly( 027 formalName = "Security Assessment Results (SAR)", 028 description = "Security assessment results, such as those provided by a FedRAMP assessor in the FedRAMP Security Assessment Report.", 029 name = "assessment-results", 030 moduleClass = OscalArModule.class, 031 rootName = "assessment-results" 032) 033public class AssessmentResults implements IBoundObject { 034 private final IMetaschemaData __metaschemaData; 035 036 /** 037 * "A <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented\">machine-oriented</a>, <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique\">globally unique</a> identifier with <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance\">cross-instance</a> scope that can be used to reference this assessment results instance in <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#ar-identifiers\">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>assessment result</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency\">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document." 038 */ 039 @BoundFlag( 040 formalName = "Assessment Results Universally Unique Identifier", 041 description = "A [machine-oriented](https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented), [globally unique](https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique) identifier with [cross-instance](https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance) scope that can be used to reference this assessment results instance in [this or other OSCAL instances](https://pages.nist.gov/OSCAL/concepts/identifier-use/#ar-identifiers). The locally defined *UUID* of the `assessment result` can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned [per-subject](https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency), which means it should be consistently used to identify the same subject across revisions of the document.", 042 name = "uuid", 043 required = true, 044 typeAdapter = UuidAdapter.class 045 ) 046 private UUID _uuid; 047 048 @BoundAssembly( 049 formalName = "Document Metadata", 050 description = "Provides information about the containing document, and defines concepts that are shared across the document.", 051 useName = "metadata", 052 minOccurs = 1 053 ) 054 private Metadata _metadata; 055 056 @BoundAssembly( 057 formalName = "Import Assessment Plan", 058 description = "Used by assessment-results to import information about the original plan for assessing the system.", 059 useName = "import-ap", 060 remarks = "Used by the SAR to import information about the original plan for assessing the system.", 061 minOccurs = 1 062 ) 063 private ImportAp _importAp; 064 065 @BoundAssembly( 066 formalName = "Local Definitions", 067 description = "Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.", 068 useName = "local-definitions" 069 ) 070 private LocalDefinitions _localDefinitions; 071 072 @BoundAssembly( 073 formalName = "Assessment Result", 074 description = "Used by the assessment results and POA\\&M. In the assessment results, this identifies all of the assessment observations and findings, initial and residual risks, deviations, and disposition. In the POA\\&M, this identifies initial and residual risks, deviations, and disposition.", 075 useName = "result", 076 minOccurs = 1, 077 maxOccurs = -1, 078 groupAs = @GroupAs(name = "results", inJson = JsonGroupAsBehavior.LIST) 079 ) 080 private List<Result> _results; 081 082 @BoundAssembly( 083 formalName = "Back matter", 084 description = "A collection of resources that may be referenced from within the OSCAL document instance.", 085 useName = "back-matter" 086 ) 087 private BackMatter _backMatter; 088 089 public AssessmentResults() { 090 this(null); 091 } 092 093 public AssessmentResults(IMetaschemaData data) { 094 this.__metaschemaData = data; 095 } 096 097 @Override 098 public IMetaschemaData getMetaschemaData() { 099 return __metaschemaData; 100 } 101 102 public UUID getUuid() { 103 return _uuid; 104 } 105 106 public void setUuid(UUID value) { 107 _uuid = value; 108 } 109 110 public Metadata getMetadata() { 111 return _metadata; 112 } 113 114 public void setMetadata(Metadata value) { 115 _metadata = value; 116 } 117 118 public ImportAp getImportAp() { 119 return _importAp; 120 } 121 122 public void setImportAp(ImportAp value) { 123 _importAp = value; 124 } 125 126 public LocalDefinitions getLocalDefinitions() { 127 return _localDefinitions; 128 } 129 130 public void setLocalDefinitions(LocalDefinitions value) { 131 _localDefinitions = value; 132 } 133 134 public List<Result> getResults() { 135 return _results; 136 } 137 138 public void setResults(List<Result> value) { 139 _results = value; 140 } 141 142 /** 143 * Add a new {@link Result} item to the underlying collection. 144 * @param item the item to add 145 * @return {@code true} 146 */ 147 public boolean addResult(Result item) { 148 Result value = ObjectUtils.requireNonNull(item,"item cannot be null"); 149 if (_results == null) { 150 _results = new LinkedList<>(); 151 } 152 return _results.add(value); 153 } 154 155 /** 156 * Remove the first matching {@link Result} item from the underlying collection. 157 * @param item the item to remove 158 * @return {@code true} if the item was removed or {@code false} otherwise 159 */ 160 public boolean removeResult(Result item) { 161 Result value = ObjectUtils.requireNonNull(item,"item cannot be null"); 162 return _results != null && _results.remove(value); 163 } 164 165 public BackMatter getBackMatter() { 166 return _backMatter; 167 } 168 169 public void setBackMatter(BackMatter value) { 170 _backMatter = value; 171 } 172 173 @Override 174 public String toString() { 175 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 176 } 177 178 /** 179 * Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP. 180 */ 181 @MetaschemaAssembly( 182 formalName = "Local Definitions", 183 description = "Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.", 184 name = "local-definitions", 185 moduleClass = OscalArModule.class 186 ) 187 public static class LocalDefinitions implements IBoundObject { 188 private final IMetaschemaData __metaschemaData; 189 190 @BoundAssembly( 191 formalName = "Assessment-Specific Control Objective", 192 description = "A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.", 193 useName = "objectives-and-methods", 194 maxOccurs = -1, 195 groupAs = @GroupAs(name = "objectives-and-methods", inJson = JsonGroupAsBehavior.LIST) 196 ) 197 private List<LocalObjective> _objectivesAndMethods; 198 199 @BoundAssembly( 200 formalName = "Activity", 201 description = "Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.", 202 useName = "activity", 203 maxOccurs = -1, 204 groupAs = @GroupAs(name = "activities", inJson = JsonGroupAsBehavior.LIST) 205 ) 206 private List<Activity> _activities; 207 208 @BoundField( 209 formalName = "Remarks", 210 description = "Additional commentary about the containing object.", 211 useName = "remarks", 212 typeAdapter = MarkupMultilineAdapter.class 213 ) 214 private MarkupMultiline _remarks; 215 216 public LocalDefinitions() { 217 this(null); 218 } 219 220 public LocalDefinitions(IMetaschemaData data) { 221 this.__metaschemaData = data; 222 } 223 224 @Override 225 public IMetaschemaData getMetaschemaData() { 226 return __metaschemaData; 227 } 228 229 public List<LocalObjective> getObjectivesAndMethods() { 230 return _objectivesAndMethods; 231 } 232 233 public void setObjectivesAndMethods(List<LocalObjective> value) { 234 _objectivesAndMethods = value; 235 } 236 237 /** 238 * Add a new {@link LocalObjective} item to the underlying collection. 239 * @param item the item to add 240 * @return {@code true} 241 */ 242 public boolean addObjectivesAndMethods(LocalObjective item) { 243 LocalObjective value = ObjectUtils.requireNonNull(item,"item cannot be null"); 244 if (_objectivesAndMethods == null) { 245 _objectivesAndMethods = new LinkedList<>(); 246 } 247 return _objectivesAndMethods.add(value); 248 } 249 250 /** 251 * Remove the first matching {@link LocalObjective} item from the underlying collection. 252 * @param item the item to remove 253 * @return {@code true} if the item was removed or {@code false} otherwise 254 */ 255 public boolean removeObjectivesAndMethods(LocalObjective item) { 256 LocalObjective value = ObjectUtils.requireNonNull(item,"item cannot be null"); 257 return _objectivesAndMethods != null && _objectivesAndMethods.remove(value); 258 } 259 260 public List<Activity> getActivities() { 261 return _activities; 262 } 263 264 public void setActivities(List<Activity> value) { 265 _activities = value; 266 } 267 268 /** 269 * Add a new {@link Activity} item to the underlying collection. 270 * @param item the item to add 271 * @return {@code true} 272 */ 273 public boolean addActivity(Activity item) { 274 Activity value = ObjectUtils.requireNonNull(item,"item cannot be null"); 275 if (_activities == null) { 276 _activities = new LinkedList<>(); 277 } 278 return _activities.add(value); 279 } 280 281 /** 282 * Remove the first matching {@link Activity} item from the underlying collection. 283 * @param item the item to remove 284 * @return {@code true} if the item was removed or {@code false} otherwise 285 */ 286 public boolean removeActivity(Activity item) { 287 Activity value = ObjectUtils.requireNonNull(item,"item cannot be null"); 288 return _activities != null && _activities.remove(value); 289 } 290 291 public MarkupMultiline getRemarks() { 292 return _remarks; 293 } 294 295 public void setRemarks(MarkupMultiline value) { 296 _remarks = value; 297 } 298 299 @Override 300 public String toString() { 301 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 302 } 303 } 304}