Source code

001package gov.nist.secauto.oscal.lib.model;
002
003import gov.nist.secauto.metaschema.core.datatype.adapter.DateAdapter;
004import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultiline;
005import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultilineAdapter;
006import gov.nist.secauto.metaschema.core.datatype.object.AmbiguousDate;
007import gov.nist.secauto.metaschema.core.model.IBoundObject;
008import gov.nist.secauto.metaschema.core.model.IMetaschemaData;
009import gov.nist.secauto.metaschema.core.model.JsonGroupAsBehavior;
010import gov.nist.secauto.metaschema.core.model.constraint.IConstraint;
011import gov.nist.secauto.metaschema.core.util.ObjectUtils;
012import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValue;
013import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValues;
014import gov.nist.secauto.metaschema.databind.model.annotations.AssemblyConstraints;
015import gov.nist.secauto.metaschema.databind.model.annotations.BoundAssembly;
016import gov.nist.secauto.metaschema.databind.model.annotations.BoundField;
017import gov.nist.secauto.metaschema.databind.model.annotations.GroupAs;
018import gov.nist.secauto.metaschema.databind.model.annotations.IsUnique;
019import gov.nist.secauto.metaschema.databind.model.annotations.KeyField;
020import gov.nist.secauto.metaschema.databind.model.annotations.MetaschemaAssembly;
021import gov.nist.secauto.metaschema.databind.model.annotations.ValueConstraints;
022import java.lang.Override;
023import java.lang.String;
024import java.util.LinkedList;
025import java.util.List;
026import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
027import org.apache.commons.lang3.builder.ToStringStyle;
028
029/**
030 * Contains the characteristics of the system, such as its name, purpose, and security impact level.
031 */
032@MetaschemaAssembly(
033    formalName = "System Characteristics",
034    description = "Contains the characteristics of the system, such as its name, purpose, and security impact level.",
035    name = "system-characteristics",
036    moduleClass = OscalSspModule.class,
037    valueConstraints = @ValueConstraints(allowedValues = {@AllowedValues(level = IConstraint.Level.ERROR, target = "prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name", values = {@AllowedValue(value = "identity-assurance-level", description = "A value of 1, 2, or 3 as defined by [SP 800-63-3](https://doi.org/10.6028/NIST.SP.800-63-3)."), @AllowedValue(value = "authenticator-assurance-level", description = "A value of 1, 2, or 3 as defined by [SP 800-63-3](https://doi.org/10.6028/NIST.SP.800-63-3)."), @AllowedValue(value = "federation-assurance-level", description = "A value of 1, 2, or 3 as defined by [SP 800-63-3](https://doi.org/10.6028/NIST.SP.800-63-3).")}), @AllowedValues(level = IConstraint.Level.ERROR, target = "prop[@name=('identity-assurance-level','authenticator-assurance-level','federation-assurance-level')]/@value", values = {@AllowedValue(value = "1", description = "As defined by [SP 800-63-3](https://doi.org/10.6028/NIST.SP.800-63-3)."), @AllowedValue(value = "2", description = "As defined by [SP 800-63-3](https://doi.org/10.6028/NIST.SP.800-63-3)."), @AllowedValue(value = "3", description = "As defined by [SP 800-63-3](https://doi.org/10.6028/NIST.SP.800-63-3).")}), @AllowedValues(level = IConstraint.Level.ERROR, target = "prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name", values = {@AllowedValue(value = "cloud-deployment-model", description = "The associated value is one of: public-cloud, private-cloud, community-cloud, government-only-cloud, hybrid-cloud, or other."), @AllowedValue(value = "cloud-service-model", description = "The associated value is one of: saas, paas, iaas, or other.")}), @AllowedValues(level = IConstraint.Level.ERROR, target = "prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='cloud-deployment-model']/@value", values = {@AllowedValue(value = "public-cloud", description = "The public cloud deployment model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "private-cloud", description = "The private cloud deployment model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "community-cloud", description = "The community cloud deployment model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "hybrid-cloud", description = "The hybrid cloud deployment model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "government-only-cloud", description = "A specific type of community-cloud for use only by government services."), @AllowedValue(value = "other", description = "Any other type of cloud deployment model that is exclusive to the other choices.")}, remarks = "The hybrid cloud deployment model, as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145), can be supported by selecting two or more of the existing deployment models."), @AllowedValues(level = IConstraint.Level.ERROR, target = "prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='cloud-service-model']/@value", values = {@AllowedValue(value = "saas", description = "Software as a service (SaaS) cloud service model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "paas", description = "Platform as a service (PaaS) cloud service model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "iaas", description = "Infrastructure as a service (IaaS) cloud service model as defined by [The NIST Definition of Cloud Computing](https://doi.org/10.6028/NIST.SP.800-145)."), @AllowedValue(value = "other", description = "Any other type of cloud service model that is exclusive to the other choices.")}), @AllowedValues(level = IConstraint.Level.ERROR, target = "responsible-party/@role-id", allowOthers = true, values = {@AllowedValue(value = "authorizing-official", description = "The authorizing official for this system."), @AllowedValue(value = "authorizing-official-poc", description = "The authorizing official's designated point of contact (POC) for this system."), @AllowedValue(value = "system-owner", description = "The executive ultimately accountable for the system."), @AllowedValue(value = "system-poc-management", description = "The primary management-level point of contact (POC) for the system."), @AllowedValue(value = "system-poc-technical", description = "The primary technical point of contact (POC) for the system."), @AllowedValue(value = "system-poc-other", description = "Other point of contact (POC) for the system that is not the management or technical POC."), @AllowedValue(value = "information-system-security-officer", description = "The primary role responsible for ensuring the organization operates the system securely."), @AllowedValue(value = "privacy-poc", description = "The point of contact (POC) responsible for identifying privacy information within the system, and ensuring its protection if present.")})}),
038    modelConstraints = @AssemblyConstraints(unique = @IsUnique(id = "unique-ssp-system-characteristics-responsible-party", level = IConstraint.Level.ERROR, target = "responsible-party", keyFields = @KeyField(target = "@role-id"), remarks = "Since `responsible-party` associates multiple `party-uuid` entries with a single `role-id`, each role-id must be referenced only once."))
039)
040public class SystemCharacteristics implements IBoundObject {
041  private final IMetaschemaData __metaschemaData;
042
043  @BoundField(
044      formalName = "System Identification",
045      description = "A [human-oriented](https://pages.nist.gov/OSCAL/concepts/identifier-use/#human-oriented), [globally unique](https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique) identifier with [cross-instance](https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance) scope that can be used to reference this system identification property elsewhere in [this or other OSCAL instances](https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope). When referencing an externally defined `system identification`, the `system identification` must be used in the context of the external / imported OSCAL instance (e.g., uri-reference). This string should be assigned [per-subject](https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency), which means it should be consistently used to identify the same system across revisions of the document.",
046      useName = "system-id",
047      minOccurs = 1,
048      maxOccurs = -1,
049      groupAs = @GroupAs(name = "system-ids", inJson = JsonGroupAsBehavior.LIST)
050  )
051  private List<SystemId> _systemIds;
052
053  @BoundField(
054      formalName = "System Name - Full",
055      description = "The full name of the system.",
056      useName = "system-name",
057      minOccurs = 1
058  )
059  private String _systemName;
060
061  @BoundField(
062      formalName = "System Name - Short",
063      description = "A short name for the system, such as an acronym, that is suitable for display in a data table or summary list.",
064      useName = "system-name-short",
065      remarks = "Since `system-name-short` is optional, if the `system-name-short` is not provided, the `system-name` can be used as a substitute."
066  )
067  private String _systemNameShort;
068
069  @BoundField(
070      formalName = "System Description",
071      description = "A summary of the system.",
072      useName = "description",
073      minOccurs = 1,
074      typeAdapter = MarkupMultilineAdapter.class
075  )
076  private MarkupMultiline _description;
077
078  @BoundAssembly(
079      formalName = "Property",
080      description = "An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.",
081      useName = "prop",
082      maxOccurs = -1,
083      groupAs = @GroupAs(name = "props", inJson = JsonGroupAsBehavior.LIST)
084  )
085  private List<Property> _props;
086
087  @BoundAssembly(
088      formalName = "Link",
089      description = "A reference to a local or remote resource, that has a specific relation to the containing object.",
090      useName = "link",
091      maxOccurs = -1,
092      groupAs = @GroupAs(name = "links", inJson = JsonGroupAsBehavior.LIST)
093  )
094  private List<Link> _links;
095
096  @BoundField(
097      formalName = "System Authorization Date",
098      description = "The date the system received its authorization.",
099      useName = "date-authorized",
100      typeAdapter = DateAdapter.class
101  )
102  private AmbiguousDate _dateAuthorized;
103
104  @BoundField(
105      formalName = "Security Sensitivity Level",
106      description = "The overall information system sensitivity categorization, such as defined by [FIPS-199](https://doi.org/10.6028/NIST.FIPS.199).",
107      useName = "security-sensitivity-level",
108      remarks = "Often, organizations require the security sensitivity level to correspond with the highest confidentiality, integrity, or availability level identified by `security-impact-level`."
109  )
110  private String _securitySensitivityLevel;
111
112  @BoundAssembly(
113      formalName = "System Information",
114      description = "Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in [NIST SP 800-60](https://doi.org/10.6028/NIST.SP.800-60v2r1).",
115      useName = "system-information",
116      minOccurs = 1
117  )
118  private SystemInformation _systemInformation;
119
120  @BoundAssembly(
121      formalName = "Security Impact Level",
122      description = "The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information.",
123      useName = "security-impact-level"
124  )
125  private SecurityImpactLevel _securityImpactLevel;
126
127  @BoundAssembly(
128      formalName = "Status",
129      description = "Describes the operational status of the system.",
130      useName = "status",
131      minOccurs = 1
132  )
133  private Status _status;
134
135  @BoundAssembly(
136      formalName = "Authorization Boundary",
137      description = "A description of this system's authorization boundary, optionally supplemented by diagrams that illustrate the authorization boundary.",
138      useName = "authorization-boundary",
139      minOccurs = 1
140  )
141  private AuthorizationBoundary _authorizationBoundary;
142
143  @BoundAssembly(
144      formalName = "Network Architecture",
145      description = "A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture.",
146      useName = "network-architecture"
147  )
148  private NetworkArchitecture _networkArchitecture;
149
150  @BoundAssembly(
151      formalName = "Data Flow",
152      description = "A description of the logical flow of information within the system and across its boundaries, optionally supplemented by diagrams that illustrate these flows.",
153      useName = "data-flow"
154  )
155  private DataFlow _dataFlow;
156
157  @BoundAssembly(
158      formalName = "Responsible Party",
159      description = "A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.",
160      useName = "responsible-party",
161      maxOccurs = -1,
162      groupAs = @GroupAs(name = "responsible-parties", inJson = JsonGroupAsBehavior.LIST)
163  )
164  private List<ResponsibleParty> _responsibleParties;
165
166  @BoundField(
167      formalName = "Remarks",
168      description = "Additional commentary about the containing object.",
169      useName = "remarks",
170      typeAdapter = MarkupMultilineAdapter.class
171  )
172  private MarkupMultiline _remarks;
173
174  public SystemCharacteristics() {
175    this(null);
176  }
177
178  public SystemCharacteristics(IMetaschemaData data) {
179    this.__metaschemaData = data;
180  }
181
182  @Override
183  public IMetaschemaData getMetaschemaData() {
184    return __metaschemaData;
185  }
186
187  public List<SystemId> getSystemIds() {
188    return _systemIds;
189  }
190
191  public void setSystemIds(List<SystemId> value) {
192    _systemIds = value;
193  }
194
195  /**
196   * Add a new {@link SystemId} item to the underlying collection.
197   * @param item the item to add
198   * @return {@code true}
199   */
200  public boolean addSystemId(SystemId item) {
201    SystemId value = ObjectUtils.requireNonNull(item,"item cannot be null");
202    if (_systemIds == null) {
203      _systemIds = new LinkedList<>();
204    }
205    return _systemIds.add(value);
206  }
207
208  /**
209   * Remove the first matching {@link SystemId} item from the underlying collection.
210   * @param item the item to remove
211   * @return {@code true} if the item was removed or {@code false} otherwise
212   */
213  public boolean removeSystemId(SystemId item) {
214    SystemId value = ObjectUtils.requireNonNull(item,"item cannot be null");
215    return _systemIds != null && _systemIds.remove(value);
216  }
217
218  public String getSystemName() {
219    return _systemName;
220  }
221
222  public void setSystemName(String value) {
223    _systemName = value;
224  }
225
226  public String getSystemNameShort() {
227    return _systemNameShort;
228  }
229
230  public void setSystemNameShort(String value) {
231    _systemNameShort = value;
232  }
233
234  public MarkupMultiline getDescription() {
235    return _description;
236  }
237
238  public void setDescription(MarkupMultiline value) {
239    _description = value;
240  }
241
242  public List<Property> getProps() {
243    return _props;
244  }
245
246  public void setProps(List<Property> value) {
247    _props = value;
248  }
249
250  /**
251   * Add a new {@link Property} item to the underlying collection.
252   * @param item the item to add
253   * @return {@code true}
254   */
255  public boolean addProp(Property item) {
256    Property value = ObjectUtils.requireNonNull(item,"item cannot be null");
257    if (_props == null) {
258      _props = new LinkedList<>();
259    }
260    return _props.add(value);
261  }
262
263  /**
264   * Remove the first matching {@link Property} item from the underlying collection.
265   * @param item the item to remove
266   * @return {@code true} if the item was removed or {@code false} otherwise
267   */
268  public boolean removeProp(Property item) {
269    Property value = ObjectUtils.requireNonNull(item,"item cannot be null");
270    return _props != null && _props.remove(value);
271  }
272
273  public List<Link> getLinks() {
274    return _links;
275  }
276
277  public void setLinks(List<Link> value) {
278    _links = value;
279  }
280
281  /**
282   * Add a new {@link Link} item to the underlying collection.
283   * @param item the item to add
284   * @return {@code true}
285   */
286  public boolean addLink(Link item) {
287    Link value = ObjectUtils.requireNonNull(item,"item cannot be null");
288    if (_links == null) {
289      _links = new LinkedList<>();
290    }
291    return _links.add(value);
292  }
293
294  /**
295   * Remove the first matching {@link Link} item from the underlying collection.
296   * @param item the item to remove
297   * @return {@code true} if the item was removed or {@code false} otherwise
298   */
299  public boolean removeLink(Link item) {
300    Link value = ObjectUtils.requireNonNull(item,"item cannot be null");
301    return _links != null && _links.remove(value);
302  }
303
304  public AmbiguousDate getDateAuthorized() {
305    return _dateAuthorized;
306  }
307
308  public void setDateAuthorized(AmbiguousDate value) {
309    _dateAuthorized = value;
310  }
311
312  public String getSecuritySensitivityLevel() {
313    return _securitySensitivityLevel;
314  }
315
316  public void setSecuritySensitivityLevel(String value) {
317    _securitySensitivityLevel = value;
318  }
319
320  public SystemInformation getSystemInformation() {
321    return _systemInformation;
322  }
323
324  public void setSystemInformation(SystemInformation value) {
325    _systemInformation = value;
326  }
327
328  public SecurityImpactLevel getSecurityImpactLevel() {
329    return _securityImpactLevel;
330  }
331
332  public void setSecurityImpactLevel(SecurityImpactLevel value) {
333    _securityImpactLevel = value;
334  }
335
336  public Status getStatus() {
337    return _status;
338  }
339
340  public void setStatus(Status value) {
341    _status = value;
342  }
343
344  public AuthorizationBoundary getAuthorizationBoundary() {
345    return _authorizationBoundary;
346  }
347
348  public void setAuthorizationBoundary(AuthorizationBoundary value) {
349    _authorizationBoundary = value;
350  }
351
352  public NetworkArchitecture getNetworkArchitecture() {
353    return _networkArchitecture;
354  }
355
356  public void setNetworkArchitecture(NetworkArchitecture value) {
357    _networkArchitecture = value;
358  }
359
360  public DataFlow getDataFlow() {
361    return _dataFlow;
362  }
363
364  public void setDataFlow(DataFlow value) {
365    _dataFlow = value;
366  }
367
368  public List<ResponsibleParty> getResponsibleParties() {
369    return _responsibleParties;
370  }
371
372  public void setResponsibleParties(List<ResponsibleParty> value) {
373    _responsibleParties = value;
374  }
375
376  /**
377   * Add a new {@link ResponsibleParty} item to the underlying collection.
378   * @param item the item to add
379   * @return {@code true}
380   */
381  public boolean addResponsibleParty(ResponsibleParty item) {
382    ResponsibleParty value = ObjectUtils.requireNonNull(item,"item cannot be null");
383    if (_responsibleParties == null) {
384      _responsibleParties = new LinkedList<>();
385    }
386    return _responsibleParties.add(value);
387  }
388
389  /**
390   * Remove the first matching {@link ResponsibleParty} item from the underlying collection.
391   * @param item the item to remove
392   * @return {@code true} if the item was removed or {@code false} otherwise
393   */
394  public boolean removeResponsibleParty(ResponsibleParty item) {
395    ResponsibleParty value = ObjectUtils.requireNonNull(item,"item cannot be null");
396    return _responsibleParties != null && _responsibleParties.remove(value);
397  }
398
399  public MarkupMultiline getRemarks() {
400    return _remarks;
401  }
402
403  public void setRemarks(MarkupMultiline value) {
404    _remarks = value;
405  }
406
407  @Override
408  public String toString() {
409    return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString();
410  }
411}