Relationships: Overview

In information systems, components interact with each other. Simple and complex component relationships can be represented accurately using OSCAL.

Relationship Types

Relationship representations include:

• third-party validations
• connectivity
• data flows
• components offered by other components
• components relying on other components

Complex Relationships

In its most basic form, each relationship represented with OSCAL stands alone. A collection of relationships may paint a more complete picture.

Example 1: Cryptographic Modules

A linux operating system includes a cryptographic module that has been successfully FIPS 140-3 validated by NIST Labs.

There are three components and two relationships.

Components:

• Operating System (type: software)
• Cryptographic Module (type: software)
• Validation (type: validation)

Relationships:

• Operating System --- provided-by ---> Cryptographic Module
• Cryptographic Module --- validated ---> Validation Module

Example 2: Network Connectivity

A web server and a database are on the same network. The web server performs queries on the database server via a TLS 1.3 connection.

There are ___ components and ___ relationships

Components:

• Web Server (type: software)
• Database Server (type: software)
• Network (type: connection)

Relationships:

• Operating System --- provided-by ---> Cryptographic Module
• Cryptographic Module --- validated ---> Validation Module