Attachments

Attachments

All OSCAL models handle attachments the same way. The following OSCALis representationused ofto attach files to OSCAL-based FedRAMP artifacts, such as when attaching policies and plans to a System Security Plan (SSP) or evidence to a Security Assessment Report (SAR).

Identifying attachments in an OSCAL FedRAMP SSPSSP, attachmentPOA&M, demonstratesSAP theor SAR requires:

• a back-matter andobject as a child to the root element
  • a resourceresources approacharray, each resources entry includes:
    • a uuid (required)
    • a title (best practice)
    • a description (encouraged)
    • a props array with entries that mustcan beinclude: implemented
      for classic SSP attachments that are not machine-readable, such as policies, procedures, plans, guidance, and rules of behavior documents. For each attachment, an SSP should provide a publication date where possible. However, in some cases, a back matter attachment may not have a specific publication date. In that case, an SSP may define a last accessed property
      • name=type with a token value of(best apractice): datetimeIdentifies the attachment type. See below.
      • name=version with a string value (best practice if applicable): Identifies the attachment's publushed version number
      • name=published with an OSCAL date-time-with-timezone thatvalue represents(best whenpractice thatif resourceapplicable): wasIdentifies lastthe viewedattachment's publication date
    • either an rlinks array (strongly preferred) or referenced,base64 object
      • an rlinks array entry includes:
        • a href with a relative or absolute URI (required)
        • a media-type (best practice)
        • consider ignoring hashes at this time
      • a base64 object:
        • a filename field (encouraged)
        • a media-type field (best practice)
        • a value: Contains the Base 64 value thatof conformsthe withattachemnt. RFC3339'sWhile "full-date"OSCAL format.
          does not require this field, a base64 object has no significance without it.

Attachment Representation

system-security-plan
  back-matter:
    resources:

    - uuid: 11111111-2222-4000-8000-001000000001
      title: Attachment Title
      description: Linked attachment.
      props:
      - name: type
        value: policy
      rlinks:
      - href: ./attachments/policy.pdf
        media-type: application/pdf


    - uuid: 11111111-2222-4000-8000-001000000002
      title: Logo
      description: A Base 64 embeded logo.
      props:
      - name: type
        value: logo
      base64:
        filename: logo.png
        media-type: application/png
        value: '00000000'

---