# Citing Control Statements

OSCAL SSPs cite OSCAL baseline statement identifiers when representing control implementation responses. Citing the identifiers correctly is critical to machine processing. 

Within OSCAL baselines, identifiers are assigned to `statement` parts and `item` parts for reference by SSPs.

### The `statement` Part

All OSCal `parts` entries have:
- a required `id` field; and
- a required `name` field.

For every control in the FedRAMP baselines there is _exactly one_ `parts` entry where `name` = `statement`. This is the `statement` part. 

```yaml

      - id: ac-2.1
        title: Automated System Account Management
        parts:
        - id: ac-2.1_smt
          name: statement
          
```

### Simple Controls

For simple controls, the `statement` part has a `prose` field that includes the control requirement statement.

```yaml

      - id: ac-2.1
        title: Automated System Account Management
        parts:
        - id: ac-2.1_smt
          name: statement
          prose: 'Support the management of system accounts using {{ insert: param, ac-02.01_odp }}.'
          
```

The `id` value for the `statement` part (i.e. `ac-2.1_smt`) is cited by the SSP's `statements` array when responding to this control. 


### Controls with Child Statements

For a control with child statements (a., b., etc.), the `statement` part includes a nested `parts` array. Every element in the nested `parts` array has:
- a required `id` field; and
- a required `name` field. Always with a value of `item`.
- a `prose` field that includes this part of the control requirement statement.
- an additional nested `parts` array **IF** this part has child parts.

Each control in the FedRAMP OSCAL baselines has a `parts` array at the root of the control. Each `parts` entry includes:
- a required `id`
- a required `name`.


```yaml
catalog:
  groups:
    controls:
    - id: ac-1
      title: Policy and Procedures
      parts:
      - id: ac-1_smt
        name: statement
        parts:
        - id: ac-1_smt.a
          name: item
          props:
          - name: label
            value: 'a.'
          prose: 'Develop, document, and disseminate to {{ insert: param, ac-1_prm_1 }}:'

```

<div class="callout">
  
  For SSP authoring, ignore any `parts` entry in the baseline outside of the `statement` part and its child parts. Other part types are for control assessments.

</div>


### Response Point Properties

To aid SSP authoring tools in identifying the required statement level at which to respond, `response-point` properties are included in the FedRAMP baselines.

SSP authoring tools should limit the scope of `response-point` property searches to the `statement` part and its child parts. Ignore `response-point` properties in the parts related to assessments.

A `response-point` property appears in the `props` array and includes:
- a `name` set to `response-point`
- a `ns` set to `http://fedramp.gov/ns/oscal`
- a `value` with a value that is any string and can be ignored.

```yaml

      - id: ac-2.1
        title: Automated System Account Management
        parts:
        - id: ac-2.1_smt
          name: statement
          props:
          - name: response-point
            ns: http://fedramp.gov/ns/oscal
            value: You must fill in this response point.
          prose: 'Support the management of system accounts using {{ insert: param, ac-02.01_odp }}.'
```

When an SSP tool encounters a `parts` entry that contains this property, it should be presented to users of SSP authoring tools as the expected level of response for that control.