Control Response: Policies, Procedures, Plans, RoB, and Guides

The following are examples.

Response: "This System" Component

There must always be a "This System" component in the SSP. This is used in several ways:

• Holistic Overview: The SSP author may wish to provide a more holistic overview of how several components work together, even if details are provided individually in other by-component assemblies.

• Catch-all: Any control response that does not cleanly align with another system component may be described in the "This System" component.

• Legacy SSP Conversion: When converting a legacy SSP to OSCAL, the legacy control response statements may initially be associated with the "This System" component until the SSP author is able to provide responses for individual components.

{{< figure src="/img/ssp-figure-38.png" title="SSP Template Security Control Response" alt="Figure illustrating how legacy SSP template control response is broad and should apply to the 'this-system' component in OSCAL." >}}

Representation

<system-implementation>
    <!-- leveraged-authorization, user -->
    <component uuid="uuid-value" type="this-system">
        <title>This System</title>
        <description>
            <p>Description of the component.</p>
        </description>
        <status state="operational"/>
    </component>
</system-implementation>

<control-implementation>
    <!-- cut -->
    <implemented-requirement uuid="uuid-value" control-id="ac-2">
        <statement uuid="uuid-value" statement-id="ac-2_smt.a">
            
            <by-component uuid="uuid-value" component-uuid="uuid-of-this-system-component">
                <description>
                    <p>Describe how individual components are working together.</p>
                    <p>Describe how the system - as a whole - is satisfying this statement.</p>
                    <p>This can include policy, procedures, hardware, software, etc.</p>
                </description>
            </by-component>
            
        </statement>
        <!-- repeat statement assembly for statement part (b, c, etc.) as needed. -->
    </implemented-requirement>
</control-implementation>
<!-- back-matter -->

NOTES:

• Although the name of the component is "This System", non-technical solutions may also be discussed here, such as policies and procedures.

Linking to Artifacts

Any time policies, procedures, plans, and similar documentation are cited in a control response, they must be linked.

For the legacy approach, when responding within the by-component assembly for "this system", the link must be within the same by-component assembly where the artifact is cited.

{{< figure src="/img/ssp-figure-39.png" title="SSP Template Security Control Response" alt="Figure illustrating how legacy SSP template control response should link to the appropriate artifact." >}}

Representation: Legacy Approach Example - No Policy Component

<control-implementation>
    <implemented-requirement uuid="uuid-value" control-id="ac-1">
        <statement uuid="uuid-value" statement-id="ac-1_smt.a">
            <by-component component-uuid="uuid-of-this-system" uuid="uuid-value">
                <description>
                    <p>Describe how Part a is satisfied within the system.</p>
                </description>
                <link href="#uuid-of-policy-resource-in-back-matter" rel="policy" />
            </by-component>
        </statement>
    </implemented-requirement>
</control-implementation>
<!-- back-matter -->

For the component approach, use the component representing the policy. The link should be in the component, but may be added directly to the by-component as well.

Representation: Component Approach Example

<system-implementation>
    <!-- leveraged-authorization, user -->
    <component uuid="uuid-value" type="policy">
        <title>Access Control and Identity Management Policy</title>
      <description>description: <p>An'This example component representingis a policy.</p>corporate </description>AC <linkpolicy href="#uuid-of-policy-resource-in-back-matter"used rel="policy"for />the <statussystem.'
      state="operational"/>props:
      </component>- </system-implementation>name: <control-implementation>implementation-point
        <implemented-requirementvalue: uuid="uuid-value"external
        class: corporate
      links:
      - href: '#11111111-2222-4000-8000-001000000005'
        rel: attachment
      status:
        state: operational


  control-id="implementation:
    implemented-requirements:
    - uuid: 11111111-2222-4000-8000-012000010000
      control-id: ac-1">1
      <statementstatements:
      uuid="uuid-value"- statement-id="id: ac-1_smt.a">a
        <uuid: 11111111-2222-4000-8000-012000010100
        by-componentcomponents:
        - component-uuid="uuid-of-policy-component"uuid: uuid="uuid-value">11111111-2222-4000-8000-009000600001
          <description>uuid: <p>11111111-2222-4000-8000-012000010102
          description: Describe how this policy satisfies Partpart a.</p>
          </description>implementation-status:
            </by-component>state: </statement>implemented
          </implemented-requirement>responsible-roles:
          </control-implementation>
<!-- back-matterrole-id: information-system-security-officer
            party-uuids:
            --> 

Forremarks: eitherThis example above,is the policy\"policy\" mustcomponent, bewhich presentrepresents asthe aAccess resourceControl inand Identity Management Policy. back-matter.

Inresources: Back- Matter

<back-matter>11111111-2222-4000-8000-001000000005
      <resourcetitle: uuid="uuid-value">
        <title>Access Control and Identity Management Policy<
      description: A single policy that addresses both the AC and IA families.
      props:
      - name: type
        value: policy
      - name: published
        value: '2023-01-01T00:00:00Z'
      - name: version
        value: '1.2'
      rlinks:
      - href: ./title>
        <rlinkattachments/policies/sample_AC_and_IA_policy.pdf
        media-type="type: application/pdf" href="./documents/policies/sample_policy.pdf" />
        <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
    </resource>
</back-matter>pdf