Notes and Agreements

As the OSCAL Foundation's FedRAMP Technology Focus Group (TFG) reaches agreements as to the path forward, they are captured here. This is a work in progress. Once the group reaches an appropriate milestone, this will be consolidated and re-organized into more consumable guidance.

See Taxonomy

See Guiding Principles

KSI Approach

• KSI Statement Analysis

  • Identify KSI goal(s)

• KSI Data Requirements:

  • Intent: A simple, unambiguous status. Typically Pass/Fail
  • Decision Point: Sampling or full coverage?
  • Identify evidence to collect in support of KSI goal(s)
  • Define evidence interpretation
    • Evidence type (count, true/false, setting)
    • Collection frequency
    • Evidence fidelity
    • Correlation
    • Thresholds
      • Could be more granular than just pass/fail
      • Example: Satisfactory, Degraded, Critical

• Organizational Considerations:

  • Action Triggers: Define the triggers for that system/org
    • Define required action(s) when triggered

• KSI Techical Collection Approach

  • Identify all evidence source/component
    • Identify the source format(s)
  • Define centralized evidence collection target
  • Define the automation required to acquire evidence from each source/component and deliver to centralied collection target
    • Decision Point: Evidence delivered raw or normalized?

• KSI Technical Interpretation Approach

  • Apply data requirements/thresholds to produce Findings
    • Findings are continuously updating as new data is received and analyzed
  • Raise action triggers when appropriate