Notes and Agreements

As the OSCAL Foundation's FedRAMP Technology Focus Group (TFG) reaches agreements as to the path forward, they are captured here. This is a work in progress. Once the group reaches an appropriate milestone, this will be consolidated and re-organized into more consumable guidance. 
 
 DRAFT - Please review and provide feedback. Self-register via Login to leave comments. 
 
 
 See Taxonomy 
 See Guiding Principles 
 
 KSI Approach 
 
 
 KSI Statement Analysis 
 
 Identify KSI goal(s) 
 
 
 
 KSI Data Requirements : 
 
 Intent : A simple, unambiguous status. Typically Pass/Fail 
 Decision Point : Sampling or full coverage? 
 Identify evidence to collect in support of KSI goal(s) 
 Define evidence interpretation
 
 Evidence type (count, true/false, setting) 
 Collection frequency 
 Evidence fidelity 
 Correlation 
 Thresholds
 
 Could be more granular than just pass/fail 
 Example: Satisfactory, Degraded, Critical 
 
 
 
 
 
 
 
 Organizational Considerations : 
 
 Action Triggers : Define the triggers for that system/org
 
 Define required action(s) when triggered 
 
 
 
 
 
 KSI Techical Collection Approach 
 
 Identify all evidence source/component
 
 Identify the source format(s) 
 
 
 Define centralized evidence collection target 
 Define the automation required to acquire evidence from each source/component and deliver to centralied collection target
 
 Decision Point : Evidence delivered raw or normalized ? 
 
 
 
 
 
 KSI Technical Interpretation Approach 
 
 Apply data requirements/thresholds to produce Findings 
 
 Findings are continuously updating as new data is received and analyzed 
 
 
 Raise action triggers when appropriate