From 0432b0412a0b17c16646469eb481d0b972237a72 Mon Sep 17 00:00:00 2001
From: "A.J. Stein" <aj@gsa.gov>
Date: Sun, 15 Dec 2024 17:45:14 -0500
Subject: [PATCH] Add common assessment constraint IDs for #2088

---
 .../oscal_assessment-common_metaschema.xml    | 77 ++++++++++---------
 1 file changed, 40 insertions(+), 37 deletions(-)

diff --git a/src/metaschema/oscal_assessment-common_metaschema.xml b/src/metaschema/oscal_assessment-common_metaschema.xml
index de8ae81fa4..ca3fb74104 100644
--- a/src/metaschema/oscal_assessment-common_metaschema.xml
+++ b/src/metaschema/oscal_assessment-common_metaschema.xml
@@ -62,16 +62,16 @@
          <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
       </model>
       <constraint>
-         <allowed-values target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
+         <allowed-values id="nist-oscal-assessment-objective-types" target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
             <enum value="objective" deprecated="1.0.1">**(deprecated)** Use 'assessment-objective' instead.</enum>
             <enum value="assessment" deprecated="1.0.1">**(deprecated)** Use 'assessment-method' instead.</enum>
             <enum value="assessment-objective">The part defines an assessment objective.</enum>
             <enum value="assessment-method">The part defines an assessment method.</enum>
          </allowed-values>
-         <has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]" max-occurs="1" />
-         <has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/prop[has-oscal-namespace(('http://csrc.nist.gov/ns/oscal','http://csrc.nist.gov/ns/rmf')) and @name='method']" min-occurs="1" max-occurs="1" />
-         <has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objects','assessment-objects')]" min-occurs="1" max-occurs="1" />
-         <has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method-id']" min-occurs="1" />
+         <has-cardinality id="nist-oscal-assessment-objective-cardinality" target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]" max-occurs="1" />
+         <has-cardinality id="nist-oscal-assessment-method-cardinality" target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/prop[has-oscal-namespace(('http://csrc.nist.gov/ns/oscal','http://csrc.nist.gov/ns/rmf')) and @name='method']" min-occurs="1" max-occurs="1" />
+         <has-cardinality id="nist-oscal-assessment-objects-cardinality" target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objects','assessment-objects')]" min-occurs="1" max-occurs="1" />
+         <has-cardinality id="nist-oscal-assessment-method-id-cardinality" target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method-id']" min-occurs="1" />
       </constraint>
    </define-assembly>
    <define-assembly name="assessment-method">
@@ -159,7 +159,7 @@
                <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
             </model>
             <constraint>
-               <is-unique id="unique-step-responsible-role" target="responsible-role">
+               <is-unique id="nist-oscal-unique-step-responsible-role" target="responsible-role">
                   <key-field target="@role-id"/>
                   <remarks>
                      <p>Since multiple <code>party-uuid</code> entries can be provided, each role-id must be referenced only once.</p>
@@ -183,16 +183,16 @@
       </model>
       <constraint>
          <!-- TODO: Dave to double-check constraints here -->
-         <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
+         <allowed-values id="nist-oscal-activity-type" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
             <enum value="method">The assessment method to use. This typically appears on parts with the name "assessment".</enum>
          </allowed-values>
-         <has-cardinality target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']" min-occurs="1"/>
-         <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']/@value">
+         <has-cardinality id="nist-oscal-activity-type-cardinality" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']" min-occurs="1"/>
+         <allowed-values id="nist-oscal-activity-type-values" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']/@value">
             <enum value="INTERVIEW">The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.</enum>
             <enum value="EXAMINE">The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).</enum>
             <enum value="TEST">The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.</enum>
          </allowed-values>
-         <is-unique id="unique-activity-responsible-role" target="responsible-role">
+         <is-unique id="nist-oscal-unique-activity-responsible-role" target="responsible-role">
             <key-field target="@role-id"/>
             <remarks>
                <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
@@ -213,7 +213,7 @@
          <formal-name>Task Type</formal-name>
          <description>The type of task.</description>
          <constraint>
-            <allowed-values allow-other="yes">
+            <allowed-values id="nist-oscal-task-type" allow-other="yes">
                <enum value="milestone">The task represents a planned milestone.</enum>
                <enum value="action">The task represents a specific assessment action to be performed.</enum>
             </allowed-values>
@@ -271,7 +271,7 @@
                         <formal-name>Time Unit</formal-name>
                         <description>The unit of time for the period.</description>
                         <constraint>
-                           <allowed-values>
+                           <allowed-values id="nist-oscal-timing-unit">
                               <enum value="seconds">The period is specified in seconds.</enum>
                               <enum value="minutes">The period is specified in minutes.</enum>
                               <enum value="hours">The period is specified in hours.</enum>
@@ -336,7 +336,7 @@
 -->               <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
             </model>
             <constraint>
-               <is-unique id="unique-associated-activity-responsible-role" target="responsible-role">
+               <is-unique id="nist-oscal-unique-associated-activity-responsible-role" target="responsible-role">
                   <key-field target="@role-id"/>
                   <remarks>
                      <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
@@ -526,8 +526,9 @@
       <define-flag name="type" as-type="token" required="yes">
          <formal-name>Subject Type</formal-name>
          <description>Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.</description>
+         <!-- REVIEW THIS -->
          <constraint>
-            <allowed-values allow-other="yes">
+            <allowed-values id="nist-oscal-assessment-subject-type" allow-other="yes">
                <enum value="component">The referenced assessment subject is a component defined in the SSP, or in the <code>local-definitions</code> of an Assessment Plan or Assessment Results.</enum>
                <enum value="inventory-item">The referenced assessment subject is a inventory item defined in the SSP, or in the <code>local-definitions</code> of an Assessment Plan or Assessment Results.</enum>
                <enum value="location">The referenced assessment subject is a <code>location</code> defined in the <code>metadata</code> of the SSP, Assessment Plan, or Assessment Results.</enum>
@@ -593,7 +594,8 @@
       <formal-name>Subject Universally Unique Identifier Reference Type</formal-name>
       <description>Used to indicate the type of object pointed to by the <code>uuid-ref</code> within a subject.</description>
       <constraint>
-         <allowed-values allow-other="yes">
+         <!-- REVIEW THIS -->
+         <allowed-values id="nist-oscal-assessment-subject-type-flag" allow-other="yes">
             <enum value="component">Component</enum>
             <enum value="inventory-item">Inventory Item</enum>
             <enum value="location">Location</enum>
@@ -687,7 +689,7 @@
                      <field ref="remarks" in-xml="WITH_WRAPPER"/>
                   </model>
                   <constraint>
-                     <is-unique id="unique-ssp-uses-component-responsible-party" target="responsible-party">
+                     <is-unique id="nist-oscal-unique-ssp-uses-component-responsible-party" target="responsible-party">
                         <key-field target="@role-id"/>
                         <remarks>
                            <p>Since <code>responsible-party</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
@@ -700,7 +702,7 @@
          </define-assembly>
       </model>
       <constraint>
-         <is-unique id="unique-ssp-assessment-assets-component" target="component">
+         <is-unique id="nist-oscal-unique-ssp-assessment-assets-component" target="component">
             <key-field target="@uuid"/>
             <remarks>
                <p>Since multiple assessment <code>component</code> entries can be provided, each component must have a unique <code>uuid</code>.</p>
@@ -717,7 +719,7 @@
          <formal-name>Finding Target Type</formal-name>
          <description>Identifies the type of the target.</description>
          <constraint>
-            <allowed-values>
+            <allowed-values id="nist-oscal-finding-target-type">
                <enum value="statement-id">A reference to a control statement identifier within a control.</enum>
                <enum value="objective-id">A reference to a control objective identifier within a control.</enum>
             </allowed-values>
@@ -753,7 +755,7 @@
                <formal-name>Objective Status State</formal-name>
                <description>An indication as to whether the objective is satisfied or not.</description>
             <constraint>
-                  <allowed-values>
+                  <allowed-values id="nist-oscal-finding-target-status-state">
                   <enum value="satisfied">The objective has been completely satisfied.</enum>
                   <enum value="not-satisfied">The objective has not been completely satisfied, but may be partially satisfied.</enum>
                </allowed-values>
@@ -763,7 +765,7 @@
             <formal-name>Objective Status Reason</formal-name>
             <description>The reason the objective was given it's status.</description>
             <constraint>
-                  <allowed-values allow-other="yes">
+                  <allowed-values id="nist-oscal-finding-target-reason" allow-other="yes">
                   <enum value="pass">The target system or system component satisfied all the conditions.</enum>
                   <enum value="fail">The target system or system component did not satisfy all the conditions.</enum>
                   <enum value="other">Some other event took place that is not a pass or a fail.</enum>
@@ -881,7 +883,7 @@
             <description>Identifies how the observation was made.</description>
             <group-as name="methods" in-json="ARRAY"/>
             <constraint>
-               <allowed-values target="." allow-other="yes">
+               <allowed-values id="nist-oscal-observation-method-types" target="." allow-other="yes">
                   <enum value="EXAMINE">An inspection was performed.</enum>
                   <enum value="INTERVIEW">An interview was performed.</enum>
                   <enum value="TEST">A manual or automated test was performed.</enum>
@@ -895,7 +897,7 @@
             <description>Identifies the nature of the observation. More than one may be used to further qualify and enable filtering.</description>
             <group-as name="types" in-json="ARRAY"/>
             <constraint>
-               <allowed-values target="." allow-other="yes">
+               <allowed-values id="nist-oscal-observation-type" target="." allow-other="yes">
                   <enum value="ssp-statement-issue">A difference between the SSP implementation statement, and actual implementation.</enum>
                   <enum value="control-objective">An observation about the status of a the associated control objective.</enum>
                   <enum value="mitigation">A mitigating factor was identified.</enum>
@@ -992,7 +994,7 @@
          <formal-name>Actor Type</formal-name>
          <description>The kind of actor.</description>
          <constraint>
-            <allowed-values>
+            <allowed-values id="nist-oscal-origin-actor-types">
                <enum value="tool">A reference to a tool component defined with the assessment assets.</enum>
                <enum value="assessment-platform">A reference to an assessment-platform defined with the assessment assets.</enum>
                <enum value="party">A reference to a party defined within the document metadata.</enum>
@@ -1068,7 +1070,7 @@
          <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
       </model>
       <constraint>
-         <is-unique id="unique-ssp-related-task-responsible-party" target="responsible-party">
+         <is-unique id="nist-oscal-unique-ssp-related-task-responsible-party" target="responsible-party">
             <key-field target="@role-id"/>
             <remarks>
                <p>Since <code>responsible-party</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
@@ -1086,7 +1088,7 @@
          <formal-name>Threat Type Identification System</formal-name>
          <description>Specifies the source of the threat information.</description>
          <constraint>
-            <allowed-values allow-other="yes">
+            <allowed-values id="nist-oscal-threat-id-system" allow-other="yes">
                <enum value="http://fedramp.gov" deprecated="1.0.3">**deprecated** The value conforms to FedRAMP definitions. This value has been deprecated; use <code>http://fedramp.gov/ns/oscal</code> instead.</enum>
                <enum value="http://fedramp.gov/ns/oscal">The value conforms to FedRAMP definitions.</enum>
             </allowed-values>
@@ -1272,10 +1274,10 @@
                      <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
                   </model>
                   <constraint>
-                     <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
+                     <allowed-values id="nist-oscal-risk-prop-name" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
                         <enum value="type">The type of remediation tracking entry. Can be multi-valued.</enum>
                      </allowed-values>
-                     <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value" allow-other="yes">
+                     <allowed-values id="nist-oscal-risk-prop-type-value" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value" allow-other="yes">
                         <enum value="vendor-check-in">Contacted vendor to determine the status of a pending fix to a known vulnerability.</enum>
                         <enum value="status-update">Information related to the current state of response to this risk.</enum>
                         <enum value="milestone-complete">A significant step in the response plan has been achieved.</enum>
@@ -1305,13 +1307,14 @@
          </define-assembly>
       </model>
       <constraint>
-         <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
+         <!-- REVIEW THIS -->
+         <allowed-values id="nist-oscal-risk-prop-name" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
             <enum value="false-positive">The risk has been confirmed to be a false positive.</enum>
             <enum value="accepted">The risk has been accepted. No further action will be taken.</enum>
             <enum value="risk-adjusted">The risk has been adjusted.</enum>
             <enum value="priority">A numeric value indicating the sequence in which risks should be addressed. (Lower numbers are higher priority)</enum>
          </allowed-values>
-         <matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='priority']/@value" datatype="integer" />
+         <matches id="nist-oscal-priority-is-integer" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='priority']/@value" datatype="integer" />
       </constraint>
    </define-assembly>
 
@@ -1333,7 +1336,7 @@
       <formal-name>Risk Status</formal-name>
       <description>Describes the status of the associated risk.</description>
       <constraint>
-         <allowed-values target="." allow-other="yes">
+         <allowed-values id="nist-oscal-risk-status-type" target="." allow-other="yes">
             <enum value="open">The risk has been identified.</enum>
             <enum value="investigating">The identified risk is being investigated. (Open risk)</enum>
             <enum value="remediating">Remediation activities are underway, but are not yet complete. (Open risk)</enum>
@@ -1371,7 +1374,7 @@
                <formal-name>Naming System</formal-name>
                <description>Specifies the naming system under which this risk metric is organized, which allows for the same names to be used in different systems controlled by different parties. This avoids the potential of a name clash.</description>
                <constraint>
-                  <allowed-values allow-other="yes"><!-- Other values -->
+                  <allowed-values id="nist-oscal-characterization-facet-name-system" allow-other="yes"><!-- Other values -->
                      <enum value="http://fedramp.gov" deprecated="1.0.3">**deprecated** The FedRAMP naming system. This has been deprecated; use <code>http://fedramp.gov/ns/oscal</code> instead.</enum>
                      <enum value="http://fedramp.gov/ns/oscal">The facet naming system defined by FedRAMP.</enum>
                      <enum value="http://csrc.nist.gov/ns/oscal">The facet naming system defined by OSCAL.</enum>
@@ -1402,29 +1405,29 @@
                <field ref="remarks" in-xml="WITH_WRAPPER"/>
             </model>
             <constraint>
-               <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
+               <allowed-values id="nist-oscal-facet-prop-name" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
                   <enum value="state">Indicates if the facet is 'initial' as first identified, or 'adjusted' indicating that the value has be changed after some adjustments have been made (e.g., to identify residual risk).</enum>
                </allowed-values>
-               <allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='state']/@value"><!-- For values related to initial and residual (mitigated) risk -->
+               <allowed-values id="nist-oscal-facet-prop-state-value" target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='state']/@value"><!-- For values related to initial and residual (mitigated) risk -->
                   <enum value="initial">As first identified.</enum>
                   <enum value="adjusted">Indicates that residual risk remains after some adjustments have been made.</enum>
                </allowed-values>
                <!-- TODO: What about "vulnerability-id", "plugin-id"? Should this be added to FedRAMP? -->
-               <allowed-values target="(.)[@system='http://csrc.nist.gov/ns/oscal']/@name">
+               <allowed-values id="nist-oscal-facet-nist-specific" target="(.)[@system='http://csrc.nist.gov/ns/oscal']/@name">
                   <enum value="likelihood">General likelihood rating.</enum>
                   <enum value="impact">General impact rating.</enum>
                   <enum value="risk">General risk rating.</enum>
                   <enum value="severity">General severity rating.</enum>
                </allowed-values>
-               <allowed-values target="(.)[@system=('http://fedramp.gov','http://fedramp.gov/ns/oscal')]/@name">
+               <allowed-values id="nist-oscal-facet-fedramp-specific" target="(.)[@system=('http://fedramp.gov','http://fedramp.gov/ns/oscal')]/@name">
                   <enum value="likelihood">Likelihood as defined by FedRAMP. The <code>class</code> can be used to specify 'initial' and 'adjusted' risk states.</enum>
                   <enum value="impact">Impact as defined by FedRAMP. The <code>class</code> can be used to specify 'initial' and 'adjusted' risk states.</enum>
                   <enum value="risk">Risk as calculated according to FedRAMP. The <code>class</code> can be used to specify 'initial' and 'adjusted' risk states.</enum>
                </allowed-values>
-               <allowed-values target="(.)[@system='http://cve.mitre.org']/@name">
+               <allowed-values id="nist-oscal-facet-cve-specific" target="(.)[@system='http://cve.mitre.org']/@name">
                   <enum value="cve-id">An identifier managed by the CVE program (see <a>https://cve.mitre.org/</a>).</enum>
                </allowed-values>
-               <allowed-values target="(.)[@system='http://www.first.org/cvss/v2.0']/@name">
+               <allowed-values id="nist-oscal-facet-cvss-specific" target="(.)[@system='http://www.first.org/cvss/v2.0']/@name">
                   <enum value="access-vector">Base: Access Vector</enum>
                   <enum value="access-complexity">Base: Access Complexity</enum>
                   <enum value="authentication">Base: Authentication</enum>