Skip to content

Defined additional allowed values for the control 'status' property #2202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
brian-ruf wants to merge 22 commits into
base: develop
Choose a base branch
from
Open

Defined additional allowed values for the control 'status' property #2202

Show file tree
Hide file tree
Changes from 19 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
f01bf6f
defined additional allowed values for the control 'status' property
brian-ruf Mar 2, 2026
ad9b5a5
Merge branch 'develop' into control-status
brian-ruf Mar 3, 2026
2d4dc06
fix: resolve Prototype Pollution in fast-json-patch (GHSA-8gh8-hqwg-x…
nancysangani Mar 11, 2026
a2b3859
fix: resolve fast-json-patch Prototype Pollution vulnerability (GHSA-…
nancysangani Mar 12, 2026
62118bb
Fix responsible-role party-uuid constraint to only check when present…
nancysangani Mar 13, 2026
346344e
Bump actions/checkout from 6.0.1 to 6.0.2
dependabot[bot] Mar 15, 2026
e3af886
Merge branch 'develop' into control-status
iMichaela Mar 15, 2026
4d71697
fix: resolve Prototype Pollution in fast-json-patch (GHSA-8gh8-hqwg-x…
nancysangani Mar 11, 2026
e0eb529
fix: resolve fast-json-patch Prototype Pollution vulnerability (GHSA-…
nancysangani Mar 12, 2026
76ef0cb
Fix responsible-role party-uuid constraint to only check when present…
nancysangani Mar 13, 2026
ff6a269
Bump actions/checkout from 6.0.1 to 6.0.2
dependabot[bot] Mar 15, 2026
26bf22d
Bump actions/setup-node from 6.2.0 to 6.3.0
dependabot[bot] Mar 15, 2026
59b59d2
Corrected broken link to the profile-resolution spec.
Mar 16, 2026
bf6e3a0
Bump com.xmlcalabash:xmlcalabash from 3.0.31 to 3.0.42 in /build
dependabot[bot] Mar 16, 2026
6bf9c80
Bump org.apache.maven.plugins:maven-dependency-plugin in /build
dependabot[bot] Mar 16, 2026
6ce92ba
Merge branch 'develop' into control-status
iMichaela Mar 17, 2026
b10d13d
Fixes broken URL
Mar 17, 2026
026b8b5
Propagating older constraint value change from validated-by to valida…
Mar 17, 2026
22d4c37
Merge branch 'develop' into control-status
iMichaela Mar 17, 2026
39087b1
revised the allowed values list per comments in PR usnistgov/OSCAL#2022
brian-ruf Mar 17, 2026
2325f36
Updated CONTRIBUTING.md
Mar 25, 2026
ccd3562
Merge branch 'develop' into control-status
iMichaela Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/periodic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ jobs:
# Needed to post comments and issues
issues: write
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
submodules: recursive
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
with:
node-version-file: "build/.nvmrc"
cache: "npm"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ jobs:
name: Package Release
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
submodules: recursive
- uses: actions/setup-java@v5
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/status.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,14 +18,14 @@ jobs:
name: Status Checks
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
submodules: recursive
- uses: actions/setup-java@v5
with:
distribution: "temurin"
java-version: "17"
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
with:
node-version-file: "build/.nvmrc"
cache: "npm"
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ NIST is developing the [Open Security Controls Assessment Language](https://csrc

With this effort, we are stressing the agile development of a set of *minimal* formats that are both generic enough to capture the breadth of data in scope (controls specifications), while also capable of ad-hoc tuning and extension to support peculiarities of both (industry or sector) standard and new control types.

The [OSCAL website](https://www.nist.gov/oscal) provides an overview of the OSCAL project, including an XML and JSON [schema reference](https://pages.nist.gov/OSCAL/reference/), [examples](https://pages.nist.gov/OSCAL/concepts/examples/), and other resources.
The [OSCAL website](https://www.nist.gov/oscal) provides an overview of the OSCAL project, including an XML and JSON [schema reference](https://pages.nist.gov/OSCAL/reference/), [examples](https://pages.nist.gov/OSCAL/resources/examples/), and other resources.

If you are interested in contributing to the development of OSCAL, refer to the [contributor guidance](https://github.com/usnistgov/OSCAL/blob/main/CONTRIBUTING.md) for more information.

Expand Down
40 changes: 9 additions & 31 deletions build/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions build/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,8 @@
"ajv-cli": "^5.0.0",
"ajv-formats": "^3.0.1",
"markdown-link-check": "3.14.2"
},
"overrides": {
"fast-json-patch": "3.1.1"
}
}
4 changes: 2 additions & 2 deletions build/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
<dependency>
<groupId>com.xmlcalabash</groupId>
<artifactId>xmlcalabash</artifactId>
<version>3.0.31</version>
<version>3.0.42</version>
</dependency>
</dependencies>

Expand All @@ -48,7 +48,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<version>3.9.0</version>
<version>3.10.0</version>
<executions>
<execution>
<id>copy-dependencies</id>
Expand Down
10 changes: 9 additions & 1 deletion src/metaschema/oscal_catalog_metaschema.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,11 +286,19 @@
value of 'withdrawn' can indicate that the <code>control</code> has
been withdrawn and should no longer be used.</enum>
</allowed-values>
<allowed-values id="oscal-control-prop-status-value"
<allowed-values id="oscal-control-prop-status-value" allow-other="yes"
target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='status']/@value">
<enum value="withdrawn">The control is no longer used.</enum>
<enum value="Withdrawn" deprecated="1.0.0">**(deprecated)*** Use 'withdrawn'
instead.</enum>
<enum value="active">[Default] This control is currently in force.</enum>
Copy link
Copy Markdown
Contributor

@iMichaela iMichaela Mar 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@brian-ruf - The proposed new allowed values appear reasonable. However, I have two specific recommendations:

  1. Status Context: The value active may cause confusion since all controls are implicitly active by default. We should consider defining this status more precisely, perhaps it should indicate that a parameter has been set by an authoritative entity and that permissions to override that parameter have been revoked. This would give the status a functional purpose beyond the default state.

  2. Case normalization: To ensure robust validation, we should include both lowercase and capitalized versions of these values (e.g., 'withdrawn' and 'Withdrawn') to accommodate different data entry styles."

Copy link
Copy Markdown
Contributor

@canb227 canb227 Mar 17, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In regards to # 2: personally I think we should just normalize to lowercase instead of allowing both uppercase and lowercase.

Copy link
Copy Markdown
Contributor Author

@brian-ruf brian-ruf Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@iMichaela

On 1. Status Context I may not have been clear enough about my intention. I was only trying to have an explicit status that is the moral equivalent of a control with no explicit status (as 99% exist now). I selected active somewhat arbitrarily and am open to a different value.

When I read "permissions to override that parameter have been revoked", I interpret it as "you are not allowed to tailor this control", which sounds like it has implications for profile resolution. I am open to the idea of a status value with this semantic meaning. Since such a status would/should impact profile resolution, are you OK with addressing it as a separate issue that can receive more attention?

That said, I am absolutely open to changing the value from active to something else that better represents the moral equivalent of normal controls in a catalog with no status.

On 2. Case normalization, 98% of the allowed values in OSCAL are strictly lower case. There are a few exceptions that are strictly upper case. (I personally don't agree with even those exceptions.) The existence of "Withdrawn" with a capital "W" was an error from the release candidates, which is why it is marked depreciated, after version 1.0.0.

If anything, we should remove the capital-W "Withdrawn" from the metaschema since it is explicitly invalid after 1.0.0 anyway. If you agree, I am happy to make that change.

Copy link
Copy Markdown
Contributor

@iMichaela iMichaela Mar 17, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@brian-ruf - In principle, I agree with you to simplify and use only sentence case (lower case). I am concerned over the accuracy some catalog owners require/expect in the OSCAL representation. How will we accommodate it, if you have to do so?

The list of non-exhaustive keywords I collected:

  • Withdrawn: Used heavily by NIST (SP 800-53) and ISO. It means the control is no longer a standalone requirement.
  • Retired: Common in CIS Benchmarks and OWASP. It indicates the control or project is no longer maintained or relevant to modern threats.
  • Deprecated: Often used in IETF (RFCs) and OWASP. It means the control/method is still available but discouraged and will likely be removed in future versions.
  • Obsolescent: Occasionally seen in ISO standards to describe a process that is being phased out.
  • Incorporated: Primarily used by NIST. This means the specific requirements of Control A have been folded into Control B (e.g., "AC-17 is now incorporated into AC-1").
  • Superseded: Used by IETF and NIST. This indicates that a newer version of the control or document has replaced the old one entirely.
  • Consolidated: Frequently used during major version jumps (like the transition to ISO/IEC 27001:2022). It means multiple specific controls were merged into one broader, more functional control.
  • Modified / Enhanced/Renamed: Used across all frameworks (especially NIST and CSA CCM) to show that while the ID remains the same, the underlying requirements have been updated.
  • Simplified: Seen in CIS v8, where controls were restructured to be more manageable for smaller organizations.
  • Split: When one complex control is broken down into two or more distinct parts for better clarity.

NIST is using all capital letters or "Title Case": "WITHDRAWN" or "Withdrawn"
ISO, IETF, CIS: are using Title Case: "Merged", "Deleted"

<enum value="incorporated">This control was incorporated into another control as identified by one or more "incorporated" links.</enum>
<enum value="moved">This control was moved as identified by a "moved" link.</enum>
<enum value="reserved">This is a placeholder for a future control.</enum>
<enum value="deprecated">This control will be withdrawn. The withdrawn timeline or milestone may be describe the remarks.</enum>
<enum value="conditional">This control is only applicable under certain conditions described in the remarks.</enum>
<enum value="superseded">This control has been superseded by the artifact indicated by one or more "superseded-by" links or as described in the remarks.</enum>
<enum value="experimental">This control is a pilot or proposed control; not yet required.</enum>
</allowed-values>
<allowed-values id="oscal-control-link-rel-type" target="link/@rel" allow-other="yes">
<enum value="reference">The link cites an external resource related to this
Expand Down
14 changes: 9 additions & 5 deletions src/metaschema/oscal_ssp_metaschema.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -618,12 +618,16 @@
<index id="oscal-system-implementation-component-validation-uuid-index" name="index-system-implementation-component-uuid-validation" target="component[@type='validation']">
<key-field target="@uuid"/>
</index>
<index-has-key id="oscal-system-implementation-validated-by-index" name="index-system-implementation-component-uuid-validation" target="component/link[@rel='validated-by']">
<!-- "validated-by" was replaced with "validation" in allowed-values-component_component_link-rel.ent but the change was not propagated at that time.
Propagating the change to the index-has-key below, which was missed in the original change, to align with the new rel value of "validation"
while also implementing the PR #2107 which has been abandoned by the author.
PR #2107 was adding `and starts-with(@href,'#')` to the index-has-key for the "validated-by" rel value which is no longer valid. The proposed change is included below.
NOTE: By propagating the old change that renamed "validated-by" with "validation" and implementing the link/@rel=`validation`,
the "validation" value is intentionally now used by the component/@type="validation" and link/@rel="validation". This is a feature not a bug.
-->
<index-has-key id="oscal-system-implementation-validation-index" name="index-system-implementation-component-uuid-validation" target="component/link[@rel='validation' and starts-with(@href,'#')]">
<key-field target="@href"/>
</index-has-key>
<!-- index-has-key id="oscal-system-implementation-proof-of-compliance-index" name="index-system-implementation-component-uuid-validation" target="component/link[@rel='proof-of-compliance']">
<key-field target="@href"/>
</index-has-key -->

<!-- References to components of @type="service" -->
<index id="oscal-index-system-implementation-component-uuid-service" name="index-system-implementation-component-uuid-service" target="component[@type='service']">
Expand Down Expand Up @@ -729,7 +733,7 @@
<index-has-key id="oscal-implemented-requirement-index-metadata-role-id" name="index-metadata-role-id" target="responsible-role|statement/responsible-role|.//by-component//responsible-role">
<key-field target="@role-id"/>
</index-has-key>
<index-has-key id="oscal-implemented-requirement-index-metadata-party-uuid" name="index-metadata-party-uuid" target="responsible-role|statement/responsible-role|.//by-component//responsible-role">
<index-has-key id="oscal-implemented-requirement-index-metadata-party-uuid" name="index-metadata-party-uuid" target="responsible-role[party-uuid]|statement/responsible-role[party-uuid]|.//by-component//responsible-role[party-uuid]">
<key-field target="party-uuid"/>
</index-has-key>
<has-cardinality id="oscal-implemented-requirement-by-component-cardinality" target=".//by-component" min-occurs="1">
Expand Down
2 changes: 1 addition & 1 deletion src/specifications/profile-resolution/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ need a process for this - also Github Issues?

## Providing feedback on this specification

The OSCAL team welcomes feedback on the work in progress in this subdirectory, whether it be questions, points for clarification, critiques or suggestions. A rendered version of the Profile Resolution specification maintained here [appears](https://pages.nist.gov/OSCAL/resources/concepts/processing/profile-resolution/) on the OSCAL web site.
The OSCAL team welcomes feedback on the work in progress in this subdirectory, whether it be questions, points for clarification, critiques or suggestions. A rendered version of the Profile Resolution specification maintained here [appears](https://pages.nist.gov/OSCAL/learn/concepts/processing/profile-resolution/) on the OSCAL web site.

Please post Issues in Github or questions to the OSCAL mailing list, or ask about them on our [Gitter channel](https://gitter.im/usnistgov-OSCAL/Lobby). (See https://pages.nist.gov/OSCAL/contact/ for links.)

Expand Down