OSCAL System Security Plan (SSP) Model 1.0.0-rc1 oscal-ssp

The OSCAL Control SSP format can be used to describe the information typically specified in a system security plan, such as those defined in NIST SP 800-18.

The root of the OSCAL System Security Plan (SSP) format is system-security-plan.

 system-security-plan Publication metadata Provides information about the publication and availability of the containing document. Publication metadata: Provides information about the publication and availability of the containing document. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Revision History Entry An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first). Revision History Entry: An entry in a sequential list of revisions to the containing document in reverse chronological order (i.e., most recent previous revision first). Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Location A location, with associated metadata that can be referenced. Location: A location, with associated metadata that can be referenced. Location URL The uniform resource locator (URL) for a web site or Internet presence associated with the location. Location URL: The uniform resource locator (URL) for a web site or Internet presence associated with the location. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Location Universally Unique Identifier A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistantly used for a given location across revisions of the document. Location Universally Unique Identifier: A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistantly used for a given location across revisions of the document. Location Reference References a location defined in metadata. Location Reference: References a location defined in metadata. Party (organization or person) A responsible entity which is either a person or an organization. Party (organization or person): A responsible entity which is either a person or an organization. Party Name The full name of the party. This is typically the legal name associated with the party. Party Name: The full name of the party. This is typically the legal name associated with the party. Party Short Name A short common name, abbreviation, or acronym for the party. Party Short Name: A short common name, abbreviation, or acronym for the party. Party External Identifier An identifier for a person or organization using a designated scheme. e.g. an Open Researcher and Contributor ID (ORCID) Party External Identifier: An identifier for a person or organization using a designated scheme. e.g. an Open Researcher and Contributor ID (ORCID) External Identifier Schema Indicates the type of external identifier. External Identifier Schema: Indicates the type of external identifier. Organizational Affiliation Identifies that the party object is a member of the organization associated with the provided UUID. Organizational Affiliation: Identifies that the party object is a member of the organization associated with the provided UUID. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Party Universally Unique Identifier A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistantly used for a given party across revisions of the document. Party Universally Unique Identifier: A unique identifier that can be used to reference this defined location elsewhere in an OSCAL document. A UUID should be consistantly used for a given party across revisions of the document. Party Type A category describing the kind of party the object describes. Party Type: A category describing the kind of party the object describes. Party Reference References a party defined in metadata. Party Reference: References a party defined in metadata. Role Defines a function assumed or expected to be assumed by a party in a specific situation. Role: Defines a function assumed or expected to be assumed by a party in a specific situation. Role Short Name A short common name, abbreviation, or acronym for the role. Role Short Name: A short common name, abbreviation, or acronym for the role. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Role Identifier A unique identifier for a specific role instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same role across minor revisions of the document. Role Identifier: A unique identifier for a specific role instance. This identifier's uniqueness is document scoped and is intended to be consistent for the same role across minor revisions of the document. Role Identifier Reference A reference to the roles served by the user. Role Identifier Reference: A reference to the roles served by the user. Back matter A collection of resources, which may be included directly or by reference. Back matter: A collection of resources, which may be included directly or by reference. Resource A resource associated with content in the containing document. A resource may be directly included in the document base64 encoded or may point to one or more equavalent internet resources. Resource: A resource associated with content in the containing document. A resource may be directly included in the document base64 encoded or may point to one or more equavalent internet resources. Citation A citation consisting of end note text and optional structured bibliographic data. Citation: A citation consisting of end note text and optional structured bibliographic data. Bibliographic Definition A container for structured bibliographic information. The model of this information is undefined by OSCAL. Bibliographic Definition: A container for structured bibliographic information. The model of this information is undefined by OSCAL. Resource link A pointer to an external resource with an optional hash for verification and change detection. Resource link: A pointer to an external resource with an optional hash for verification and change detection. Hypertext Reference A resolvable URI reference to a resource. Hypertext Reference: A resolvable URI reference to a resource. Media Type Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. Media Type: Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. Base64 The Base64 alphabet in RFC 2045 - aligned with XSD. Base64: The Base64 alphabet in RFC 2045 - aligned with XSD. File Name Name of the file before it was encoded as Base64 to be embedded in a resource. This is the name that will be assigned to the file when the file is decoded. File Name: Name of the file before it was encoded as Base64 to be embedded in a resource. This is the name that will be assigned to the file when the file is decoded. Media Type Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. Media Type: Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Resource Universally Unique Identifier A globally unique identifier that can be used to reference this defined resource elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Resource Universally Unique Identifier: A globally unique identifier that can be used to reference this defined resource elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Property An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair. The value of a property is a simple scalar value, which may be expressed as a list of values in some OSCAL formats. Property: An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair. The value of a property is a simple scalar value, which may be expressed as a list of values in some OSCAL formats. Property Universally Unique Identifier A unique identifier that can be used to reference this property elsewhere in an OSCAL document. A UUID should be consistantly used for a given location across revisions of the document. Property Universally Unique Identifier: A unique identifier that can be used to reference this property elsewhere in an OSCAL document. A UUID should be consistantly used for a given location across revisions of the document. Property Name A textual label that uniquely identifies a specific attribute, characteristic, or quality of the property's containing object. Property Name: A textual label that uniquely identifies a specific attribute, characteristic, or quality of the property's containing object. Property Namespace A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name. Property Namespace: A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name. Property Class A textual label that provides a sub-type or characterization of the property's name. This can be used to further distinguish or discriminate between the semantics of multiple properties of the same object with the same name and ns. Property Class: A textual label that provides a sub-type or characterization of the property's name. This can be used to further distinguish or discriminate between the semantics of multiple properties of the same object with the same name and ns. Annotated Property An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair with optional explanatory remarks. The value of an annotated property is a simple scalar value. Annotated Property: An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair with optional explanatory remarks. The value of an annotated property is a simple scalar value. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Annotated Property Name A textual label that uniquely identifies a specific attribute, characteristic, or quality of the annotated property's containing object. Annotated Property Name: A textual label that uniquely identifies a specific attribute, characteristic, or quality of the annotated property's containing object. Annotated Property Universally Unique Identifier A unique identifier that can be used to reference this annotated property elsewhere in an OSCAL document. A UUID should be consistantly used for a given location across revisions of the document. Annotated Property Universally Unique Identifier: A unique identifier that can be used to reference this annotated property elsewhere in an OSCAL document. A UUID should be consistantly used for a given location across revisions of the document. Annotated Property Namespace A namespace qualifying the annotated property's name. This allows different organizations to associate distinct semantics with the same name. Annotated Property Namespace: A namespace qualifying the annotated property's name. This allows different organizations to associate distinct semantics with the same name. Annotated Property Value Indicates the value of the attribute, characteristic, or quality. Annotated Property Value: Indicates the value of the attribute, characteristic, or quality. Link A reference to a local or remote resource Link: A reference to a local or remote resource Hypertext Reference A resolvable URL reference to a resource. Hypertext Reference: A resolvable URL reference to a resource. Relation Describes the type of relationship provided by the link. This can be an indicator of the link's purpose. Relation: Describes the type of relationship provided by the link. This can be an indicator of the link's purpose. Media Type Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. Media Type: Specifies a media type as defined by the Internet Assigned Numbers Authority (IANA) Media Types Registry. Responsible Party A reference to a set of organizations or persons that have responsibility for performing a referenced role in the context of the containing object. Responsible Party: A reference to a set of organizations or persons that have responsibility for performing a referenced role in the context of the containing object. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Responsible Role The role that the party is responsible for. Responsible Role: The role that the party is responsible for. Responsible Role A reference to one or more roles with responsibility for performing a function relative to the containing object. Responsible Role: A reference to one or more roles with responsibility for performing a function relative to the containing object. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Responsible Role ID The role that is responsible for the business function. Responsible Role ID: The role that is responsible for the business function. Hash A representation of a cryptographic digest generated over a resource using a specified hash algorithm. Hash: A representation of a cryptographic digest generated over a resource using a specified hash algorithm. Hash algorithm Method by which a hash is derived Hash algorithm: Method by which a hash is derived Publication Timestamp The date and time the document was published. The date-time value must be formatted according to RFC 3339 with full time and time zone included. Publication Timestamp: The date and time the document was published. The date-time value must be formatted according to RFC 3339 with full time and time zone included. Last Modified Timestamp The date and time the document was last modified. The date-time value must be formatted according to RFC 3339 with full time and time zone included. Last Modified Timestamp: The date and time the document was last modified. The date-time value must be formatted according to RFC 3339 with full time and time zone included. Document Version A string used to distinguish the current version of the document from other previous (and future) versions. Document Version: A string used to distinguish the current version of the document from other previous (and future) versions. OSCAL version The OSCAL model version the document was authored against. OSCAL version: The OSCAL model version the document was authored against. Email Address An email address as defined by RFC 5322 Section 3.4.1. Email Address: An email address as defined by RFC 5322 Section 3.4.1. Telephone Number Contact number by telephone. Telephone Number: Contact number by telephone. type flag Indicates the type of phone number. type flag: Indicates the type of phone number. Address A postal address for the location. Address: A postal address for the location. City City, town or geographical region for the mailing address. City: City, town or geographical region for the mailing address. State State, province or analogous geographical region for mailing address State: State, province or analogous geographical region for mailing address Postal Code Postal or ZIP code for mailing address Postal Code: Postal or ZIP code for mailing address Country Code The ISO 3166-1 alpha-2 country code for the mailing address. Country Code: The ISO 3166-1 alpha-2 country code for the mailing address. Address line A single line of an address. Address line: A single line of an address. Document Identifier A document identifier qualified by an identifier type. Document Identifier: A document identifier qualified by an identifier type. Document Identification Scheme Qualifies the kind of document identifier. Document Identification Scheme: Qualifies the kind of document identifier. Component A defined component that can be part of an implemented system. Component: A defined component that can be part of an implemented system. Status Describes the operational status of the system component. Status: Describes the operational status of the system component. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. State The operational status. State: The operational status. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Component Identifier The unique identifier for the component. Component Identifier: The unique identifier for the component. Component Type A category describing the purpose of the component. Component Type: A category describing the purpose of the component. Service Protocol Information Information about the protocol used to provide a service. Service Protocol Information: Information about the protocol used to provide a service. Service Protocol Information Universally Unique Identifier A globally unique identifier that can be used to reference this service protocol entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. Service Protocol Information Universally Unique Identifier: A globally unique identifier that can be used to reference this service protocol entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. Protocol Name The common name of the protocol, which should be the appropriate "service name" from the IANA Service Name and Transport Protocol Port Number Registry. Protocol Name: The common name of the protocol, which should be the appropriate "service name" from the IANA Service Name and Transport Protocol Port Number Registry. Port Range Where applicable this is the IPv4 port range on which the service operates. Port Range: Where applicable this is the IPv4 port range on which the service operates. Start Indicates the starting port number in a port range Start: Indicates the starting port number in a port range End Indicates the ending port number in a port range End: Indicates the ending port number in a port range Transport Indicates the transport type. Transport: Indicates the transport type. System User A type of user that interacts with the system based on an associated role. System User: A type of user that interacts with the system based on an associated role. User Short Name A short common name, abbreviation, or acronym for the user. User Short Name: A short common name, abbreviation, or acronym for the user. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. User Universally Unique Identifier The unique identifier for the user class. User Universally Unique Identifier: The unique identifier for the user class. Privilege Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege. Privilege: Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege. Functions Performed Describes a function performed for a given authorized privilege by this user class. Functions Performed: Describes a function performed for a given authorized privilege by this user class. Inventory Item A single managed inventory item within the system. Inventory Item: A single managed inventory item within the system. Implemented Component The set of components that are implemented in a given system inventory item. Implemented Component: The set of components that are implemented in a given system inventory item. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Component Universally Unique Identifier Reference A reference to a component that is implemented as part of an inventory item. Component Universally Unique Identifier Reference: A reference to a component that is implemented as part of an inventory item. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Inventory Item Universally Unique Identifier A globally unique identifier that can be used to reference this inventory item entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. Inventory Item Universally Unique Identifier: A globally unique identifier that can be used to reference this inventory item entry elsewhere in an OSCAL document. A UUID should be consistently used for a given resource across revisions of the document. Set Parameter Value Identifies the parameter that will be set by the enclosed value. Set Parameter Value: Identifies the parameter that will be set by the enclosed value. Parameter Value A parameter value or set of values. Parameter Value: A parameter value or set of values. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Parameter ID A reference to a parameter within a control, who's catalog has been imported into the current implementation context. Parameter ID: A reference to a parameter within a control, who's catalog has been imported into the current implementation context. System Identification A unique identifier for the system described by this system security plan. System Identification: A unique identifier for the system described by this system security plan. Identification System Type Identifies the identification system from which the provided identifier was assigned. Identification System Type: Identifies the identification system from which the provided identifier was assigned. System Security Plan (SSP) A system security plan, such as those described in NIST SP 800-18 System Security Plan (SSP): A system security plan, such as those described in NIST SP 800-18 System Security Plan Universally Unique Identifier A globally unique identifier for this catalog instance. This UUID should be changed when this document is revised. System Security Plan Universally Unique Identifier: A globally unique identifier for this catalog instance. This UUID should be changed when this document is revised. Import Profile Used to import the OSCAL profile representing the system's control baseline. Import Profile: Used to import the OSCAL profile representing the system's control baseline. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Profile Reference A resolvable URL reference to the profile to use as the system's control baseline. Profile Reference: A resolvable URL reference to the profile to use as the system's control baseline. System Characteristics Contains the characteristics of the system, such as its name, purpose, and security impact level. System Characteristics: Contains the characteristics of the system, such as its name, purpose, and security impact level. System Name - Full The full name of the system. System Name - Full: The full name of the system. System Name - Short A short name for the system, such as an acronym, that is suitable for display in a data table or summary list. System Name - Short: A short name for the system, such as an acronym, that is suitable for display in a data table or summary list. Security Sensitivity Level The overall information system sensitivity categorization, such as defined by FIPS-199. Security Sensitivity Level: The overall information system sensitivity categorization, such as defined by FIPS-199. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. System Information Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. System Information: Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. Information Type Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. Information Type: Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. Information Type Categorization A set of information type identifiers qualified by the given identification system used, such as NIST SP 800-60. Information Type Categorization: A set of information type identifiers qualified by the given identification system used, such as NIST SP 800-60. Information Type Systemized Identifier An identifier qualified by the given identification system used, such as NIST SP 800-60. Information Type Systemized Identifier: An identifier qualified by the given identification system used, such as NIST SP 800-60. Information Type Identification System Specifies the information type identification system used. Information Type Identification System: Specifies the information type identification system used. Confidentiality Impact Level The expected level of impact resulting from the unauthorized disclosure of the described information. Confidentiality Impact Level: The expected level of impact resulting from the unauthorized disclosure of the described information. Adjustment Justification If the selected security level is different from the base security level, this contains the justification for the change. Adjustment Justification: If the selected security level is different from the base security level, this contains the justification for the change. Integrity Impact Level The expected level of impact resulting from the unauthorized modification of the described information. Integrity Impact Level: The expected level of impact resulting from the unauthorized modification of the described information. Adjustment Justification If the selected security level is different from the base security level, this contains the justification for the change. Adjustment Justification: If the selected security level is different from the base security level, this contains the justification for the change. Availability Impact Level The expected level of impact resulting from the disruption of access to or use of the described information or the information system. Availability Impact Level: The expected level of impact resulting from the disruption of access to or use of the described information or the information system. Adjustment Justification If the selected security level is different from the base security level, this contains the justification for the change. Adjustment Justification: If the selected security level is different from the base security level, this contains the justification for the change. Information Type Universally Unique Identifier A globally unique identifier that can be used to reference this information type entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Information Type Universally Unique Identifier: A globally unique identifier that can be used to reference this information type entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Base Level (Confidentiality, Integrity, or Availability) The prescribed base (Confidentiality, Integrity, or Availability) security impact level. Base Level (Confidentiality, Integrity, or Availability): The prescribed base (Confidentiality, Integrity, or Availability) security impact level. Selected Level (Confidentiality, Integrity, or Availability) The selected (Confidentiality, Integrity, or Availability) security impact level. Selected Level (Confidentiality, Integrity, or Availability): The selected (Confidentiality, Integrity, or Availability) security impact level. Security Impact Level The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information. Security Impact Level: The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information. Security Objective: Confidentiality A target-level of confidentiality for the system, based on the sensitivity of information within the system. Security Objective: Confidentiality: A target-level of confidentiality for the system, based on the sensitivity of information within the system. Security Objective: Integrity A target-level of integrity for the system, based on the sensitivity of information within the system. Security Objective: Integrity: A target-level of integrity for the system, based on the sensitivity of information within the system. Security Objective: Availability A target-level of availability for the system, based on the sensitivity of information within the system. Security Objective: Availability: A target-level of availability for the system, based on the sensitivity of information within the system. Status Describes the operational status of the system. Status: Describes the operational status of the system. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. State The current operating status. State: The current operating status. System Authorization Date The date the system received its authorization. System Authorization Date: The date the system received its authorization. Authorization Boundary A description of this system's authorization boundary, optionally supplemented by diagrams that illustrate the authorization boundary. Authorization Boundary: A description of this system's authorization boundary, optionally supplemented by diagrams that illustrate the authorization boundary. Diagram A graphic that provides a visual representation the system, or some aspect of it. Diagram: A graphic that provides a visual representation the system, or some aspect of it. Diagram ID The identifier for this diagram. Diagram ID: The identifier for this diagram. Network Architecture A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture. Network Architecture: A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Data Flow A description of the logical flow of information within the system and across its boundaries, optionally supplemented by diagrams that illustrate these flows. Data Flow: A description of the logical flow of information within the system and across its boundaries, optionally supplemented by diagrams that illustrate these flows. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. System Implementation Provides information as to how the system is implemented. System Implementation: Provides information as to how the system is implemented. Leveraged Authorization A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common control provider. Leveraged Authorization: A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common control provider. party-uuid field A reference to the party that manages the leveraged system. party-uuid field: A reference to the party that manages the leveraged system. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Leveraged Authorization Universally Unique Identifier A globally unique identifier that can be used to reference this leveraged authorization entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Leveraged Authorization Universally Unique Identifier: A globally unique identifier that can be used to reference this leveraged authorization entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Control Implementation Describes how the system satisfies a set of controls. Control Implementation: Describes how the system satisfies a set of controls. Control-based Requirement Describes how the system satisfies an individual control. Control-based Requirement: Describes how the system satisfies an individual control. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Control Requirement Universally Unique Identifier A globally unique identifier that can be used to reference this control requirement entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Control Requirement Universally Unique Identifier: A globally unique identifier that can be used to reference this control requirement entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Control Identifier Reference A reference to a control identifier. Control Identifier Reference: A reference to a control identifier. Specific Control Statement Identifies which statements within a control are addressed. Specific Control Statement: Identifies which statements within a control are addressed. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Control Statement Reference A reference to a control statement by its identifier Control Statement Reference: A reference to a control statement by its identifier Control Statement Reference Universally Unique Identifier A globally unique identifier that can be used to reference this control statement entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Control Statement Reference Universally Unique Identifier: A globally unique identifier that can be used to reference this control statement entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Component Control Implementation Defines how the referenced component implements a set of controls. Component Control Implementation: Defines how the referenced component implements a set of controls. Export Identifies content intended for external consumption, such as with leveraged organizations. Export: Identifies content intended for external consumption, such as with leveraged organizations. Provided Control Implementation Describes a capability which may be inherited by a leveraging system. Provided Control Implementation: Describes a capability which may be inherited by a leveraging system. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Provided Universally Unique Identifier A globally unique identifier that can be used to reference this provided entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Provided Universally Unique Identifier: A globally unique identifier that can be used to reference this provided entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Control Implementation Responsibility Describes a control implementation responsibiity imposed on a leveraging system. Control Implementation Responsibility: Describes a control implementation responsibiity imposed on a leveraging system. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Responsibility Universally Unique Identifier A globally unique identifier that can be used to reference this responsibility entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Responsibility Universally Unique Identifier: A globally unique identifier that can be used to reference this responsibility entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Provided UUID Identifies a 'provided' assembly associated with this assembly. Provided UUID: Identifies a 'provided' assembly associated with this assembly. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Inherited Control Implementation Describes a control implementation inherited by a leveraging system. Inherited Control Implementation: Describes a control implementation inherited by a leveraging system. Inherited Universally Unique Identifier A globally unique identifier that can be used to reference this inherited entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Inherited Universally Unique Identifier: A globally unique identifier that can be used to reference this inherited entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Provided UUID Identifies a 'provided' assembly associated with this assembly. Provided UUID: Identifies a 'provided' assembly associated with this assembly. Satisfied Control Implementation Responsibility Describes how this system satisfies a responsibiity imposed by a leveraged system. Satisfied Control Implementation Responsibility: Describes how this system satisfies a responsibiity imposed by a leveraged system. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Satisfied Universally Unique Identifier A globally unique identifier that can be used to reference this satisfied entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Satisfied Universally Unique Identifier: A globally unique identifier that can be used to reference this satisfied entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. Provided UUID Identifies a 'provided' assembly associated with this assembly. Provided UUID: Identifies a 'provided' assembly associated with this assembly. Remarks Additional commentary on the containing object. Remarks: Additional commentary on the containing object. Component Universally Unique Identifier Reference A reference to the component that is implementing a given control or control statement. Component Universally Unique Identifier Reference: A reference to the component that is implementing a given control or control statement. By-Component Universally Unique Identifier A globally unique identifier that can be used to reference this by-component entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. By-Component Universally Unique Identifier: A globally unique identifier that can be used to reference this by-component entry elsewhere in an OSCAL document. A UUID should be consistantly used for a given resource across revisions of the document. The content model is the same as blockElementType, but line endings need to be preserved, since this is preformatted. The content model is the same as blockElementType, but line endings need to be preserved, since this is preformatted. The xs:dateTime with a required timezone. An email address Need a better pattern. A URI Requires a scheme with colon per RFC 3986 A URI reference, such as a relative URL A Type 4 ('random' or 'pseudorandom' UUID per RFC 4122 A sequence of 8-4-4-4-12 hex digits, with extra constraints in the 13th and 17-18th places for version 4