Hi @dan-fedramp — this is a question about intended encoding rather than a defect report, though it may turn out to be one.
Context
Force of the Rule says of MAY:
The rule is truly optional. Parties SHOULD address such rules in their security documentation by explaining their decisions about how they handle such rules.
So a provider who reads a MAY rule and decides not to take the option it grants is still expected to record that decision in the SDR. Concrete examples from the Class C population: IVV-CSO-USR (representative samples), VDR-CSO-SIR (sampling — confirmed as "always optional" in FedRAMP/community#146), CDS-CSO-PSM (per-service materials), and VER-TFR-NRI.
The question
fedRampRequirements[].frrImplementationStatus enumerates exactly Implemented, Not Implemented, Partially Implemented. For a declined MAY rule, none of the three is accurate:
Implemented claims a capability that deliberately does not exist.Not Implemented reports a shortfall where the rule defines none, and aggregates into gap counts as though it were one.Partially Implemented is worse than either.
frrImplementationStatus is not in required (only frrID and frrImplementation are), so omitting the property appears to be the schema-valid way to record the decision without asserting a status — leaving the explanation to frrImplementation, which is what the MAY guidance asks for anyway. That is what we have done.
Two things would be useful to confirm:
- Is omission the intended signal for a declined optional rule, or is there a preferred convention we've missed?
- Should the FRR (and KSI) status enums carry an additional value, the way
SDR-CSF-CTF does for Rev5 controls (Planned, Alternative Implementation, Not Applicable)? The asymmetry between the Rev5 control statuses and the 20x FRR/KSI statuses is what prompted the question.
Happy to move this to FedRAMP/community if it reads as a practice question rather than a schema one.
— Patrick Phillips, Tarly
Hi @dan-fedramp — this is a question about intended encoding rather than a defect report, though it may turn out to be one.
Context
Force of the Rule says of
MAY:So a provider who reads a
MAYrule and decides not to take the option it grants is still expected to record that decision in the SDR. Concrete examples from the Class C population:IVV-CSO-USR(representative samples),VDR-CSO-SIR(sampling — confirmed as "always optional" in FedRAMP/community#146),CDS-CSO-PSM(per-service materials), andVER-TFR-NRI.The question
fedRampRequirements[].frrImplementationStatusenumerates exactlyImplemented,Not Implemented,Partially Implemented. For a declinedMAYrule, none of the three is accurate:Implementedclaims a capability that deliberately does not exist.Not Implementedreports a shortfall where the rule defines none, and aggregates into gap counts as though it were one.Partially Implementedis worse than either.frrImplementationStatusis not inrequired(onlyfrrIDandfrrImplementationare), so omitting the property appears to be the schema-valid way to record the decision without asserting a status — leaving the explanation tofrrImplementation, which is what theMAYguidance asks for anyway. That is what we have done.Two things would be useful to confirm:
SDR-CSF-CTFdoes for Rev5 controls (Planned,Alternative Implementation,Not Applicable)? The asymmetry between the Rev5 control statuses and the 20x FRR/KSI statuses is what prompted the question.Happy to move this to FedRAMP/community if it reads as a practice question rather than a schema one.
— Patrick Phillips, Tarly