Giter VIP home page Giter VIP logo

oscal-compass / compliance-trestle-fedramp Goto Github PK

View Code? Open in Web Editor NEW
3.0 8.0 1.0 2.48 MB

Compliance trestle plugin to support FedRAMP specific functionality.

Home Page: https://ibm.github.io/compliance-trestle/plugins/compliance-trestle-fedramp/

License: Apache License 2.0

Makefile 0.06% Python 0.65% Shell 0.06% XSLT 99.24% JavaScript 0.01%
oscal python compliance security fedramp

compliance-trestle-fedramp's Introduction

compliance-trestle-fedramp

A plugin for compliance-trestle to provide functionality specifically for FedRAMP.

This plugin provides APIs and commands for validating a FedRAMP compliant SSP (in JSON or YAML format). In future it will also provide utilities for converting various OSCAL models from XML to JSON format and vice-versa.

Python codebase, easy installation via pip

compliance-trestle-fedramp currently runs on python platforms on Linux and Mac. Windows support is planned to be added soon. It is available on PyPi so it is easily installed via pip. It is under active development and new releases are made available regularly.

Complete documentation and tutorials

A tutorial on how this plugin is created can be found here. Instructions on how to use the CLI are described here.

Development status

Compliance trestle fedramp is currently in beta. The expectation is that in ongoing work there may be un-announced changes that are breaking within the trestle-fedramp codebase.

Contributing to Trestle-fedramp

Our project welcomes external contributions. Please consult contributing to get started.

License & Authors

If you would like to see the detailed LICENSE click here. Consult contributors for a list of authors and maintainers for the core team.

# Copyright (c) 2020 IBM Corp. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

compliance-trestle-fedramp's People

Contributors

butler54 avatar compliance-trestle-1 avatar jpower432 avatar stevemar avatar vikas-agarwal76 avatar

Stargazers

 avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Forkers

jpower432

compliance-trestle-fedramp's Issues

Update compliance-trestle-fedramp to work with latest stable version of compliance-trestle

Issue description / feature objectives

The compliance-trestle version referenced in the setup.cfg is 0.31.0. The public API has had changes which makes this plugin not usable with stable versions of compliance-trestle.

Caveats / Assumptions

None

Completion Criteria

Update the plugin code using trestle libraries so it can be used with the latest version of compliance-trestle. At the time of submitting this issue, it is v2.4.0.

The semantic release job is not updating the repository

Describe the bug

Not an application bug, but a bug in the CI workflow that needs to be resolved. The semantic release job ran with no output and still passed. Not commit, tags, release were created.

To Reproduce

Steps to reproduce the behavior:

  1. Merge changes to main
  2. Observe the that the job passes with no output

Expected behavior

Release to be created

Screenshots / Logs.

Associated job with issue - https://github.com/oscal-compass/compliance-trestle-fedramp/actions/runs/8633856602/job/23709506722

Environment

  • OS: [e.g. iOS]
  • Python version:
  • Installed packages:

Update CONTRIBUTING.md information to match compliance trestle

Issue description / feature objectives

The contributing documentation needs to be filled out/updated.

Caveats / Assumptions

  • Match the compliance-trestle contributing doc
  • There is not organization-level contributing doc

Completion Criteria

All areas with FIXME updated

Add a feature to use content from an OSCAL SSP to populate the FedRAMP SSP Appendix A template

Issue description / feature objectives

Create a new command that will use the control implementation content from an OSCAL SSP to populate fields in the FedRAMP SSP Appendix A Template

Caveats / Assumptions

  • Only the control implementation information would be populated starting at page 26
  • This System data should always be included in the final output
  • Control origination and implementation status population might be conditional based on custom YAML headers/properties available

Completion Criteria

  • A command is added for the transformation
  • A copy of this template is populated (list of fields below) and written to an output directory
    • Control Origination (#27)
    • Parameters (#34)
    • Implementation Status (#32)
    • Description (#29)
    • Responsible Role (#39)

The components to include in the output are configurable by title, but by default all components are included (This can be accomplishing using the trestle ssp-filter command)

The sonar job is failing in the Trestle PR Pipeline workflow pipeline is failing

Describe the bug

The sonar job in the Trestle PR Pipeline workflow is failing. The compliance-trestle-fedramp project does exist in the organization.

To Reproduce

Steps to reproduce the behavior:

  1. Submit a PR
  2. Observe the error

Expected behavior

Job to pass when changes meet the requirements

Screenshots / Logs.

https://github.com/IBM/compliance-trestle-fedramp/actions/runs/7821325792/job/21338157771?pr=24

Environment

  • GitHub Actions

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.