oscal-assessment-plan

OSCAL Assessment Plan (SAP) Model

The Assessment Plan model documents how a security assessment will be conducted, including scope, methodology, schedule, and assessment activities.

Related skills:

• oscal-ssp - System Security Plan being assessed
• oscal-assessment-results - Results from executing the plan
• oscal-poam - Remediation tracking for findings

Purpose

An Assessment Plan:

• Defines assessment scope and objectives
• Identifies assessment methods (examine, interview, test)
• Specifies schedule and resources
• Documents assessment activities for each control
• Supports repeatable assessments

Document Structure

assessment-plan:
  uuid: <unique-identifier>
  metadata:
    title: "System Assessment Plan"
    version: "1.0.0"
    oscal-version: "1.1.2"
  import-ssp:
    href: "ssp.json"
  local-definitions: {}
  terms-and-conditions: {}
  reviewed-controls: {}
  assessment-subjects: []
  assessment-assets: {}
  tasks: []
  back-matter:
    resources: []

Import SSP

Reference the System Security Plan being assessed:

import-ssp:
  href: "https://example.com/system-ssp.json"

Local Definitions

Define assessment-specific components, users, and objectives:

local-definitions:
  components:
    - uuid: assessment-tool-uuid
      type: software
      title: "Vulnerability Scanner"
      description: "Automated vulnerability scanning tool"
  inventory-items:
    - uuid: scanner-instance-uuid
      description: "Scanner deployment"
  users:
    - uuid: assessor-uuid
      title: "Lead Assessor"
      props:
        - name: type
          value: external
  objectives-and-methods:
    - control-id: ac-2
      description: "Account management assessment"
      parts:
        - id: ac-2_obj.1
          name: objective
          prose: "Verify account types are defined"
        - id: ac-2_method.1
          name: method
          props:
            - name: method
              value: EXAMINE
          parts:
            - name: objects
              prose: "Account management policy and procedures"