oscal-assessment-results

OSCAL Assessment Results (SAR) Model

The Assessment Results model documents findings from security assessments, including observations, risks, and evidence. It captures what was found when executing an assessment plan.

Related skills:

• oscal-assessment-plan - Plan that guided the assessment
• oscal-ssp - System that was assessed
• oscal-poam - Remediation tracking for findings

Purpose

Assessment Results:

• Document findings from assessment activities
• Record observations about control implementation
• Identify risks requiring remediation
• Provide evidence supporting conclusions
• Support continuous monitoring and periodic assessments

Document Structure

assessment-results:
  uuid: <unique-identifier>
  metadata:
    title: "System Assessment Results"
    version: "1.0.0"
    oscal-version: "1.1.2"
  import-ap:
    href: "assessment-plan.json"
  local-definitions: {}
  results:
    - uuid: result-uuid
      title: "Annual Assessment Results"
      start: "2024-03-01T00:00:00Z"
      end: "2024-03-15T23:59:59Z"
      reviewed-controls: {}
      findings: []
      observations: []
      risks: []
  back-matter:
    resources: []

Import Assessment Plan

Reference the assessment plan that was executed:

import-ap:
  href: "https://example.com/assessment-plan.json"

Results

Each result represents an assessment period:

results:
  - uuid: "result-uuid"
    title: "Q1 2024 Assessment"
    description: "Quarterly security assessment"
    start: "2024-03-01T00:00:00Z"
    end: "2024-03-15T23:59:59Z"
    props:
      - name: assessment-type
        value: periodic
    reviewed-controls:
      control-selections:
        - include-all: {}
    attestations:
      - responsible-parties:
          - role-id: lead-assessor
            party-uuids:
              - assessor-uuid
        parts:
          - name: attestation-statement
            prose: "This assessment was conducted in accordance with..."