trestle-assessment

OSCAL Assessment Models in Trestle

Overview

OSCAL defines two assessment models:

• Assessment Plan (SAP): This model defines the scope, method, and schedule for a security assessment.
• Assessment Results (SAR): This model records findings, observations, and risks from an assessment.

Assessment Plan (SAP)

Purpose

The plan defines what you assess, how you assess it, when you assess it, and who assesses it. The model matches a Security Assessment Plan in FedRAMP and NIST terms.

Key Components

{
  "assessment-plan": {
    "uuid": "...",
    "metadata": { "title": "...", "version": "..." },
    "import-ssp": { "href": "#..." },
    "local-definitions": {
      "activities": [],
      "objectives-and-methods": []
    },
    "reviewed-controls": {
      "control-selections": [
        { "include-controls": [{ "control-id": "ac-1" }] }
      ]
    },
    "assessment-subjects": [],
    "assessment-assets": {
      "assessment-platforms": []
    },
    "tasks": []
  }
}

Key Fields

Field	Purpose
import-ssp	References the SSP under assessment
reviewed-controls	Controls in scope for this assessment
assessment-subjects	Systems, components, or inventories under assessment
assessment-assets	Tools and platforms used for assessment
tasks	Scheduled assessment activities
local-definitions.activities	Assessment activities and their steps
local-definitions.objectives-and-methods	Assessment objectives tied to controls

Workspace Location

assessment-plans/
└── my-assessment/
    └── assessment-plan.json

Assessment Results (SAR)

Purpose

The results record the outcomes of a security assessment. Outcomes include findings, observations, and risk determinations.

Key Components

{
  "assessment-results": {
    "uuid": "...",
    "metadata": { "title": "...", "version": "..." },
    "import-ap": { "href": "#..." },
    "results": [
      {
        "uuid": "...",
        "title": "Assessment Round 1",
        "start": "2024-01-15T00:00:00Z",
        "end": "2024-01-30T00:00:00Z",
        "reviewed-controls": {},
        "findings": [],
        "observations": [],
        "risks": []
      }
    ]
  }
}