Essentials OSCAL NS 1.0

About this namespace

NAMESPACE URI: https://www.cyber.gov.au/ns/essentials/oscal/1.0

This page defines version 1.0 of the Essentials OSCAL namespace: the names and values, not defined by the OSCAL specification, that Essentials OSCAL documents use. OSCAL allows publishers to extend its models in this way, as described in NIST's Extending OSCAL Models with Props and Links.

A document uses this namespace if it has a property whose ns is the namespace URI, or if its metadata/remarks link to a back-matter resource whose rlink is the namespace URI.

The namespace covers two kinds of extension:

• Namespaced properties. Their ns is the namespace URI.
• Class, link relation and type values. OSCAL has no ns flag on class, rel or type, so these values appear unqualified. In a document that uses this namespace, their meaning is the one defined on this page.

Any other name or value in those documents is defined by OSCAL and has the meaning given by the OSCAL model reference for the version the document declares in oscal-version.

On this page, the source publication is the Essentials publication that an OSCAL document represents.

Index of terms

Definitions

Properties

domain (property)

Used on

control/prop; metadata/prop of a profile or metadata/prop of a resolved catalog

Occurs

On a control, once for each domain the action applies to, in the order the source publication lists them. On profile or resolved-catalog metadata, exactly once.

Value

A token naming the domain, in lower case with words joined by hyphens, for example privileged-environments. The namespace defines the format, not the list of domains. The domains belong to each release and can differ between releases.

Meaning

An Essentials domain: a category of assets or functions whose effectiveness is assessed separately.

• On a control, the action applies to the domain.
• On profile metadata, the profile selects the domain's controls: every catalog control that has a domain property with the same value.
• On resolved-catalog metadata, the catalog contains the domain's controls.

domain-description (property)

Used on

metadata/prop of a profile or metadata/prop of a resolved catalog

Occurs

Exactly once, together with domain

Value

Free text

Meaning

The description of the document's domain, as given in the source publication.

domain-priority-phase (property)

Used on

metadata/prop of a profile or metadata/prop of a resolved catalog

Occurs

Once for each phase assigned to the domain, in the order the source publication gives them

Value

phase-n, where n is the phase number, for example phase-2 for Phase 2. The phases assigned to a domain belong to each release and can differ between releases.

Meaning

A priority phase the source publication assigns to the document's domain.

Group and part classes

These classes are used on OSCAL groups, and on parts whose name OSCAL defines.

essentials-principle (group class)

Used on

group/@class

Meaning

The group is one Essentials principle. Its overview part states the principle. Its controls are the actions that address it.

essentials-action (part class)

Used on

control/part[@name='statement']/@class

Occurs

Once for each control

Meaning

The part's prose is the Essentials action: the outcome the organisation is to achieve, and the outcome an assessor evaluates. The part has the label "Action".

indicators-of-good-practice (part class)

Used on

control/part[@name='statement']/@class, on the part titled Indicators of Good Practice

Occurs

At most once for each control

Contains

Three indicator-group parts

Meaning

The Indicators of Good Practice (IGP) for the action: optional indicators that help an assessor evaluate the action's outcomes for a domain. They do not replace expert judgement, and they are not a checklist.

indicator-group (part class)

Used on

part[@name='item']/@class, directly inside an indicators-of-good-practice part

Occurs

Three times, in the order Not effective, Partially effective, Fully effective. Each has a title and no id.

Meaning

The indicator statements for one effectiveness rating.

Indicator statement classes (part class)

Used on

part[@name='item']/@class, directly inside an indicator-group part

Occurs

One or more in each indicator group

Values

Indicator statement classes

Class	Rating indicated (and title of its group)
not-effective-indicator-statement	Not effective
partially-effective-indicator-statement	Partially effective
fully-effective-indicator-statement	Fully effective

Meaning

The part's prose is one statement that an assessor finds true or not true of the assets in scope. The class gives the rating the statement indicates.

Link relations

mitigated-technique (link relation)

Used on

control/link/@rel

Occurs

Zero or more, one for each technique

Target

The href is a fragment (#<uuid>) that points to a back-matter/resource. The resource's title is the technique's name and its rlink is the technique's page on MITRE ATT&CK®.

Meaning

The source publication lists the linked ATT&CK technique as mitigated by the action.

Resource types

non-oscal-catalog (mapping resource type)

Used on

mapping/target-resource/@type (OSCAL defines catalog and profile, and allows other values)

Occurs

Once for each mapping whose target is not available in OSCAL

Meaning

The mapping's target is a control catalog that its publisher does not provide in OSCAL, for example a framework published only as a spreadsheet. Each target/@id-ref is the identifier as written in the target's own publication, and cannot be resolved against an OSCAL document.