Selection parameters were deemed out of scope in earlier sprints but they appear to be more common in SP800-53 Rev 5 than in Rev 4, while at the same time real-world users even of Rev 4 (such as FedRAMP) expect to see them.

Goals

Represent "selection" parameter assignments in OSCAL sufficiently to support them in SP800-53 (revs 4 and 5) and its profiles including FedRAMP profiles.

Background

While we can represent parameters and inject arbitrary (string) values into parameter assignments at resolution or display time, SP800-53 also includes parameters that require not string values, but selections from one or more choices.

Selections may be "one only" or "one or more" (but maybe not "n or more" or "no more than n") from among a set of enumerated or (when selection choices are further parameterized) unenumerated values.

Real examples suggest that it might be useful for profiles to be able to "remodel" simple-value parameters (in their sources) as selections and vice versa. Indeed rewriting a selection to a simple value might be a way to provide for a (single) selection.

Dependencies

• Examples in SP800-53 revs 4 and 5 e.g. CA-3 (5), RA-3
• Examples in FedRAMP
• (A poll of these and/or other available examples to find edge cases?)

Acceptance Criteria

• Produce a small demo demonstrating selections from among choices of values in parameter assignments, both in their definition (default or proposed values) and in use in profiles.
• A demo catalog offers parameter value selections, including both "select one" and "select several" cases.
• In at least one case, a selected value may be further parameterized (cf RA-3)
• A profile shows how one or more options may be selected from selections in this catalog
• A profile of that profile shows how selections may be altered again
• Selections may be overwritten by simple values, and vice-versa
• A poll of SP800-53 suggests that the model is adequate to its needs
• Optionally (nice to have) a Schematron detects when actual selections are at odds with their implicit requirements (e.g. an impermissible value is offered) - nb this is open-ended

Note that deployment or updates to example catalogs is not a criterion for acceptance. We can use the 'mini-testing' unit tests but we shouldn't impact other demonstrations (yet).