How to edit front-matter (non-control data)?

[aj-stein-nist]

Hello, I am trying to use the trestle author ssp and trestle assemble ssp functionality to begin authoring a system security plan in OSCAL for a project. How can I define and update things in the beginning of a system security plan:

1. Information System Name
2. Impact Level
3. Information Types

Essentially, anything that is in the system-characteristics.

The website says to contact maintainers with questions , so ... @fsuits?

[fsuits]

Hi @aj-stein-nist -

There are multiple changes going on in the SSP workflow, but the quick answer is that markdown will only allow editing of a subset of the OSCAL models and other details will need to be edited directly in the JSON - possibly with help from other trestle functionality such as split and merge.

The additional pending change is that currently some of the -assemble tools will assemble into a fresh model, which means you would need to re-edit to add anything to it. That should be changed shortly so that -assemble will optionally take an existing JSON model and replace its relevant contents from markdown while keeping other things the same.

Some additional work may be needed to retain the info in SystemCharacteristics but I will raise an issue for that.

In summary - right now I think you would need to edit the json to update those things each time you assemble - but the goal is to edit json once and have the info retained.

I will raise the issue for this - so please add comments if needed.

Thanks!

[aj-stein-nist]

Thanks for your in depth feedback, considered it answered!

[rahearn]

@fsuits is this answer still accurate today (I think the caveats about re-editing have been addressed in the meantime, at least)?

My goal is that any SSP content that a normal developer might find useful should live in a markdown file to be assembled into JSON with ssp-assemble. That would obviously include parts of SystemCharacteristics and SystemImplementation. Is extending ssp-generate and ssp-assemble to include those parts something that is either already on the roadmap or something that would be welcomed as a PR?