Add RISK support in to component definition spread sheet (csv) support

[degenaro]

Issue description / feature objectives

Add the following optional columns as expected but optional to the csv-to-oscal-cd task:

• $Original_Risk_Rating
  • Provide the Original Risk Rating from the scanner
• $Adjusted_Risk_Rating
  • Provide the Adjusted Risk Rating as approved by the CIO
• $Risk_Adjustment
  • Whether there was a Risk Adjustment

These values, if specified, are to be added to the resulting OSCAL component definition as Properties.

Caveats / Assumptions

Provide sample/test/tutorial csv's with these additional fields/descriptions.

Completion Criteria

Test cases for code coverage added.

[Ma1h01]

Do risk-related columns need special handling? For example, they are ignored or required for validation component type?

[degenaro]

For validation, ignored. Otherwise, handling is the same for other optional columns that become OSCAL properties.

…

On Thu, Jun 6, 2024 at 2:00 PM Ma1h01 ***@***.***> wrote: Do risk-related columns need special handling? For example, they are ignored or required for validation component type? — Reply to this email directly, view it on GitHub <#1544 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD66XILPGBWOZ5L6C6DF2DZGCPUFAVCNFSM6AAAAABH2L3N5WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNJTGEYDEOJZGE> . You are receiving this because you were assigned.Message ID: ***@***.***>

[Ma1h01]

My approach to this issue is as follows:

In csv-to-oscal-cd.py:

1. Add three constants to represent the three risk headings.
2. Add the constants to the _columns_optional and _rule_property_column_names lists because they are optional and not required when component type is validation.
3. Modify the print_info() to correctly show the three newly added optional headings.

Then, make a new csv file with all three risk headings added for testing.

In csv-to-oscal-cd-test.py:

1. Write one test case to verify the presence of the three risk props in the resulting component-definition.json.
2. Write one test case to verify the absence of the three risk props in the resulting component-definition.json, when the component type is validation.