@mitre/hdf-schema 3.0.1 → 3.1.0-rc.1

package/src/schemas/primitives/amendments.schema.json

@@ -1,155 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.0.0",
-  "title": "HDF Amendment Primitives",
-  "description": "Types for waivers, attestations, exceptions, and POA&Ms that modify requirement compliance status.",
-  "$defs": {
-    "Override_Type": {
-      "type": "string",
-      "enum": [
-        "waiver",
-        "attestation",
-        "exception",
-        "poam",
-        "inherited"
-      ],
-      "description": "The type of amendment. 'waiver': risk accepted (AO). 'attestation': manually verified (assessor). 'exception': not applicable (system owner + AO). 'poam': remediation tracked (no status change). 'inherited': control provided by another component or system (overrides to notApplicable/passed).",
-      "title": "Override Type"
-    },
-    "Standalone_Override": {
-      "type": "object",
-      "unevaluatedProperties": false,
-      "required": [
-        "type",
-        "requirementId",
-        "status",
-        "reason",
-        "appliedBy",
-        "appliedAt",
-        "expiresAt"
-      ],
-      "properties": {
-        "type": {
-          "$ref": "#/$defs/Override_Type",
-          "description": "The type of amendment."
-        },
-        "requirementId": {
-          "type": "string",
-          "description": "The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."
-        },
-        "baselineRef": {
-          "type": "string",
-          "description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
-        },
-        "status": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.0.0#/$defs/Result_Status",
-          "description": "The new status this amendment sets. For POA&Ms, this is the current status (POA&Ms track work, they don't change status)."
-        },
-        "reason": {
-          "type": "string",
-          "description": "Justification for this amendment."
-        },
-        "appliedBy": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.0.0#/$defs/Identity",
-          "description": "Identity of who applied this amendment."
-        },
-        "appliedAt": {
-          "type": "string",
-          "format": "date-time",
-          "description": "When this amendment was applied. ISO 8601 format."
-        },
-        "expiresAt": {
-          "type": "string",
-          "format": "date-time",
-          "description": "When this amendment expires and must be reviewed. No permanent amendments. ISO 8601 format."
-        },
-        "evidence": {
-          "type": "array",
-          "items": {
-            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.0.0#/$defs/Evidence"
-          },
-          "description": "Supporting evidence (screenshots, logs, URLs, documents)."
-        },
-        "signature": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.0.0#/$defs/Signature",
-          "description": "Digital signature for non-repudiation."
-        },
-        "previousChecksum": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.0.0#/$defs/Checksum",
-          "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
-        },
-        "milestones": {
-          "type": "array",
-          "items": {
-            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.0.0#/$defs/Milestone"
-          },
-          "description": "Remediation milestones (primarily for POA&M type amendments)."
-        },
-        "inheritedFrom": {
-          "type": "string",
-          "format": "uuid",
-          "description": "componentId of the local component that provides this control. Set when the provider is in the same system. Omit for external or cross-system providers; the reason field explains the source. Primarily used with type 'inherited'."
-        },
-        "componentRef": {
-          "type": "string",
-          "format": "uuid",
-          "description": "componentId of the component this amendment is scoped to. When set, the amendment only applies to the specified component. When omitted, the amendment applies system-wide."
-        }
-      },
-      "examples": [
-        {
-          "type": "waiver",
-          "requirementId": "SV-257777",
-          "baselineRef": "RHEL9-STIG",
-          "status": "passed",
-          "reason": "Compensating control: session timeout set to 15 min",
-          "appliedBy": { "type": "email", "identifier": "ao@agency.gov" },
-          "appliedAt": "2026-01-15T10:00:00Z",
-          "expiresAt": "2026-06-30T00:00:00Z",
-          "evidence": [
-            {
-              "type": "url",
-              "data": "https://jira.agency.gov/CYBER-4521",
-              "description": "ISSM approval with compensating control documentation"
-            }
-          ]
-        },
-        {
-          "type": "poam",
-          "requirementId": "SV-258001",
-          "baselineRef": "RHEL9-STIG",
-          "status": "failed",
-          "reason": "Patch requires vendor release, expected Q2 2026",
-          "appliedBy": { "type": "email", "identifier": "sysadmin@agency.gov" },
-          "appliedAt": "2026-01-20T09:00:00Z",
-          "expiresAt": "2026-07-01T00:00:00Z",
-          "milestones": [
-            {
-              "description": "Vendor patch release",
-              "estimatedCompletion": "2026-04-15T00:00:00Z",
-              "status": "pending"
-            },
-            {
-              "description": "Apply patch to all servers",
-              "estimatedCompletion": "2026-05-01T00:00:00Z",
-              "status": "pending"
-            }
-          ]
-        },
-        {
-          "type": "inherited",
-          "requirementId": "SV-230368",
-          "baselineRef": "RHEL9-STIG",
-          "status": "notApplicable",
-          "reason": "IA-2 is a common control provided by Keycloak SSO. This application has no local authentication mechanism.",
-          "inheritedFrom": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
-          "appliedBy": { "type": "email", "identifier": "issm@agency.gov" },
-          "appliedAt": "2026-03-26T10:00:00Z",
-          "expiresAt": "2026-09-26T00:00:00Z"
-        }
-      ],
-      "description": "A standalone amendment that modifies a requirement's compliance status. Extends the inline Status_Override concept with requirementId and baselineRef for use outside of results documents.",
-      "title": "Standalone Override"
-    }
-  }
-}