Publish CaC content as an OSCAL Component Definition for NIST 800-53

[jpower432]

Share the context

OSCAL has been adopted by GSA as a supported submission type for FedRAMP accreditation. This issue captures an initial use case for publishing OSCAL Component Definitions from CaC content, specifically for OCP4 with the NIST-800-53 catalog/FedRAMP profiles.

Description of problem:

CaC content is not currently converted to OSCAL, and access to the information in this repository represented in OSCAL would be valuable to support compliance efforts.

Proposed change:

Publish OSCAL Component Definitions as release artifacts for OCP4

Approach

Tooling and Processing

• Option 1 - Build a CLI under utilities to convert using the compliance-trestle library
• Option 2 - Create compliance-trestle plugin under the ComplianceAsCode organization

Content Storage

• Any OSCAL content published upstream by authoritative sources should be imported and stored in a vendor directory for use. The vendor directory would store a trestle workspace. An example would be the NIST 800-53 OSCAL catalog and FedRAMP baselines.
• Another option could be to create the trestle workspace and import artifacts as runtime. This would have to pin the artifact to a commit or tagged version to ensure the results are reproducible.

Content Hierarchy

• Build the information from the existing YAML
• Create a single component definition and a single component for OCP4

References:

1. Component Definitions
2. Work previously done in the space for rule conversion - https://github.com/ComplianceAsCode/ocp-oscal-cd/pull/18/files
3. OSCAL conversion from @Mab879 - https://github.com/Mab879/content/blob/oscal_gen/utils/oscal/build_cd.py

[Mab879]

I would prefer option 1, that we create some utilities on this repo to covert to OSCAL.