nist_ssp_example.json.out

{
  "document": {
    "model": "system-security-plan"
  },
  "findings": [
    {
      "code": "PATTERN_NOT_CHECKED",
      "location": "/system-security-plan",
      "message": "59 value(s) declared as TokenDatatype were not checked against its pattern ^(\\p{L}|_)(\\p{L}|\\p{N}|[.\\-_])*$ , because that pattern uses regular-expression syntax this tool cannot compile. They are neither passed nor failed.",
      "property": "TokenDatatype",
      "rule": {
        "citation": "oscal-validate policy: the schema declares a regular expression this tool cannot compile, because JSON Schema patterns are ECMA-262 regular expressions and Python's re module does not implement the Unicode property escapes ECMA-262 allows. Values governed by such a pattern are reported as unchecked rather than approximated with a hand-written substitute, which would be a rule encoded from memory.",
        "retrieved": "-",
        "url": "README.md (Limits)"
      },
      "severity": "UNVERIFIABLE",
      "value": "59 value(s)"
    },
    {
      "code": "CONSTRAINT_NOT_EVALUATED",
      "location": "/system-security-plan",
      "message": "NIST publishes 200 allowed-values constraint(s) that this tool did not evaluate: most allowed-value sets declare allow-other, so a value outside them is not necessarily a violation. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.",
      "property": "allowed-values",
      "rule": {
        "citation": "oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.",
        "retrieved": "-",
        "url": "README.md (Limits)"
      },
      "severity": "UNVERIFIABLE",
      "value": "200 constraint(s)"
    },
    {
      "code": "CONSTRAINT_NOT_EVALUATED",
      "location": "/system-security-plan",
      "message": "NIST publishes 12 expect constraint(s) that this tool did not evaluate: the test is a Metapath expression, which this tool does not implement. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.",
      "property": "expect",
      "rule": {
        "citation": "oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.",
        "retrieved": "-",
        "url": "README.md (Limits)"
      },
      "severity": "UNVERIFIABLE",
      "value": "12 constraint(s)"
    },
    {
      "code": "CONSTRAINT_NOT_EVALUATED",
      "location": "/system-security-plan",
      "message": "NIST publishes 1 index constraint(s) that this tool did not evaluate: their target expressions are outside the Metapath subset this tool parses. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.",
      "property": "index",
      "rule": {
        "citation": "oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.",
        "retrieved": "-",
        "url": "README.md (Limits)"
      },
      "severity": "UNVERIFIABLE",
      "value": "1 constraint(s)"
    },
    {
      "code": "CONSTRAINT_NOT_EVALUATED",
      "location": "/system-security-plan",
      "message": "NIST publishes 25 matches constraint(s) that this tool did not evaluate: the value constraint is applied through Metapath datatype coercion. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.",
      "property": "matches",
      "rule": {
        "citation": "oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.",
        "retrieved": "-",
        "url": "README.md (Limits)"
      },
      "severity": "UNVERIFIABLE",
      "value": "25 constraint(s)"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/control-id",
      "message": "This names a control, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "control-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/0/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/1/by-components/0/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/1/by-components/1/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/1/by-components/2/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/1/by-components/3/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/1/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt.a"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/2/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt.a.1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/3/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt.a.2"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/4/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt.b"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/5/by-components/0/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_2"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/5/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt.b.1"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/6/by-components/0/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_3"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/6/by-components/1/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_3"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/6/by-components/2/set-parameters/0/param-id",
      "message": "This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "param-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_prm_3"
    },
    {
      "code": "REFERENCE_UNVERIFIABLE",
      "location": "/system-security-plan/control-implementation/implemented-requirements/0/statements/6/statement-id",
      "message": "This names a control statement, which is a part, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (#b78aa3ec-915d-475b-8097-46813fae1825), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.",
      "property": "statement-id",
      "rule": {
        "citation": "NIST, \"Identifier Use and UUIDs\", section Scope (page last updated 2025-06-10): \"since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references.\" Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/"
      },
      "severity": "UNVERIFIABLE",
      "value": "au-1_smt.b.2"
    },
    {
      "code": "IMPORT_NOT_SUPPLIED",
      "location": "/system-security-plan/import-profile/href",
      "message": "No document with this file name was supplied. Identifiers it declares are outside the effective data model this run could see, so references into it are reported UNVERIFIABLE rather than as failures. Pass it with --resolve to settle them.",
      "property": "href",
      "rule": {
        "citation": "NIST, \"URI Usage\", section Linking to another OSCAL object (page last updated 2025-03-03): a reference \"uses a relative reference consisting of only a URI fragment containing the identifier or UUID of the referenced object within the current documents effective data model. The effective data model of a document includes all objects identified with the document and any directly or transitively imported documents.\"",
        "retrieved": "2026-08-14",
        "url": "https://pages.nist.gov/OSCAL/learn/concepts/uri-use/"
      },
      "severity": "INFO",
      "value": "#b78aa3ec-915d-475b-8097-46813fae1825"
    },
    {
      "code": "OSCAL_VERSION_DIFFERS",
      "location": "/system-security-plan/metadata/oscal-version",
      "message": "The document declares OSCAL 1.2.2. Every finding in this report was produced against the vendored OSCAL 1.2.3 schema and constraint layer, so a difference between the two releases can show up here as a finding about the document.",
      "property": "oscal-version",
      "rule": {
        "citation": "The schema declares metadata/oscal-version in the vendored oscal_complete_schema.json for OSCAL 1.2.3 as \"The OSCAL model version the document was authored against and will conform to as valid.\" This tool judges every document against the vendored OSCAL 1.2.3 schema, whatever release the document names.",
        "retrieved": "2026-08-14",
        "url": "https://github.com/usnistgov/OSCAL/releases/download/v1.2.3/oscal_complete_schema.json"
      },
      "severity": "WARNING",
      "value": "1.2.2"
    }
  ],
  "summary": {
    "ERROR": 0,
    "INFO": 1,
    "UNVERIFIABLE": 21,
    "WARNING": 1
  },
  "tool": {
    "name": "oscal-validate",
    "version": "0.2.0"
  }
}

[exit 0]