├── docx
    └── .gitkeep
├── .gitignore
├── .github
    ├── disregard-timestamp-changes.sh
    └── workflows
    │   ├── ci.yml
    │   └── build.yml
├── Makefile
├── README.md
└── xml
    ├── rhel-7-fedramp-Low.xml
    └── rhel-8-fedramp-Low.xml


/docx/.gitkeep:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | /docx/*.docx
2 | 


--------------------------------------------------------------------------------
/.github/disregard-timestamp-changes.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -o errexit
 4 | set -o nounset
 5 | set -x
 6 | 
 7 | for format in xml json; do
 8 | 	cd $format
 9 | 	for f in `ls`; do
10 | 		if ! git ls-files --error-unmatch $f; then
11 | 			git add $f
12 | 		fi
13 | 		if [ "x$format" == "xxml"  ] && ! git diff $f|grep -v last-modified.*last-modified | grep -v ' uuid="' | grep '^+\s'; then
14 | 			git checkout $f;
15 | 		fi
16 | 		if [ "x$format" == "xjson" ] && ! git diff $f|grep -v '"last-modified": ".*",$'  | grep -v '"uuid": "' | grep '^+\s'; then
17 | 			git checkout $f;
18 | 		fi
19 | 	done
20 | 	cd ..
21 | done
22 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
 1 | oscal: xml json
 2 | all: oscal docx
 3 | 
 4 | 
 5 | xml: gocomply_fedramp
 6 | 	gocomply_fedramp --debug opencontrol --format xml https://github.com/ComplianceAsCode/redhat xml/
 7 | 
 8 | json: gocomply_fedramp
 9 | 	gocomply_fedramp --debug opencontrol --format json https://github.com/ComplianceAsCode/redhat json/
10 | 
11 | docx: gocomply_fedramp $(shell ls -d xml/* | sed -e 's/xml/docx/g')
12 | 
13 | docx/%.docx: xml/%.xml
14 | 	gocomply_fedramp convert $< $@
15 | 
16 | gocomply_fedramp:
17 | ifeq ("$(wildcard $(GOPATH)/bin/gocomply_fedramp)","")
18 | 	go get -u -v github.com/gocomply/fedramp/cli/gocomply_fedramp
19 | endif
20 | 
21 | .PHONY: gocomply_fedramp oscal xml json
22 | 


--------------------------------------------------------------------------------
/.github/workflows/ci.yml:
--------------------------------------------------------------------------------
 1 | name: CI
 2 | on:
 3 |   pull_request:
 4 |     branches: [ master ]
 5 | jobs:
 6 |   report:
 7 |     runs-on: ubuntu-latest
 8 |     steps:
 9 |       - name: Install Go
10 |         uses: actions/setup-go@v1
11 |         with:
12 |           go-version: 1.13
13 |       - name: Install dependencies
14 |         uses: mstksg/get-package@master
15 |         with:
16 |                 apt-get: libxml2-utils
17 |       - uses: actions/checkout@v2
18 |       - name: Get fedramp tool
19 |         run: |
20 |           go get -u -v github.com/gocomply/fedramp/cli/gocomply_fedramp
21 |       - name: Convert opencontrol
22 |         run: |
23 |           export PATH="$HOME/go/bin:$PATH"
24 |           make oscal
25 |       - name: Disregard timestamp-only changes
26 |         run: |
27 |           .github/disregard-timestamp-changes.sh
28 | 


--------------------------------------------------------------------------------
/.github/workflows/build.yml:
--------------------------------------------------------------------------------
 1 | name: Build
 2 | on:
 3 |   push:
 4 |     branches: [ master ]
 5 |   schedule:
 6 |   - cron: "0 0 * * *"
 7 | jobs:
 8 |   report:
 9 |     runs-on: ubuntu-latest
10 |     steps:
11 |       - name: Install Go
12 |         uses: actions/setup-go@v1
13 |         with:
14 |           go-version: 1.13
15 |       - name: Install dependencies
16 |         uses: mstksg/get-package@master
17 |         with:
18 |                 apt-get: libxml2-utils
19 |       - uses: actions/checkout@v2
20 |       - name: Get fedramp tool
21 |         run: |
22 |           go get -u -v github.com/gocomply/fedramp/cli/gocomply_fedramp
23 |       - name: Convert opencontrol
24 |         run: |
25 |           export PATH="$HOME/go/bin:$PATH"
26 |           make oscal
27 |       - name: Disregard timestamp-only changes
28 |         run: |
29 |           .github/disregard-timestamp-changes.sh
30 |       - name: Push to master
31 |         uses: mikeal/publish-to-github-action@master
32 |         env:
33 |           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # OSCAL content
 2 | 
 3 | At this point of time, this repository contains OSCAL formatted SSPs (System Security Plans) generated
 4 | automatically out of [opencontrol data](https://github.com/ComplianceAsCode/redhat).
 5 | 
 6 | This repository is on periodical refresh. ![Build](https://github.com/ComplianceAsCode/oscal/workflows/Build/badge.svg)
 7 | 
 8 | ### Developer information.
 9 | 
10 | [gocomply_fedramp](https://github.com/gocomply/fedramp) tool was used to generate files available here.
11 | 
12 | Commands to install `gocomply_fedramp` tool:
13 | 
14 |     $ get -u -v github.com/gocomply/fedramp/cli/gocomply_fedramp
15 | 
16 | Command to re-generate OSCAL files:
17 | 
18 |     $ gocomply_fedramp opencontrol https://github.com/ComplianceAsCode/redhat xml/
19 | 
20 | ### How to use these files?
21 | 
22 | It is possible to generate latest FedRAMP SSP document in `.docx` form using `gocomply_fedramp` tool.
23 | 
24 |     $ gocomply_fedramp convert ./xml/coreos-4-fedramp-Low.xml  FedRAMP-Low-openshift.docx
25 | 
26 | To generate all FedRAMP docx guides, one for each oscal file available run:
27 | 
28 |     $ make docx
29 | 


--------------------------------------------------------------------------------
/xml/rhel-7-fedramp-Low.xml:
--------------------------------------------------------------------------------
   1 | <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="c19ec366-24f9-4239-9bec-3c36686f9888">
   2 |   <metadata>
   3 |     <title></title>
   4 |     <published>2020-07-01T00:00:00.00-04:00</published>
   5 |     <last-modified>2023-03-02T01:19:03.38+00:00</last-modified>
   6 |     <version>0.0.1</version>
   7 |     <oscal-version>1.0.0-milestone3</oscal-version>
   8 |     <revision-history>
   9 |       <revision>
  10 |         <published>2019-06-01T00:00:00.00-04:00</published>
  11 |         <version>1.0</version>
  12 |         <oscal-version>1.0-Milestone3</oscal-version>
  13 |         <prop name="party-uuid" ns="https://fedramp.gov/ns/oscal">6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</prop>
  14 |         <remarks>
  15 |                <p>Initial publication.</p>
  16 |             </remarks>
  17 |       </revision>
  18 |       <revision>
  19 |         <published>2020-06-01T00:00:00.00-04:00</published>
  20 |         <version>2.0</version>
  21 |         <oscal-version>1.0-Milestone3</oscal-version>
  22 |         <prop name="party-id" ns="https://fedramp.gov/ns/oscal">csp</prop>
  23 |         <remarks>
  24 |                <p>Updated for annual assessment.</p>
  25 |             </remarks>
  26 |       </revision>
  27 |     </revision-history>
  28 |     <prop name="marking">Controlled Unclassified Information</prop>
  29 |     <role id="prepared-by">
  30 |       <title>Prepared By</title>
  31 |       <desc>The organization that prepared this SSP. If developed in-house, this is the CSP itself.</desc>
  32 |     </role>
  33 |     <role id="prepared-for">
  34 |       <title>Prepared For</title>
  35 |       <desc>The organization for which this SSP was prepared. Typically the CSP.</desc>
  36 |     </role>
  37 |     <role id="content-approver">
  38 |       <title>System Security Plan Approval</title>
  39 |       <desc>The individual or individuals accountable for the accuracy of this SSP.</desc>
  40 |     </role>
  41 |     <role id="cloud-service-provider">
  42 |       <title>Cloud Service Provider</title>
  43 |       <short-name>CSP</short-name>
  44 |     </role>
  45 |     <role id="system-owner">
  46 |       <title>Information System Owner</title>
  47 |       <desc>The individual within the CSP who is ultimately accountable for everything related to this system.</desc>
  48 |     </role>
  49 |     <role id="authorizing-official">
  50 |       <title>Authorizing Official</title>
  51 |       <desc>The individual or individuals who must grant this system an authorization to operate.</desc>
  52 |     </role>
  53 |     <role id="authorizing-official-poc">
  54 |       <title>Authorizing Official's Point of Contact</title>
  55 |       <desc>The individual representing the authorizing official.</desc>
  56 |     </role>
  57 |     <role id="system-poc-management">
  58 |       <title>Information System Management Point of Contact (POC)</title>
  59 |       <desc>The highest level manager who responsible for system operation on behalf of the System Owner.</desc>
  60 |     </role>
  61 |     <role id="system-poc-technical">
  62 |       <title>Information System Technical Point of Contact</title>
  63 |       <desc>The individual or individuals leading the technical operation of the system.</desc>
  64 |     </role>
  65 |     <role id="system-poc-other">
  66 |       <title>General Point of Contact (POC)</title>
  67 |       <desc>A general point of contact for the system, designated by the system owner.</desc>
  68 |     </role>
  69 |     <role id="information-system-security-officer">
  70 |       <title>System Information System Security Officer (or Equivalent)</title>
  71 |       <desc>The individual accountable for the security posture of the system on behalf of the system owner.</desc>
  72 |     </role>
  73 |     <role id="privacy-poc">
  74 |       <title>Privacy Official's Point of Contact</title>
  75 |       <desc>The individual responsible for the privacy threshold analysis and if necessary the privacy impact assessment.</desc>
  76 |     </role>
  77 |     <role id="asset-owner">
  78 |       <title>Owner of an inventory item within the system.</title>
  79 |     </role>
  80 |     <role id="asset-administrator">
  81 |       <title>Administrative responsibility an inventory item within the system.</title>
  82 |     </role>
  83 |     <role id="isa-poc-local">
  84 |       <title>ICA POC (Local)</title>
  85 |       <desc>The point of contact for an interconnection on behalf of this system.</desc>
  86 |       <remarks>
  87 |             <p>Remove this role if there are no ICAs.</p>
  88 |          </remarks>
  89 |     </role>
  90 |     <role id="isa-poc-remote">
  91 |       <title>ICA POC (Remote)</title>
  92 |       <desc>The point of contact for an interconnection on behalf of this external system to which this system connects.</desc>
  93 |       <remarks>
  94 |             <p>Remove this role if there are no ICAs.</p>
  95 |          </remarks>
  96 |     </role>
  97 |     <role id="isa-authorizing-official-local">
  98 |       <title>ICA Signatory (Local)</title>
  99 |       <desc>Responsible for signing an interconnection security agreement on behalf of this system.</desc>
 100 |       <remarks>
 101 |             <p>Remove this role if there are no ICAs.</p>
 102 |          </remarks>
 103 |     </role>
 104 |     <role id="isa-authorizing-official-remote">
 105 |       <title>ICA Signatory (Remote)</title>
 106 |       <desc>Responsible for signing an interconnection security agreement on behalf of the external system to which this system connects.</desc>
 107 |       <remarks>
 108 |             <p>Remove this role if there are no ICAs.</p>
 109 |          </remarks>
 110 |     </role>
 111 |     <role id="consultant">
 112 |       <title>Consultant</title>
 113 |       <desc>Any consultants involved with developing or maintaining this content.</desc>
 114 |     </role>
 115 |     <role id="admin-unix">
 116 |       <title>[SAMPLE]Unix Administrator</title>
 117 |       <desc>This is a sample role.</desc>
 118 |     </role>
 119 |     <role id="admin-client">
 120 |       <title>[SAMPLE]Client Administrator</title>
 121 |       <desc>This is a sample role.</desc>
 122 |     </role>
 123 |     <role id="program-director">
 124 |       <title>[SAMPLE]Program Director</title>
 125 |       <desc>This is a sample role.</desc>
 126 |     </role>
 127 |     <role id="fedramp-pmo">
 128 |       <title>Federal Risk and Authorization Management Program (FedRAMP) Program Management Office (PMO)</title>
 129 |       <short-name>FedRAMP PMO</short-name>
 130 |     </role>
 131 |     <role id="fedramp-jab">
 132 |       <title>Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB)</title>
 133 |       <short-name>FedRAMP JAB</short-name>
 134 |     </role>
 135 |     <location uuid="27b78960-59ef-4619-82b0-ae20b9c709ac">
 136 |       <title>CSP HQ</title>
 137 |       <address type="work">
 138 |         <addr-line>Suite 0000</addr-line>
 139 |         <addr-line>1234 Some Street</addr-line>
 140 |         <city>Haven</city>
 141 |         <state>ME</state>
 142 |         <postal-code>00000</postal-code>
 143 |       </address>
 144 |       <remarks>
 145 |             <p>There must be one location identifying the CSP's primary business address, such as the CSP's HQ, or the address of the system owner's primary business location.</p>
 146 |          </remarks>
 147 |     </location>
 148 |     <location uuid="16adcc8d-65d8-4583-80d3-9cf007744fec">
 149 |       <title>Primary Data Center</title>
 150 |       <address>
 151 |         <addr-line>2222 Main Street</addr-line>
 152 |         <city>Anywhere</city>
 153 |         <state>--</state>
 154 |         <postal-code>00000-0000</postal-code>
 155 |       </address>
 156 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">data-center</prop>
 157 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">primary-data-center</prop>
 158 |       <remarks>
 159 |             <p>There must be one location for each data center.</p>
 160 |             <p>There must be at least two data centers.</p>
 161 |             <p>For a data center, briefly summarize the components at this location.</p>
 162 |             <p>All data centers must have a conformity tag of "data-center".</p>
 163 |             <p>A primary data center must also have a conformity tag of "primary-data-center".</p>
 164 |          </remarks>
 165 |     </location>
 166 |     <location uuid="ad321514-7b9f-4374-8409-efb18eea6e5d">
 167 |       <title>Secondary Data Center</title>
 168 |       <address>
 169 |         <addr-line>3333 Small Road</addr-line>
 170 |         <city>Anywhere</city>
 171 |         <state>--</state>
 172 |         <postal-code>00000-0000</postal-code>
 173 |       </address>
 174 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">data-center</prop>
 175 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">alternate-data-center</prop>
 176 |       <remarks>
 177 |             <p>There must be one location for each data center.</p>
 178 |             <p>There must be at least two data centers.</p>
 179 |             <p>For a data center, briefly summarize the components at this location.</p>
 180 |             <p>All data centers must have a conformity tag of "data-center"</p>
 181 |             <p>An alternate or backup data center must also have a conformity tag of "alternate-data-center".</p>
 182 |          </remarks>
 183 |     </location>
 184 |     <party uuid="6b286b5d-8f07-4fa7-8847-1dd0d88f73fb" type="organization">
 185 |       <party-name>Cloud Service Provider (CSP) Name</party-name>
 186 |       <short-name>CSP Acronym/Short Name</short-name>
 187 |       <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
 188 |       <remarks>
 189 |             <p>Replace sample CSP information.</p>
 190 |          </remarks>
 191 |     </party>
 192 |     <party uuid="77e0e2c8-2560-4fe9-ac78-c3ff4ffc9f6d" type="organization">
 193 |       <party-name>Federal Risk and Authorization Management Program: Program Management Office</party-name>
 194 |       <short-name>FedRAMP PMO</short-name>
 195 |       <link href="https://fedramp.gov"></link>
 196 |       <address type="work">
 197 |         <addr-line>1800 F St. NW</addr-line>
 198 |         <city>Washington</city>
 199 |         <state>DC</state>
 200 |         <country>US</country>
 201 |       </address>
 202 |       <email>info@fedramp.gov</email>
 203 |       <remarks>
 204 |             <p>This party entry must be present in a FedRAMP SSP.</p>
 205 |             <p>The uuid may be different; however, the uuid must be associated with the "fedramp-pmo" role in the responsible-party assemblies.</p>
 206 |          </remarks>
 207 |     </party>
 208 |     <party uuid="49017ec3-9f51-4dbd-9253-858c2b1295fd" type="organization">
 209 |       <party-name>Federal Risk and Authorization Management Program: Joint Authorization Board</party-name>
 210 |       <short-name>FedRAMP JAB</short-name>
 211 |       <remarks>
 212 |             <p>This party entry must be present in a FedRAMP SSP.</p>
 213 |             <p>The uuid may be different; however, the uuid must be associated with the "fedramp-jab" role in the responsible-party assemblies.</p>
 214 |          </remarks>
 215 |     </party>
 216 |     <party uuid="78992555-4a99-4eaa-868c-f2c249679dd3" type="organization">
 217 |       <party-name>External Organization</party-name>
 218 |       <short-name>External</short-name>
 219 |       <remarks>
 220 |             <p>Generic placeholder for any external organization.</p>
 221 |          </remarks>
 222 |     </party>
 223 |     <party uuid="f595397b-cbe4-4a87-8c86-9bff91c4e7fd" type="organization">
 224 |       <party-name>Agency Name</party-name>
 225 |       <short-name>A.N.</short-name>
 226 |       <remarks>
 227 |             <p>Generic placeholder for an authorizing agency.</p>
 228 |          </remarks>
 229 |     </party>
 230 |     <party uuid="8e3d39da-4851-4d2a-adb5-4b5585ded952" type="organization">
 231 |       <party-name>Name of Consulting Org</party-name>
 232 |       <short-name>NOCO</short-name>
 233 |       <link href="https://consulting.sample"></link>
 234 |       <address type="work">
 235 |         <addr-line>3333 Corporate Way</addr-line>
 236 |         <city>Washington</city>
 237 |         <state>DC</state>
 238 |         <country>US</country>
 239 |       </address>
 240 |       <email>poc@consulting.sample</email>
 241 |     </party>
 242 |     <party uuid="80361ec4-bfce-4b5c-85c8-313d6ebd220b" type="organization">
 243 |       <party-name>[SAMPLE]Remote System Org Name</party-name>
 244 |     </party>
 245 |     <party uuid="09ad840f-aa79-43aa-9f22-25182c2ab11b" type="person">
 246 |       <party-name>[SAMPLE]ICA POC&#39;s Name</party-name>
 247 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 248 |       <email>person@ica.org.example</email>
 249 |       <phone>202-555-1212</phone>
 250 |       <member-of-organization>80361ec4-bfce-4b5c-85c8-313d6ebd220b</member-of-organization>
 251 |     </party>
 252 |     <party uuid="f0bc13a4-3303-47dd-80d3-380e159c8362" type="organization">
 253 |       <party-name>[SAMPLE]Example IaaS Provider</party-name>
 254 |       <short-name>E.I.P.</short-name>
 255 |       <remarks>
 256 |             <p>Underlying service provider. Leveraged Authorization.</p>
 257 |          </remarks>
 258 |     </party>
 259 |     <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
 260 |       <party-name>[SAMPLE]Person Name 1</party-name>
 261 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 262 |       <address>
 263 |         <addr-line>Mailstop A-1</addr-line>
 264 |       </address>
 265 |       <email>name@org.domain</email>
 266 |       <phone>202-000-0001</phone>
 267 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 268 |       <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
 269 |     </party>
 270 |     <party uuid="36b8d6c0-3b25-42cc-b529-cf4066145cdd" type="person">
 271 |       <party-name>[SAMPLE]Person Name 2</party-name>
 272 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 273 |       <address type="work">
 274 |         <addr-line>Address Line</addr-line>
 275 |         <city>City</city>
 276 |         <state>ST</state>
 277 |         <postal-code>00000</postal-code>
 278 |         <country>US</country>
 279 |       </address>
 280 |       <email>name@org.domain</email>
 281 |       <phone>202-000-0002</phone>
 282 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 283 |     </party>
 284 |     <party uuid="0cec09d9-20c6-470b-9ffc-85763375880b" type="person">
 285 |       <party-name>[SAMPLE]Person Name 3</party-name>
 286 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 287 |       <address type="work">
 288 |         <addr-line>Address Line</addr-line>
 289 |         <city>City</city>
 290 |         <state>ST</state>
 291 |         <postal-code>00000</postal-code>
 292 |         <country>US</country>
 293 |       </address>
 294 |       <email>name@org.domain</email>
 295 |       <phone>202-000-0003</phone>
 296 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 297 |     </party>
 298 |     <party uuid="f75e21f6-43d8-46ab-890d-7f2eebc5a830" type="person">
 299 |       <party-name>[SAMPLE]Person Name 4</party-name>
 300 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 301 |       <address type="work">
 302 |         <addr-line>Address Line</addr-line>
 303 |         <city>City</city>
 304 |         <state>ST</state>
 305 |         <postal-code>00000</postal-code>
 306 |         <country>US</country>
 307 |       </address>
 308 |       <email>name@org.domain</email>
 309 |       <phone>202-000-0004</phone>
 310 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 311 |     </party>
 312 |     <party uuid="132953a9-640c-46f7-9de9-3fa15ec99361" type="person">
 313 |       <party-name>[SAMPLE]Person Name 5</party-name>
 314 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 315 |       <address type="work">
 316 |         <addr-line>Address Line</addr-line>
 317 |         <city>City</city>
 318 |         <state>ST</state>
 319 |         <postal-code>00000</postal-code>
 320 |         <country>US</country>
 321 |       </address>
 322 |       <email>name@org.domain</email>
 323 |       <phone>202-000-0005</phone>
 324 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 325 |     </party>
 326 |     <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
 327 |       <party-name>[SAMPLE]Person Name 6</party-name>
 328 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 329 |       <address type="work">
 330 |         <addr-line>Address Line</addr-line>
 331 |         <city>City</city>
 332 |         <state>ST</state>
 333 |         <postal-code>00000</postal-code>
 334 |         <country>US</country>
 335 |       </address>
 336 |       <email>name@org.domain</email>
 337 |       <phone>202-000-0006</phone>
 338 |       <member-of-organization>78992555-4a99-4eaa-868c-f2c249679dd3</member-of-organization>
 339 |     </party>
 340 |     <party uuid="db234cb7-1776-425c-9ac4-b067c1723011" type="person">
 341 |       <party-name>[SAMPLE]Person Name 7</party-name>
 342 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 343 |       <address type="work">
 344 |         <addr-line>Address Line</addr-line>
 345 |         <city>City</city>
 346 |         <state>ST</state>
 347 |         <postal-code>00000</postal-code>
 348 |         <country>US</country>
 349 |       </address>
 350 |       <email>name@org.domain</email>
 351 |       <phone>202-000-0007</phone>
 352 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 353 |     </party>
 354 |     <party uuid="b306f5af-b93a-4a7f-a2b2-37a44fc92a79" type="organization">
 355 |       <party-name>[SAMPLE] IT Department</party-name>
 356 |     </party>
 357 |     <party uuid="59cdc953-5902-4fa4-a878-f3163854624c" type="organization">
 358 |       <party-name>[SAMPLE]Security Team</party-name>
 359 |     </party>
 360 |     <responsible-party role-id="cloud-service-provider">
 361 |       <party-uuid>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</party-uuid>
 362 |       <remarks>
 363 |             <p>Exactly one</p>
 364 |          </remarks>
 365 |     </responsible-party>
 366 |     <responsible-party role-id="prepared-by">
 367 |       <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
 368 |       <remarks>
 369 |             <p>Exactly one</p>
 370 |          </remarks>
 371 |     </responsible-party>
 372 |     <responsible-party role-id="prepared-for">
 373 |       <party-uuid>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</party-uuid>
 374 |     </responsible-party>
 375 |     <responsible-party role-id="content-approver">
 376 |       <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
 377 |       <party-uuid>36b8d6c0-3b25-42cc-b529-cf4066145cdd</party-uuid>
 378 |       <remarks>
 379 |             <p>One or more</p>
 380 |          </remarks>
 381 |     </responsible-party>
 382 |     <responsible-party role-id="system-owner">
 383 |       <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
 384 |       <remarks>
 385 |             <p>Exactly one</p>
 386 |          </remarks>
 387 |     </responsible-party>
 388 |     <responsible-party role-id="authorizing-official">
 389 |       <party-uuid>49017ec3-9f51-4dbd-9253-858c2b1295fd</party-uuid>
 390 |       <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
 391 |       <remarks>
 392 |             <p>One or more</p>
 393 |          </remarks>
 394 |     </responsible-party>
 395 |     <responsible-party role-id="system-poc-management">
 396 |       <party-uuid>0cec09d9-20c6-470b-9ffc-85763375880b</party-uuid>
 397 |       <remarks>
 398 |             <p>Exactly one</p>
 399 |          </remarks>
 400 |     </responsible-party>
 401 |     <responsible-party role-id="system-poc-technical">
 402 |       <party-uuid>f75e21f6-43d8-46ab-890d-7f2eebc5a830</party-uuid>
 403 |       <remarks>
 404 |             <p>Exactly one</p>
 405 |          </remarks>
 406 |     </responsible-party>
 407 |     <responsible-party role-id="information-system-security-officer">
 408 |       <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
 409 |       <remarks>
 410 |             <p>Exactly one</p>
 411 |          </remarks>
 412 |     </responsible-party>
 413 |     <responsible-party role-id="authorizing-official-poc">
 414 |       <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
 415 |       <remarks>
 416 |             <p>Exactly one</p>
 417 |          </remarks>
 418 |     </responsible-party>
 419 |     <responsible-party role-id="privacy-poc">
 420 |       <party-uuid>db234cb7-1776-425c-9ac4-b067c1723011</party-uuid>
 421 |       <remarks>
 422 |             <p>Exactly one</p>
 423 |          </remarks>
 424 |     </responsible-party>
 425 |     <responsible-party role-id="fedramp-pmo">
 426 |       <party-uuid>77e0e2c8-2560-4fe9-ac78-c3ff4ffc9f6d</party-uuid>
 427 |       <remarks>
 428 |             <p>Exactly one</p>
 429 |          </remarks>
 430 |     </responsible-party>
 431 |     <responsible-party role-id="fedramp-jab">
 432 |       <party-uuid>49017ec3-9f51-4dbd-9253-858c2b1295fd</party-uuid>
 433 |       <remarks>
 434 |             <p>Exactly one</p>
 435 |          </remarks>
 436 |     </responsible-party>
 437 |     <remarks>
 438 |          <p>This OSCAL-based FedRAMP SSP Template can be used for the FedRAMP Low, Moderate, and
 439 |             High baselines.</p>
 440 |          <p>Guidance for OSCAL-based FedRAMP Tailored content has not yet been developed.</p>
 441 |       </remarks>
 442 |   </metadata>
 443 |   <import-profile href="https://raw.githubusercontent.com/usnistgov/OSCAL/master/content/fedramp.gov/xml/FedRAMP_LOW-baseline_profile.xml"></import-profile>
 444 |   <system-characteristics>
 445 |     <system-id identifier-type="https://fedramp.gov">F00000000</system-id>
 446 |     <system-name>Red Hat Enterprise Linux 7.x</system-name>
 447 |     <system-name-short>rhel-7</system-name-short>
 448 |     <description><p>Automatically generated OSCAL SSP from OpenControl guidance for Red Hat Enterprise Linux 7.x</p></description>
 449 |     <security-sensitivity-level>low</security-sensitivity-level>
 450 |     <system-information>
 451 |       <information-type>
 452 |         <title>Information Type Name</title>
 453 |         <description><p>This item is useless nevertheless required.</p></description>
 454 |         <confidentiality-impact>
 455 |           <base>fips-199-moderate</base>
 456 |         </confidentiality-impact>
 457 |         <integrity-impact>
 458 |           <base>fips-199-moderate</base>
 459 |         </integrity-impact>
 460 |         <availability-impact>
 461 |           <base>fips-199-moderate</base>
 462 |         </availability-impact>
 463 |       </information-type>
 464 |     </system-information>
 465 |     <security-impact-level>
 466 |       <security-objective-confidentiality>fips-199-moderate</security-objective-confidentiality>
 467 |       <security-objective-integrity>fips-199-moderate</security-objective-integrity>
 468 |       <security-objective-availability>fips-199-moderate</security-objective-availability>
 469 |     </security-impact-level>
 470 |     <status state="operational"></status>
 471 |     <authorization-boundary>
 472 |       <description><p>A holistic, top-level explanation of the FedRAMP authorization boundary.</p></description>
 473 |     </authorization-boundary>
 474 |   </system-characteristics>
 475 |   <system-implementation>
 476 |     <user uuid="ebddf85a-2c8b-493f-89af-2e03c5ede486">
 477 |       <role-id>generator</role-id>
 478 |     </user>
 479 |     <component uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" component-type="system">
 480 |       <title>This system</title>
 481 |       <description><p>The entire system as depicted in the system authorization boundary</p></description>
 482 |       <status state="under-development"></status>
 483 |     </component>
 484 |   </system-implementation>
 485 |   <control-implementation>
 486 |     <description><p>FedRAMP SSP Template Section 13</p></description>
 487 |     <implemented-requirement uuid="a5f7c261-b143-4932-bafe-56a203d2974f" control-id="at-1">
 488 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 489 |       <statement statement-id="at-1_stmt.a" uuid="4fb55f92-8f7a-4b68-9edf-48625ce3a62a">
 490 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 491 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 492 |           <remarks><p>This control reflects organizational procedure/policy and is not
 493 | applicable to component-level configuration.
 494 | </p></remarks>
 495 |         </by-component>
 496 |       </statement>
 497 |       <statement statement-id="at-1_stmt.b" uuid="faf43c77-46a3-41ed-8d55-a238c5c3c300">
 498 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 499 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 500 |           <remarks><p>This control reflects organizational procedure/policy and is not
 501 | applicable to component-level configuration.
 502 | </p></remarks>
 503 |         </by-component>
 504 |       </statement>
 505 |     </implemented-requirement>
 506 |     <implemented-requirement uuid="187bbf86-112c-43bb-a6b1-0370ac67b459" control-id="at-2">
 507 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 508 |       <statement statement-id="at-2_stmt.a" uuid="11e87d5e-a558-4352-8418-864f48a3fa5a">
 509 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 510 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 511 |           <remarks><p>This control reflects organizational procedure/policy and is not
 512 | applicable to component-level configuration.
 513 | </p></remarks>
 514 |         </by-component>
 515 |       </statement>
 516 |       <statement statement-id="at-2_stmt.b" uuid="6b809c4b-ae3b-448a-b599-1cc724f41ce5">
 517 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 518 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 519 |           <remarks><p>This control reflects organizational procedure/policy and is not
 520 | applicable to component-level configuration.
 521 | </p></remarks>
 522 |         </by-component>
 523 |       </statement>
 524 |       <statement statement-id="at-2_stmt.c" uuid="326f3d80-8c5a-4a2a-ab26-8a3a290f2d01">
 525 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 526 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 527 |           <remarks><p>This control reflects organizational procedure/policy and is not
 528 | applicable to component-level configuration.
 529 | </p></remarks>
 530 |         </by-component>
 531 |       </statement>
 532 |     </implemented-requirement>
 533 |     <implemented-requirement uuid="6b128074-d806-4839-b3ec-d1afd70507f0" control-id="at-3">
 534 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 535 |       <statement statement-id="at-3_stmt.a" uuid="9fd8bcd9-0953-4643-8659-30a875b9bf4e">
 536 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 537 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 538 |           <remarks><p>This control reflects organizational procedure/policy and is not
 539 | applicable to component-level configuration.
 540 | </p></remarks>
 541 |         </by-component>
 542 |       </statement>
 543 |       <statement statement-id="at-3_stmt.b" uuid="c069e62b-112d-4576-aa88-f8728db3cd66">
 544 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 545 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 546 |           <remarks><p>This control reflects organizational procedure/policy and is not
 547 | applicable to component-level configuration.
 548 | </p></remarks>
 549 |         </by-component>
 550 |       </statement>
 551 |       <statement statement-id="at-3_stmt.c" uuid="e21d0bf9-7aac-4595-be92-736aeec4ec3e">
 552 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 553 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 554 |           <remarks><p>This control reflects organizational procedure/policy and is not
 555 | applicable to component-level configuration.
 556 | </p></remarks>
 557 |         </by-component>
 558 |       </statement>
 559 |     </implemented-requirement>
 560 |     <implemented-requirement uuid="2ff212e3-ac02-4eba-8546-8fa25721828c" control-id="at-4">
 561 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 562 |       <statement statement-id="at-4_stmt.a" uuid="07d09c72-058c-4b7e-be8b-044b9a8f8236">
 563 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 564 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 565 |           <remarks><p>This control reflects organizational procedure/policy and is not
 566 | applicable to component-level configuration.
 567 | </p></remarks>
 568 |         </by-component>
 569 |       </statement>
 570 |       <statement statement-id="at-4_stmt.b" uuid="2ffa39fb-db05-43b4-83ff-65762cef8c30">
 571 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 572 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 573 |           <remarks><p>This control reflects organizational procedure/policy and is not
 574 | applicable to component-level configuration.
 575 | </p></remarks>
 576 |         </by-component>
 577 |       </statement>
 578 |     </implemented-requirement>
 579 |     <implemented-requirement uuid="b2074ca2-3314-40e0-a322-f76401c98bfa" control-id="ir-1">
 580 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 581 |       <statement statement-id="ir-1_stmt.a" uuid="ed383cd8-fcef-44ad-940f-ea4fc52b0aa2">
 582 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 583 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 584 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 585 | applicable to the configuration of Red Hat Enterprise Linux.
 586 | </p></remarks>
 587 |         </by-component>
 588 |       </statement>
 589 |       <statement statement-id="ir-1_stmt.a.1" uuid="a3341e3c-19c6-4b0b-b637-9735c61cc5f6">
 590 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 591 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 592 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 593 | applicable to the configuration of Red Hat Enterprise Linux.
 594 | </p></remarks>
 595 |         </by-component>
 596 |       </statement>
 597 |       <statement statement-id="ir-1_stmt.a.2" uuid="e91da04a-dbf5-4de9-b6e9-746ea1986315">
 598 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 599 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 600 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 601 | applicable to the configuration of Red Hat Enterprise Linux.
 602 | </p></remarks>
 603 |         </by-component>
 604 |       </statement>
 605 |       <statement statement-id="ir-1_stmt.b" uuid="f045f5f3-7433-450a-8514-a5d958b6f756">
 606 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 607 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 608 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 609 | applicable to the configuration of Red Hat Enterprise Linux.
 610 | </p></remarks>
 611 |         </by-component>
 612 |       </statement>
 613 |       <statement statement-id="ir-1_stmt.b.1" uuid="2cee221e-32d8-4226-a9f9-301ed97dd459">
 614 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 615 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 616 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 617 | applicable to the configuration of Red Hat Enterprise Linux.
 618 | </p></remarks>
 619 |         </by-component>
 620 |       </statement>
 621 |       <statement statement-id="ir-1_stmt.b.2" uuid="fa61c208-6617-4235-b59c-eca7c1a95820">
 622 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 623 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 624 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 625 | applicable to the configuration of Red Hat Enterprise Linux.
 626 | </p></remarks>
 627 |         </by-component>
 628 |       </statement>
 629 |     </implemented-requirement>
 630 |     <implemented-requirement uuid="0a75b64e-e699-48d4-8f39-5739080a53eb" control-id="ir-2">
 631 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 632 |       <statement statement-id="ir-2_stmt.a" uuid="fb410b5c-35f6-43a9-bc42-1eb15f6561a9">
 633 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 634 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 635 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 636 | applicable to the configuration of Red Hat Enterprise Linux.
 637 | </p></remarks>
 638 |         </by-component>
 639 |       </statement>
 640 |       <statement statement-id="ir-2_stmt.b" uuid="7503c5a4-5d5e-4dc7-8423-09cfaaed0c90">
 641 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 642 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 643 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 644 | applicable to the configuration of Red Hat Enterprise Linux.
 645 | </p></remarks>
 646 |         </by-component>
 647 |       </statement>
 648 |       <statement statement-id="ir-2_stmt.c" uuid="eae5a6d6-5743-4c18-a1ff-417213648ba8">
 649 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 650 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 651 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 652 | applicable to the configuration of Red Hat Enterprise Linux.
 653 | </p></remarks>
 654 |         </by-component>
 655 |       </statement>
 656 |     </implemented-requirement>
 657 |     <implemented-requirement uuid="d5f43da4-0738-4742-b982-9078b37c5e7a" control-id="ir-4">
 658 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 659 |       <statement statement-id="ir-4_stmt.a" uuid="df767cc6-026f-47e6-b828-78dde7ffea92">
 660 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 661 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 662 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 663 | applicable to the configuration of Red Hat Enterprise Linux.
 664 | </p></remarks>
 665 |         </by-component>
 666 |       </statement>
 667 |       <statement statement-id="ir-4_stmt.b" uuid="a776cf6b-5456-46a0-8971-aea647e59336">
 668 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 669 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 670 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 671 | applicable to the configuration of Red Hat Enterprise Linux.
 672 | </p></remarks>
 673 |         </by-component>
 674 |       </statement>
 675 |       <statement statement-id="ir-4_stmt.c" uuid="f50b8c8c-add4-42c9-8c3b-c2a614a4652b">
 676 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 677 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 678 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 679 | applicable to the configuration of Red Hat Enterprise Linux.
 680 | </p></remarks>
 681 |         </by-component>
 682 |       </statement>
 683 |     </implemented-requirement>
 684 |     <implemented-requirement uuid="fb3375f1-e4be-45d8-98a3-89897298fca4" control-id="ir-5">
 685 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 686 |       <statement statement-id="ir-5_stmt" uuid="5e6ba516-299c-4800-a996-f5a5d9edbb09">
 687 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f064814e-36c6-448e-8f0d-4eca9db77025">
 688 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 689 |           <remarks><p>This control reflects organizational procedure/policies and is not
 690 | applicable to Red Hat Enterprise Linux configuration.
 691 | </p></remarks>
 692 |         </by-component>
 693 |       </statement>
 694 |     </implemented-requirement>
 695 |     <implemented-requirement uuid="655e23ea-73f9-42c9-b7d4-3a94e7a2ad57" control-id="ir-6">
 696 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 697 |       <statement statement-id="ir-6_stmt.a" uuid="40d636d6-6964-4610-aa7c-d86737531f1a">
 698 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 699 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 700 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 701 | applicable to the configuration of Red Hat Enterprise Linux.
 702 | </p></remarks>
 703 |         </by-component>
 704 |       </statement>
 705 |       <statement statement-id="ir-6_stmt.b" uuid="9a1f52a2-b2a3-42dd-9f4e-07b0a9e5562a">
 706 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 707 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 708 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 709 | applicable to the configuration of Red Hat Enterprise Linux.
 710 | </p></remarks>
 711 |         </by-component>
 712 |       </statement>
 713 |     </implemented-requirement>
 714 |     <implemented-requirement uuid="3e04a01d-4a41-444a-bdc8-bb8ddeb427e9" control-id="ir-7">
 715 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 716 |       <statement statement-id="ir-7_stmt" uuid="1defce0f-835b-45b2-a8b4-0bbf79eb06a7">
 717 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 718 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 719 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 720 | applicable to the configuration of Red Hat Enterprise Linux.
 721 | </p></remarks>
 722 |         </by-component>
 723 |       </statement>
 724 |     </implemented-requirement>
 725 |     <implemented-requirement uuid="98e7a79d-ec6b-4253-a247-3dfa3a97f274" control-id="ir-8">
 726 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 727 |       <statement statement-id="ir-8_stmt.a" uuid="f226ef5d-c4e5-453e-8f06-806363fc976a">
 728 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 729 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 730 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 731 | applicable to the configuration of Red Hat Enterprise Linux.
 732 | </p></remarks>
 733 |         </by-component>
 734 |       </statement>
 735 |       <statement statement-id="ir-8_stmt.a.1" uuid="a45f4789-b326-476a-873c-2c0f287832d3">
 736 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 737 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 738 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 739 | applicable to the configuration of Red Hat Enterprise Linux.
 740 | </p></remarks>
 741 |         </by-component>
 742 |       </statement>
 743 |       <statement statement-id="ir-8_stmt.a.2" uuid="813f981f-6923-4235-a648-7b076ee3eea6">
 744 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 745 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 746 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 747 | applicable to the configuration of Red Hat Enterprise Linux.
 748 | </p></remarks>
 749 |         </by-component>
 750 |       </statement>
 751 |       <statement statement-id="ir-8_stmt.a.3" uuid="30328a20-0b4a-46b8-8f1a-7ba21adae16c">
 752 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 753 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 754 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 755 | applicable to the configuration of Red Hat Enterprise Linux.
 756 | </p></remarks>
 757 |         </by-component>
 758 |       </statement>
 759 |       <statement statement-id="ir-8_stmt.a.4" uuid="df0171a6-7b99-4a7d-94b4-05f839870539">
 760 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 761 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 762 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 763 | applicable to the configuration of Red Hat Enterprise Linux.
 764 | </p></remarks>
 765 |         </by-component>
 766 |       </statement>
 767 |       <statement statement-id="ir-8_stmt.a.5" uuid="0f112da4-8f39-4059-9b59-5e79408d6400">
 768 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 769 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 770 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 771 | applicable to the configuration of Red Hat Enterprise Linux.
 772 | </p></remarks>
 773 |         </by-component>
 774 |       </statement>
 775 |       <statement statement-id="ir-8_stmt.a.6" uuid="c5f5033e-b926-4c39-8ed6-ce6973cf1003">
 776 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 777 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 778 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 779 | applicable to the configuration of Red Hat Enterprise Linux.
 780 | </p></remarks>
 781 |         </by-component>
 782 |       </statement>
 783 |       <statement statement-id="ir-8_stmt.a.7" uuid="7165cc37-0212-473c-b692-b82782d977cd">
 784 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 785 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 786 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 787 | applicable to the configuration of Red Hat Enterprise Linux.
 788 | </p></remarks>
 789 |         </by-component>
 790 |       </statement>
 791 |       <statement statement-id="ir-8_stmt.a.8" uuid="d9359977-60b1-407b-b570-0a5f1196cc94">
 792 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 793 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 794 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 795 | applicable to the configuration of Red Hat Enterprise Linux.
 796 | </p></remarks>
 797 |         </by-component>
 798 |       </statement>
 799 |       <statement statement-id="ir-8_stmt.b" uuid="0a5d4e19-2307-43f4-bc0b-8e40d51b1709">
 800 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 801 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 802 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 803 | applicable to the configuration of Red Hat Enterprise Linux.
 804 | </p></remarks>
 805 |         </by-component>
 806 |       </statement>
 807 |       <statement statement-id="ir-8_stmt.c" uuid="410ad22d-49e8-4aa4-89cf-ba7d90b82231">
 808 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 809 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 810 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 811 | applicable to the configuration of Red Hat Enterprise Linux.
 812 | </p></remarks>
 813 |         </by-component>
 814 |       </statement>
 815 |       <statement statement-id="ir-8_stmt.d" uuid="b8b6ffaa-f874-46b5-a0e8-919d4d22db03">
 816 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 817 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 818 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 819 | applicable to the configuration of Red Hat Enterprise Linux.
 820 | </p></remarks>
 821 |         </by-component>
 822 |       </statement>
 823 |       <statement statement-id="ir-8_stmt.e" uuid="987ad1c7-67d9-44bb-9bdf-070d5bef811c">
 824 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 825 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 826 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 827 | applicable to the configuration of Red Hat Enterprise Linux.
 828 | </p></remarks>
 829 |         </by-component>
 830 |       </statement>
 831 |       <statement statement-id="ir-8_stmt.f" uuid="78a2096f-5c01-4a63-a51b-4652d85f1821">
 832 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 833 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 834 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 835 | applicable to the configuration of Red Hat Enterprise Linux.
 836 | </p></remarks>
 837 |         </by-component>
 838 |       </statement>
 839 |     </implemented-requirement>
 840 |     <implemented-requirement uuid="42a8e6e7-ba47-4673-aa26-921fc065444d" control-id="pe-1">
 841 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 842 |       <statement statement-id="pe-1_stmt.a" uuid="c83f6fe7-f379-4d26-b467-b6d8eee9b69d">
 843 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b9ec3101-88dd-4b31-8554-cb58a661cf37">
 844 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 845 |           <remarks><p>Development, documentation, and dissemination of a physical
 846 | and environmental protection policy reflects organizational
 847 | procedure/policy and is not applicable to component-level
 848 | configuration.
 849 | </p></remarks>
 850 |         </by-component>
 851 |       </statement>
 852 |       <statement statement-id="pe-1_stmt.b" uuid="da7d9481-1921-47cd-a889-16afb00309d7">
 853 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="e2f86c0a-2a8a-4fb1-bba7-bcb67201d575">
 854 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 855 |           <remarks><p>Organizational review and updates to the physical and
 856 | environmental protection policy reflects organizational
 857 | procedure/policy and is not applicable to component-level
 858 | configuration.
 859 | </p></remarks>
 860 |         </by-component>
 861 |       </statement>
 862 |     </implemented-requirement>
 863 |     <implemented-requirement uuid="7ec32282-917b-4e33-9f1b-1cc83c5f2126" control-id="pe-2">
 864 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 865 |       <statement statement-id="pe-2_stmt.a" uuid="b5066467-2113-4017-8031-35011f19a450">
 866 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="038e04b3-3dbe-4b39-92c2-c785877f4bcd">
 867 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 868 |           <remarks><p>Development, approval, and maintenance of a list
 869 | of individuals with authorized access to the facility
 870 | where the information system resides reflects organizational
 871 | procedure/policy and is not applicable to component-level
 872 | configuration.
 873 | </p></remarks>
 874 |         </by-component>
 875 |       </statement>
 876 |       <statement statement-id="pe-2_stmt.b" uuid="392ae166-9512-48e9-aa07-42183889708c">
 877 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="669f2834-4e92-4717-871b-ae33fdaeaaa1">
 878 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 879 |           <remarks><p>Issuing authorization credentials for facility access
 880 | reflects organizational procedure/policy and is not
 881 | applicable to component-level configuration.
 882 | </p></remarks>
 883 |         </by-component>
 884 |       </statement>
 885 |       <statement statement-id="pe-2_stmt.c" uuid="d5469cdc-724a-4322-9129-d5934c105c10">
 886 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="bfb7d2d8-d63a-49c4-b3fb-7ca6924e9d98">
 887 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 888 |           <remarks><p>Reviewing the access list detailing authorized facility
 889 | access by individuals at an organization-defined frequency
 890 | reflects organizational procedure/policy and is not
 891 | applicable to component-level configuration.
 892 | </p></remarks>
 893 |         </by-component>
 894 |       </statement>
 895 |       <statement statement-id="pe-2_stmt.d" uuid="a967db64-9e28-4b4e-b8c7-3f44a166c394">
 896 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="859bce49-462e-42c3-a22c-f485a8e44724">
 897 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 898 |           <remarks><p>Removal of individuals from the facility access list when access
 899 | is no longer required reflects organizational procedure/policy
 900 | and is not applicable to component-level configuration.
 901 | </p></remarks>
 902 |         </by-component>
 903 |       </statement>
 904 |     </implemented-requirement>
 905 |     <implemented-requirement uuid="042703fc-da12-4f5b-9c7a-6d0137e53335" control-id="pe-3">
 906 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 907 |       <statement statement-id="pe-3_stmt.a" uuid="5441c93a-ece5-4408-89a4-3016425351ad">
 908 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="d32678f5-5c72-4ec3-81f0-9d87d5406f5a">
 909 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 910 |           <remarks><p>Enforcing physical access authorizations at organization-defined
 911 | entry/exit points to the facility where the information system resides
 912 | reflects organizational procedure/policy and is not applicable to
 913 | component-level configuration.
 914 | </p></remarks>
 915 |         </by-component>
 916 |       </statement>
 917 |       <statement statement-id="pe-3_stmt.b" uuid="ff052ff3-128f-4899-bd0b-2ab818502631">
 918 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="6fa063ec-7fbd-43c2-b09c-7d1a0f27e663">
 919 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 920 |           <remarks><p>Maintaining physical access audit logs for organization-defined
 921 | entry/exit points reflects organizational procedure/policy and
 922 | is not applicable to component-level configuration.
 923 | </p></remarks>
 924 |         </by-component>
 925 |       </statement>
 926 |       <statement statement-id="pe-3_stmt.c" uuid="6d431649-93fd-40ed-82a5-a10123b36d13">
 927 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="ab51d315-44ab-420d-a34a-fe28a1bb5d8d">
 928 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 929 |           <remarks><p>Providing organization-defined security safeguards to control access
 930 | to areas within the facility officially designated as publicly
 931 | accessible reflects organizational procedure/policy and
 932 | is not applicable to component-level configuration.
 933 | </p></remarks>
 934 |         </by-component>
 935 |       </statement>
 936 |       <statement statement-id="pe-3_stmt.d" uuid="73ada1b1-2cb7-4e33-92b5-d49db0460f18">
 937 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="89f5db7a-50c1-41a4-bd2f-b0515b74cd9d">
 938 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 939 |           <remarks><p>Escorting visitors and monitoring visitor activity during
 940 | organization-defined circumstances requiring visitor escorts
 941 | and monitoring reflects organizational procedure/policy and
 942 | is not applicable to component-level configuration.
 943 | </p></remarks>
 944 |         </by-component>
 945 |       </statement>
 946 |       <statement statement-id="pe-3_stmt.e" uuid="cf7ec606-b6be-4f32-87a2-b69aacb9c9b8">
 947 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="49afbd68-3163-4721-b4a1-6da04653789f">
 948 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 949 |           <remarks><p>Securing keys, combinations, and other physical access devices
 950 | reflects organizational procedure/policy and
 951 | is not applicable to component-level configuration.
 952 | </p></remarks>
 953 |         </by-component>
 954 |       </statement>
 955 |       <statement statement-id="pe-3_stmt.f" uuid="ac8fc9a1-95dd-4d7c-b1c2-7e8aba4d5be6">
 956 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="0938121d-1df5-4128-b99d-0c772958da88">
 957 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 958 |           <remarks><p>Inventory of organization-defined physical access devices
 959 | at an organization-defined frequency reflects organizational
 960 | procedure/policy and is not applicable to component-level
 961 | configuration.
 962 | </p></remarks>
 963 |         </by-component>
 964 |       </statement>
 965 |       <statement statement-id="pe-3_stmt.g" uuid="38201073-f9fa-470b-be12-c08647c86ac2">
 966 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="12ae89c8-84dd-48ee-a198-3e89b569638f">
 967 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 968 |           <remarks><p>Changing combinations and keys at an organization-defined frequency
 969 | and/or when keys are lost, combinations are compromised, or individuals
 970 | are transferred or terminated, reflects organizational procedure/policy
 971 | and is not applicable to component-level configuration.
 972 | </p></remarks>
 973 |         </by-component>
 974 |       </statement>
 975 |     </implemented-requirement>
 976 |     <implemented-requirement uuid="dc8a7092-0aab-4dd5-a47a-e857656e5f0b" control-id="pe-6">
 977 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 978 |       <statement statement-id="pe-6_stmt.a" uuid="33cd6b74-63d4-460b-823f-b5f28b85efcd">
 979 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="d819c998-1e4d-48ac-b59d-ad2866825484">
 980 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 981 |           <remarks><p>Monitoring physical access to the facility where the information
 982 | system resides to detect and respond to physical security incidents
 983 | reflects organizational procedure/policy and is outside the scope
 984 | of component-level configuration.
 985 | </p></remarks>
 986 |         </by-component>
 987 |       </statement>
 988 |       <statement statement-id="pe-6_stmt.b" uuid="f3362c58-4214-4a7c-80a0-b105d2e1c71b">
 989 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="ce190ad7-f714-44fa-bfc0-8945d32c13e1">
 990 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 991 |           <remarks><p>Reviewing physical access logs at an organization-defined
 992 | frequency and upon occurence of organization-defined events
 993 | or potential indications of events, reflects organizational
 994 | procedure/policy and is not applicable to component-level
 995 | configuration.
 996 | </p></remarks>
 997 |         </by-component>
 998 |       </statement>
 999 |       <statement statement-id="pe-6_stmt.c" uuid="b92908ce-4745-4711-bcb3-6a5960563a2d">
1000 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="84fe10a0-60dc-47d9-90ba-d0f6f61bca15">
1001 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1002 |           <remarks><p>Coordinating results of reviews and investigations with
1003 | the organizational incident response capability reflects
1004 | organizational procedure/policy and is not applicable to
1005 | component-level configuration.
1006 | </p></remarks>
1007 |         </by-component>
1008 |       </statement>
1009 |     </implemented-requirement>
1010 |     <implemented-requirement uuid="e4329b69-a2bc-496f-aef9-60af3f2ba616" control-id="pe-8">
1011 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1012 |       <statement statement-id="pe-8_stmt.a" uuid="91b8d93b-c8fa-417c-ae8c-4951597fe883">
1013 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1014 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1015 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1016 | </p></remarks>
1017 |         </by-component>
1018 |       </statement>
1019 |       <statement statement-id="pe-8_stmt.b" uuid="02093793-e0dd-4d1a-949f-013f040ae8a0">
1020 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1021 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1022 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1023 | </p></remarks>
1024 |         </by-component>
1025 |       </statement>
1026 |     </implemented-requirement>
1027 |     <implemented-requirement uuid="11b8b7ee-c378-4425-b296-6f56eb703c76" control-id="pe-12">
1028 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1029 |       <statement statement-id="pe-12_stmt" uuid="4845a568-565f-40f8-976c-5c1d1f1eb9ef">
1030 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1031 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1032 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1033 | </p></remarks>
1034 |         </by-component>
1035 |       </statement>
1036 |     </implemented-requirement>
1037 |     <implemented-requirement uuid="6657211f-e3b9-43c5-9477-02767cef12b4" control-id="pe-13">
1038 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1039 |       <statement statement-id="pe-13_stmt" uuid="4c7ac6a7-5677-47f5-ad33-e8a4d982c01d">
1040 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1041 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1042 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1043 | </p></remarks>
1044 |         </by-component>
1045 |       </statement>
1046 |     </implemented-requirement>
1047 |     <implemented-requirement uuid="4bf3d533-2f44-44d2-9003-a104380b30e9" control-id="pe-14">
1048 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1049 |       <statement statement-id="pe-14_stmt.a" uuid="e2719a38-2d72-4d39-9c9f-344e9d3342b6">
1050 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1051 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1052 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1053 | </p></remarks>
1054 |         </by-component>
1055 |       </statement>
1056 |       <statement statement-id="pe-14_stmt.b" uuid="6b2d96a7-6a9d-4448-99d5-89a5443be73b">
1057 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1058 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1059 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1060 | </p></remarks>
1061 |         </by-component>
1062 |       </statement>
1063 |     </implemented-requirement>
1064 |     <implemented-requirement uuid="07a3be45-5937-4bfd-98b8-b8f9ea1b21a2" control-id="pe-15">
1065 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1066 |       <statement statement-id="pe-15_stmt" uuid="a6f71100-a32c-4b0b-bd03-ef3d792de1ad">
1067 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1068 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1069 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1070 | </p></remarks>
1071 |         </by-component>
1072 |       </statement>
1073 |     </implemented-requirement>
1074 |     <implemented-requirement uuid="e9fecabe-ac5c-4e3c-9e8b-dcd8923787f8" control-id="pe-16">
1075 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1076 |       <statement statement-id="pe-16_stmt" uuid="29136d47-d918-4593-8b2b-6516d3c01915">
1077 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1078 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1079 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1080 | </p></remarks>
1081 |         </by-component>
1082 |       </statement>
1083 |     </implemented-requirement>
1084 |     <implemented-requirement uuid="5a6a70cd-e241-4b52-bf70-dbb9f62a0c75" control-id="pl-1">
1085 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1086 |       <statement statement-id="pl-1_stmt.a" uuid="094d50b5-ebc2-442d-9031-7bc8a1196c57">
1087 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1088 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1089 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1090 | applicable to the configuration of Red Hat Enterprise Linux.
1091 | </p></remarks>
1092 |         </by-component>
1093 |       </statement>
1094 |       <statement statement-id="pl-1_stmt.b" uuid="8a288e6e-1641-49e0-acf5-684f40de5b21">
1095 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1096 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1097 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1098 | applicable to the configuration of Red Hat Enterprise Linux.
1099 | </p></remarks>
1100 |         </by-component>
1101 |       </statement>
1102 |     </implemented-requirement>
1103 |     <implemented-requirement uuid="567a49c4-0184-47f0-854f-4ef1fb836ae8" control-id="pl-2">
1104 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1105 |       <statement statement-id="pl-2_stmt.a" uuid="b0c294fd-f8da-43a1-91a5-5a8f1ce16aa8">
1106 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1107 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1108 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1109 | applicable to the configuration of Red Hat Enterprise Linux.
1110 | </p></remarks>
1111 |         </by-component>
1112 |       </statement>
1113 |       <statement statement-id="pl-2_stmt.b" uuid="0ae636b7-3308-4de6-985d-bee23fd586cc">
1114 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1115 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1116 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1117 | applicable to the configuration of Red Hat Enterprise Linux.
1118 | </p></remarks>
1119 |         </by-component>
1120 |       </statement>
1121 |       <statement statement-id="pl-2_stmt.c" uuid="d878723c-436f-4131-bcf9-a63cff332b30">
1122 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1123 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1124 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1125 | applicable to the configuration of Red Hat Enterprise Linux.
1126 | </p></remarks>
1127 |         </by-component>
1128 |       </statement>
1129 |       <statement statement-id="pl-2_stmt.d" uuid="b4235c44-8baf-4bda-8d26-1e2fd25a910d">
1130 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1131 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1132 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1133 | applicable to the configuration of Red Hat Enterprise Linux.
1134 | </p></remarks>
1135 |         </by-component>
1136 |       </statement>
1137 |       <statement statement-id="pl-2_stmt.e" uuid="0336a419-949e-41a7-9586-7844675ee2a5">
1138 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1139 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1140 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1141 | applicable to the configuration of Red Hat Enterprise Linux.
1142 | </p></remarks>
1143 |         </by-component>
1144 |       </statement>
1145 |     </implemented-requirement>
1146 |     <implemented-requirement uuid="aa60b190-b436-428f-82d3-5e609134ce39" control-id="pl-4">
1147 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1148 |       <statement statement-id="pl-4_stmt.a" uuid="42ef50ea-2c10-46a2-9bdc-76d8adf7560c">
1149 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1150 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1151 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1152 | applicable to the configuration of Red Hat Enterprise Linux.
1153 | </p></remarks>
1154 |         </by-component>
1155 |       </statement>
1156 |       <statement statement-id="pl-4_stmt.b" uuid="c46e6105-5a63-49db-bf1f-73b389843af6">
1157 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1158 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1159 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1160 | applicable to the configuration of Red Hat Enterprise Linux.
1161 | </p></remarks>
1162 |         </by-component>
1163 |       </statement>
1164 |       <statement statement-id="pl-4_stmt.c" uuid="2f333acf-78a0-4ff4-b462-cff0758b291b">
1165 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1166 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1167 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1168 | applicable to the configuration of Red Hat Enterprise Linux.
1169 | </p></remarks>
1170 |         </by-component>
1171 |       </statement>
1172 |       <statement statement-id="pl-4_stmt.d" uuid="4f93d123-f0b7-41ec-8ad8-3b8862704db2">
1173 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1174 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1175 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1176 | applicable to the configuration of Red Hat Enterprise Linux.
1177 | </p></remarks>
1178 |         </by-component>
1179 |       </statement>
1180 |     </implemented-requirement>
1181 |     <implemented-requirement uuid="c988b60d-465a-4ff5-b48a-725e3a78d86a" control-id="ps-1">
1182 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1183 |       <statement statement-id="ps-1_stmt.a" uuid="0d51f17d-3553-4efc-8ffd-225ef6ca9909">
1184 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1185 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1186 |           <remarks><p>Organizational development, documentation, and dissemination of
1187 | a personnel security policy to organization-defined personnel
1188 | is outside the scope of Red Hat Enterprise Linux configuration.
1189 | </p></remarks>
1190 |         </by-component>
1191 |       </statement>
1192 |       <statement statement-id="ps-1_stmt.a.1" uuid="0aa5b922-5a46-4e23-a13b-3c3dc4d2394e">
1193 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1194 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1195 |           <remarks><p>Organizational development, documentation, and dissemination of
1196 | a personnel security policy to organization-defined personnel
1197 | is outside the scope of Red Hat Enterprise Linux configuration.
1198 | </p></remarks>
1199 |         </by-component>
1200 |       </statement>
1201 |       <statement statement-id="ps-1_stmt.a.2" uuid="c46c9f16-3014-47ad-bcf4-7fe5b7f7eef3">
1202 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1203 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1204 |           <remarks><p>Organizational development, documentation, and dissemination of
1205 | a personnel security policy to organization-defined personnel
1206 | is outside the scope of Red Hat Enterprise Linux configuration.
1207 | </p></remarks>
1208 |         </by-component>
1209 |       </statement>
1210 |       <statement statement-id="ps-1_stmt.b" uuid="3b162d5f-320a-4980-96a4-827861f26603">
1211 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8e1a01d7-b935-4923-a72b-5fdab355ca76">
1212 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1213 |           <remarks><p>Organizational reviews and updates to the personnel security policy
1214 | and personnel security procedures at an organization-defined frequency
1215 | is outside the scope of Red Hat Enterprise Linux configuration.
1216 | </p></remarks>
1217 |         </by-component>
1218 |       </statement>
1219 |       <statement statement-id="ps-1_stmt.b.1" uuid="40256f60-3c90-424b-8d79-8a8be97a6d02">
1220 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1221 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1222 |           <remarks><p>Organizational development, documentation, and dissemination of
1223 | a personnel security policy to organization-defined personnel
1224 | is outside the scope of Red Hat Enterprise Linux configuration.
1225 | </p></remarks>
1226 |         </by-component>
1227 |       </statement>
1228 |       <statement statement-id="ps-1_stmt.b.2" uuid="390198da-0711-49ba-ba04-7e623e2f872f">
1229 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1230 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1231 |           <remarks><p>Organizational development, documentation, and dissemination of
1232 | a personnel security policy to organization-defined personnel
1233 | is outside the scope of Red Hat Enterprise Linux configuration.
1234 | </p></remarks>
1235 |         </by-component>
1236 |       </statement>
1237 |     </implemented-requirement>
1238 |     <implemented-requirement uuid="4013a119-4669-4462-b32c-a13a61913347" control-id="ps-2">
1239 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1240 |       <statement statement-id="ps-2_stmt.a" uuid="1388f2d8-ae86-4819-97e2-5768ca9dc4b7">
1241 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="a1f82811-f626-4ecb-9987-0e5c056a792f">
1242 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1243 |           <remarks><p>Organizational assignment of a risk designation to all organizational
1244 | positions is outside the scope of Red Hat Enterprise Linux configuration.
1245 | </p></remarks>
1246 |         </by-component>
1247 |       </statement>
1248 |       <statement statement-id="ps-2_stmt.b" uuid="277a1997-199e-4df9-9aff-3a28c98b2569">
1249 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="76dc6db9-0389-4e6b-b889-0cfc81206704">
1250 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1251 |           <remarks><p>Organizational establishment of screening criteria for individuals
1252 | filling those positions is outside the scope of Red Hat Enterprise Linux
1253 | configuration.
1254 | </p></remarks>
1255 |         </by-component>
1256 |       </statement>
1257 |       <statement statement-id="ps-2_stmt.c" uuid="421af13e-3066-4d91-89e9-3327af5f2d90">
1258 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="2e37e2c3-8e83-48a9-a8f0-3e10cbda33b0">
1259 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1260 |           <remarks><p>Organizational review and updating of position risk
1261 | designations at an organization-defined frequency is outside the scope
1262 | of Red Hat Enterprise Linux configuration.
1263 | </p></remarks>
1264 |         </by-component>
1265 |       </statement>
1266 |     </implemented-requirement>
1267 |     <implemented-requirement uuid="f7be1dbd-86aa-41f8-b1d0-67ff78c56022" control-id="ps-3">
1268 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1269 |       <statement statement-id="ps-3_stmt.a" uuid="4b0f8c16-3670-44f5-9304-3dfbb1e47801">
1270 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f5ce677b-00ef-4acd-a893-6a1108779fe0">
1271 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1272 |           <remarks><p>Organizational screening of individuals prior to authorizing access
1273 | to the information system is outside the scope of Red Hat Enterprise Linux
1274 | configuration.
1275 | </p></remarks>
1276 |         </by-component>
1277 |       </statement>
1278 |       <statement statement-id="ps-3_stmt.b" uuid="94fdd023-e571-45e2-96ea-e752c9f6f201">
1279 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="e4e0488e-a97a-4a7d-b05d-a628a196dcf4">
1280 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1281 |           <remarks><p>Organizational processes to rescreen individuals according to
1282 | organization-defined conditions requiring rescreening and,
1283 | where rescreening is so indicated, the frequency of such
1284 | rescreening, is outside the scope of Red Hat Enterprise Linux
1285 | configuration.
1286 | </p></remarks>
1287 |         </by-component>
1288 |       </statement>
1289 |     </implemented-requirement>
1290 |     <implemented-requirement uuid="b4b68dad-4698-4307-b5d5-368927e4ca81" control-id="ps-4">
1291 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1292 |       <statement statement-id="ps-4_stmt.a" uuid="e713072c-cd4d-4957-8a6a-89312c814a72">
1293 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="4131e0d9-2ae1-439c-9390-594d5fe724b4">
1294 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1295 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1296 | employment, information system access is disabled within an
1297 | organization-defined time period, are outside the scope of
1298 | Red Hat Enterprise Linux configuration.
1299 | </p></remarks>
1300 |         </by-component>
1301 |       </statement>
1302 |       <statement statement-id="ps-4_stmt.b" uuid="82bbc369-291d-41ad-8142-adf503f51a3b">
1303 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="855c02d1-a80b-4fe4-9e88-b9f1541c7966">
1304 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1305 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1306 | employment, any authenticators/credentials associated with the individual
1307 | are terminated/revoked, are outside the scope of
1308 | Red Hat Enterprise Linux configuration.
1309 | </p></remarks>
1310 |         </by-component>
1311 |       </statement>
1312 |       <statement statement-id="ps-4_stmt.c" uuid="89d535f9-c9da-406c-89e0-4a5fdf524ef0">
1313 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="6fe3d101-0b7e-4306-8a60-a83386d2902b">
1314 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1315 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1316 | employment, exit interviews are conducted that include a discussion of
1317 | organization-defined information security topics, are outside the scope
1318 | of Red Hat Enterprise Linux configuration.
1319 | </p></remarks>
1320 |         </by-component>
1321 |       </statement>
1322 |       <statement statement-id="ps-4_stmt.d" uuid="e84edbfc-357a-4010-a60d-3d3a9101fb6a">
1323 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="e2fcf347-7359-4cb0-9b78-4495cb51f9fe">
1324 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1325 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1326 | employment, all security-related organizational information
1327 | system-related property is retrieved, are outside the scope
1328 | of Red Hat Enterprise Linux configuration.
1329 | </p></remarks>
1330 |         </by-component>
1331 |       </statement>
1332 |       <statement statement-id="ps-4_stmt.e" uuid="3e3d11bc-4f79-45e6-a8c8-5027ae4fa3cf">
1333 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="09c8db57-2a8e-432e-bfcf-7751092dc5cf">
1334 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1335 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1336 | employment, the organization retains access to organizational
1337 | information systems formerly controlled by the terminated individual,
1338 | are outside the scope of Red Hat Enterprise Linux configuration.
1339 | </p></remarks>
1340 |         </by-component>
1341 |       </statement>
1342 |       <statement statement-id="ps-4_stmt.f" uuid="1dced8bb-23f9-4853-9127-e579658554b6">
1343 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="a0416027-169d-43e4-816d-a7d11f28ab5c">
1344 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1345 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1346 | employment, the organization notifies organization-defined personnel
1347 | or roles within an organization-defined time period, are outside
1348 | the scope of Red Hat Enterprise Linux configuration.
1349 | </p></remarks>
1350 |         </by-component>
1351 |       </statement>
1352 |     </implemented-requirement>
1353 |     <implemented-requirement uuid="c13693a6-8717-4c41-b9a5-4f30ce6f8101" control-id="ps-5">
1354 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1355 |       <statement statement-id="ps-5_stmt.a" uuid="e1489dc0-a117-42be-b778-82b7750998cd">
1356 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="479491e8-8dea-4f0e-b7d3-ffd22903d2b4">
1357 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1358 |           <remarks><p>Organizational processes to review and confirm ongoing operational
1359 | need for current logical and physical access authorizations to
1360 | information systems/facilities when individuals are reassigned or
1361 | transferred to other positions within the organization are
1362 | outside the scope of Red Hat Enterprise Linux configuration.
1363 | </p></remarks>
1364 |         </by-component>
1365 |       </statement>
1366 |       <statement statement-id="ps-5_stmt.b" uuid="4a9feaa8-de4f-4163-ade4-79cc444243ab">
1367 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="4f79abd4-01cc-4a13-9688-27c5d024bfcb">
1368 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1369 |           <remarks><p>Organizational processes to initiate organization-defined transfer
1370 | or reassignment actions within organization-defined time period
1371 | following the formal transfer action are outside the scope of
1372 | Red Hat Enterprise Linux configuration.
1373 | </p></remarks>
1374 |         </by-component>
1375 |       </statement>
1376 |       <statement statement-id="ps-5_stmt.c" uuid="dc70a4f1-e6f7-413e-b681-a8c1bc3c046e">
1377 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="0e9e3993-12c2-4701-b54f-a4840a0c6bd7">
1378 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1379 |           <remarks><p>Organizational processes to modify access authorizations as needed to
1380 | correspond with any changes in oeprational need due to reassignment
1381 | or transfer are outside the scope of Red Hat Enterprise Linux configuration.
1382 | </p></remarks>
1383 |         </by-component>
1384 |       </statement>
1385 |       <statement statement-id="ps-5_stmt.d" uuid="1db9f2d5-379b-4c98-a6e4-00940b0e110f">
1386 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="5065e649-c75c-4114-b472-32d24cbfad15">
1387 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1388 |           <remarks><p>Organizational notifications of organization-defined personnel
1389 | or roles within an organization-defined time period are outside
1390 | the scope of Red Hat Enterprise Linux configuration.
1391 | </p></remarks>
1392 |         </by-component>
1393 |       </statement>
1394 |     </implemented-requirement>
1395 |     <implemented-requirement uuid="170cfb24-bb93-4702-90d1-8d17b5c354fd" control-id="ps-6">
1396 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1397 |       <statement statement-id="ps-6_stmt.a" uuid="2d92b85d-052e-41e8-a286-e555d06de10f">
1398 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="21e5d497-9123-4f23-8057-62ef9c31ccbd">
1399 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1400 |           <remarks><p>Organizational process to develop and document access agreements for
1401 | organizational information systems are outside the scope of
1402 | Red Hat Enterprise Linux configuration.
1403 | </p></remarks>
1404 |         </by-component>
1405 |       </statement>
1406 |       <statement statement-id="ps-6_stmt.b" uuid="4f3ef13a-e090-4d16-8b0c-9e889bae67db">
1407 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="adb9b134-e07a-4289-b7d5-9b540c238761">
1408 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1409 |           <remarks><p>Organizational reviews and updates to the access agreements at an
1410 | organization-defined frequency are outside the scope of
1411 | Red Hat Enterprise Linux configuration.
1412 | </p></remarks>
1413 |         </by-component>
1414 |       </statement>
1415 |       <statement statement-id="ps-6_stmt.c" uuid="32edf3e6-203c-4450-83ff-cf925412a8ac">
1416 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b16478ac-2be8-4826-a331-d89f1f9c817e">
1417 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1418 |           <remarks><p>Organizational processes that ensure individuals requiring access to
1419 | organizational information and information systems sign and re-sign
1420 | access agreements are outside the scope of Red Hat Enterprise Linux configuration.
1421 | </p></remarks>
1422 |         </by-component>
1423 |       </statement>
1424 |       <statement statement-id="ps-6_stmt.c.1" uuid="0ec17fd5-01a5-418d-88b7-f844e61ca31b">
1425 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b16478ac-2be8-4826-a331-d89f1f9c817e">
1426 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1427 |           <remarks><p>Organizational processes that ensure individuals requiring access to
1428 | organizational information and information systems sign and re-sign
1429 | access agreements are outside the scope of Red Hat Enterprise Linux configuration.
1430 | </p></remarks>
1431 |         </by-component>
1432 |       </statement>
1433 |       <statement statement-id="ps-6_stmt.c.2" uuid="085ff1ac-a28c-4d4d-ac7c-a9458cceb105">
1434 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b16478ac-2be8-4826-a331-d89f1f9c817e">
1435 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1436 |           <remarks><p>Organizational processes that ensure individuals requiring access to
1437 | organizational information and information systems sign and re-sign
1438 | access agreements are outside the scope of Red Hat Enterprise Linux configuration.
1439 | </p></remarks>
1440 |         </by-component>
1441 |       </statement>
1442 |     </implemented-requirement>
1443 |     <implemented-requirement uuid="71d0c115-792b-462a-a349-f36740aa5544" control-id="ps-7">
1444 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1445 |       <statement statement-id="ps-7_stmt.a" uuid="0adf029f-4aec-4849-a44d-24e76dd274e1">
1446 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="5a6b68a7-216e-4f2d-a7d6-017baa605b65">
1447 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1448 |           <remarks><p>Organizational processes to establish security requirements including
1449 | security roles and responsibilities for third-party providers are
1450 | outside the scope of Red Hat Enterprise Linux configuration.
1451 | </p></remarks>
1452 |         </by-component>
1453 |       </statement>
1454 |       <statement statement-id="ps-7_stmt.b" uuid="d7de56d7-ee30-475c-99c9-c76655387b24">
1455 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="72edc7fa-1400-43a6-a419-b63392aa46b5">
1456 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1457 |           <remarks><p>Organizational processes requiring third-party providers to comply
1458 | with personnel security polocies and procedures established by
1459 | the organization are outside the scope of Red Hat Enterprise Linux configuration.
1460 | </p></remarks>
1461 |         </by-component>
1462 |       </statement>
1463 |       <statement statement-id="ps-7_stmt.c" uuid="c93764f1-b0bd-4889-bd27-cb577fb9109c">
1464 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="71831662-dfd7-442f-8e95-0142f1d3c5c4">
1465 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1466 |           <remarks><p>Organizational processes to document presonnel security requirements
1467 | are outside the scope of Red Hat Enterprise Linux configuration.
1468 | </p></remarks>
1469 |         </by-component>
1470 |       </statement>
1471 |       <statement statement-id="ps-7_stmt.d" uuid="c6d320d9-3ce8-46fd-a00c-8963e666aee0">
1472 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="7757d8f6-0ae6-42b5-ae0f-9e3059c7efe9">
1473 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1474 |           <remarks><p>Organizational processes to require third-party providers to notify
1475 | organization-defined personnel or roles of any personnel transfers or
1476 | terminations of third-party personnel who possess organizational
1477 | credentials and/or badges, or who have information system privileges
1478 | within an organization-defined time period, are outside the
1479 | scope of Red Hat Enterprise Linux configuration.
1480 | </p></remarks>
1481 |         </by-component>
1482 |       </statement>
1483 |       <statement statement-id="ps-7_stmt.e" uuid="85911840-5a9f-4809-8966-3b61e611f684">
1484 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="9c5a474a-0081-488e-8770-80e2de25b009">
1485 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1486 |           <remarks><p>Organizational monitoring of provider compliance is outside
1487 | the scope of Red Hat Enterprise Linux configuration.
1488 | </p></remarks>
1489 |         </by-component>
1490 |       </statement>
1491 |     </implemented-requirement>
1492 |     <implemented-requirement uuid="7a65e74d-e2e7-493a-a7ba-b05985a49cb2" control-id="ps-8">
1493 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1494 |       <statement statement-id="ps-8_stmt.a" uuid="53be986d-9088-4b95-a7f2-9920267fa519">
1495 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="660bfa1c-231a-4b9c-9f2a-dbc99d75ef46">
1496 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1497 |           <remarks><p>Organizational employment of a formal sanctions process for individuals
1498 | failing to comply with established information security policies
1499 | and procedures is outside the scope of Red Hat Enterprise Linux configuration.
1500 | </p></remarks>
1501 |         </by-component>
1502 |       </statement>
1503 |       <statement statement-id="ps-8_stmt.b" uuid="65d1d313-0f08-45cb-a619-0c2f61acfa0b">
1504 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="4a62645f-0cd3-49e8-9156-210ee0518aac">
1505 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1506 |           <remarks><p>Organizational notification of organization-defined personnel
1507 | or roles within an organization-defined time period when a formal
1508 | employee santions process is initiated, identifying the individual
1509 | sanctioned and the reason for the sanction.
1510 | </p></remarks>
1511 |         </by-component>
1512 |       </statement>
1513 |     </implemented-requirement>
1514 |   </control-implementation>
1515 |   <back-matter>
1516 |     <resource uuid="3a5ca2de-0f66-47e6-844d-6ccdf214b767">
1517 |       <title>FedRAMP Applicable Laws and Regulations</title>
1518 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">fedramp-citations</prop>
1519 |       <rlink href="https://www.fedramp.gov/assets/resources/templates/SSP-A12-FedRAMP-Laws-and-Regulations-Template.xlsx"></rlink>
1520 |     </resource>
1521 |     <resource uuid="12da89ef-51dd-4404-948d-e9f0e25b961e">
1522 |       <title>FedRAMP Master Acronym and Glossary</title>
1523 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">fedramp-acronyms</prop>
1524 |       <rlink href="https://www.fedramp.gov/assets/resources/documents/FedRAMP_Master_Acronym_and_Glossary.pdf"></rlink>
1525 |     </resource>
1526 |     <resource uuid="d45612a9-cf25-4ef6-b2dd-69e38ba2967a">
1527 |       <title>[SAMPLE]Name or Title of Document</title>
1528 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">law</prop>
1529 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Publication Date</prop>
1530 |       <doc-id type="doi">Identification Number</doc-id>
1531 |       <rlink href="https://domain.example/path/to/document.pdf"></rlink>
1532 |     </resource>
1533 |     <resource uuid="a8a0cc81-800f-479f-93d3-8b8743d9b98d">
1534 |       <title>[SAMPLE]Privacy-Related Law Citation</title>
1535 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">law</prop>
1536 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">pii</prop>
1537 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Publication Date</prop>
1538 |       <doc-id type="doi">Identification Number</doc-id>
1539 |       <rlink href="https://domain.example/path/to/document.pdf"></rlink>
1540 |     </resource>
1541 |     <resource uuid="545e75c3-537f-48fe-9630-95337916d982">
1542 |       <title>[SAMPLE]Regulation Citation</title>
1543 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">regulation</prop>
1544 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Publication Date</prop>
1545 |       <doc-id type="doi">Identification Number</doc-id>
1546 |       <rlink href="https://domain.example/path/to/document.pdf"></rlink>
1547 |     </resource>
1548 |     <resource uuid="9d6cf2b4-8e88-4040-a33c-7bc206553a1a">
1549 |       <title>[SAMPLE]Interconnection Security Agreement Title</title>
1550 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1551 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1552 |     </resource>
1553 |     <resource uuid="31a46c4f-2959-4287-bc1c-67297d7da60b">
1554 |       <desc>CSP Logo</desc>
1555 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">prepared-for-logo</prop>
1556 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">csp-logo</prop>
1557 |       <rlink href="./logo.png" media-type="image/png"></rlink>
1558 |       <base64>00000000</base64>
1559 |     </resource>
1560 |     <resource uuid="c5866ad8-8ed7-49b4-844a-0276fa9f8f51">
1561 |       <desc>Preparer Logo</desc>
1562 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">prepared-by-logo</prop>
1563 |       <rlink href="./party-1-logo.png" media-type="image/png"></rlink>
1564 |       <base64>00000000</base64>
1565 |     </resource>
1566 |     <resource uuid="0846b6ef-cfa4-4bb3-8280-717f7e7b04d4">
1567 |       <desc>FedRAMP Logo</desc>
1568 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">fedramp-logo</prop>
1569 |       <rlink href="https://github.com/GSA/fedramp-automation/raw/master/assets/FedRAMP_LOGO.png"></rlink>
1570 |     </resource>
1571 |     <resource uuid="2c1747d6-874a-49a2-8488-2fd9735416bf">
1572 |       <desc>3PAO Logo</desc>
1573 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">3pao-logo</prop>
1574 |       <rlink href="./logo.png" media-type="image/png"></rlink>
1575 |       <base64>00000000</base64>
1576 |     </resource>
1577 |     <resource uuid="d2eb3c18-6754-4e3a-a933-03d289e3fad5">
1578 |       <desc>The primary authorization boundary diagram.</desc>
1579 |       <rlink href="./diagrams/boundary.png"></rlink>
1580 |       <base64>00000000</base64>
1581 |       <remarks>
1582 |             <p>Section 9.2, Figure 9-1 Authorization Boundary Diagram (graphic)</p>
1583 |             <p>This should be referenced in the
1584 |                system-characteristics/authorization-boundary/diagram/link/@href flag using a value
1585 |                of "#d2eb3c18-6754-4e3a-a933-03d289e3fad5"</p>
1586 |          </remarks>
1587 |     </resource>
1588 |     <resource uuid="61081e81-850b-43c1-bf43-1ecbddcb9e7f">
1589 |       <desc>The primary network diagram.</desc>
1590 |       <rlink href="./diagrams/network.png"></rlink>
1591 |       <base64>00000000</base64>
1592 |       <remarks>
1593 |             <p>Section 9.4, Figure 9-2 Network Diagram (graphic)</p>
1594 |             <p>This should be referenced in the
1595 |                system-characteristics/network-architecture/diagram/link/@href flag using a value
1596 |                of "#61081e81-850b-43c1-bf43-1ecbddcb9e7f"</p>
1597 |          </remarks>
1598 |     </resource>
1599 |     <resource uuid="ac5d7535-f3b8-45d3-bf3b-735c82c64547">
1600 |       <desc>The primary data flow diagram.</desc>
1601 |       <rlink href="./diagrams/dataflow.png"></rlink>
1602 |       <base64>00000000</base64>
1603 |       <remarks>
1604 |             <p>Section 10, Figure 10-1 Data Flow Diagram (graphic)</p>
1605 |             <p>This should be referenced in the
1606 |                system-characteristics/data-flow/diagram/link/@href flag using a value
1607 |                of "#ac5d7535-f3b8-45d3-bf3b-735c82c64547"</p>
1608 |          </remarks>
1609 |     </resource>
1610 |     <resource uuid="090ab379-2089-4830-b9fd-26d0729e22e9">
1611 |       <title>Policy Title</title>
1612 |       <desc>Policy document</desc>
1613 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">policy</prop>
1614 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1615 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1616 |       <rlink href="./sample_policy.pdf"></rlink>
1617 |       <base64>00000000</base64>
1618 |       <remarks>
1619 |             <p>Table 15-1 Attachments: Policy Attachment</p>
1620 |          </remarks>
1621 |     </resource>
1622 |     <resource uuid="ab300133-d749-4abb-b858-1cd6ffd8af9e">
1623 |       <title>Policy Title</title>
1624 |       <desc>Policy document</desc>
1625 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">policy</prop>
1626 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1627 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1628 |       <rlink href="./sample_policy.pdf"></rlink>
1629 |       <base64>00000000</base64>
1630 |       <remarks>
1631 |             <p>Table 15-1 Attachments: Policy Attachment</p>
1632 |          </remarks>
1633 |     </resource>
1634 |     <resource uuid="1002a58e-9e11-4aa6-9ab4-2bde52995952">
1635 |       <title>Procedure Title</title>
1636 |       <desc>Procedure document</desc>
1637 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">procedure</prop>
1638 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1639 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1640 |       <rlink href="./sample_procedure.pdf"></rlink>
1641 |       <base64>00000000</base64>
1642 |       <remarks>
1643 |             <p>Table 15-1 Attachments: Procedure Attachment</p>
1644 |          </remarks>
1645 |     </resource>
1646 |     <resource uuid="4bb1e2e5-261c-4b5c-b22c-e1627c2e8be6">
1647 |       <title>Procedure Title</title>
1648 |       <desc>Procedure document</desc>
1649 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">procedure</prop>
1650 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1651 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1652 |       <rlink href="./sample_procedure.pdf"></rlink>
1653 |       <base64>00000000</base64>
1654 |       <remarks>
1655 |             <p>Table 15-1 Attachments: Procedure Attachment</p>
1656 |          </remarks>
1657 |     </resource>
1658 |     <resource uuid="90a128ac-c850-48f6-8fff-a55692f80b41">
1659 |       <title>User's Guide</title>
1660 |       <desc>User&#39;s Guide</desc>
1661 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">user-guide</prop>
1662 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">guide</prop>
1663 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1664 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1665 |       <rlink href="./sample_guide.pdf"></rlink>
1666 |       <base64>00000000</base64>
1667 |       <remarks>
1668 |             <p>Table 15-1 Attachments: User's Guide Attachment</p>
1669 |          </remarks>
1670 |     </resource>
1671 |     <resource uuid="fab59751-b855-40cb-93c1-492562e20e18">
1672 |       <title>Privacy Impact Assessment</title>
1673 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">privacy-impact-assessment</prop>
1674 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1675 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1676 |       <rlink href="./pia.docx"></rlink>
1677 |       <base64 filename="pia.docx">00000000</base64>
1678 |       <remarks>
1679 |             <p>Table 15-1 Attachments: Privacy Impact Assessment</p>
1680 |          </remarks>
1681 |     </resource>
1682 |     <resource uuid="489112e1-57f2-4c29-8dd0-95b1442fbf3b">
1683 |       <title>Document Title</title>
1684 |       <desc>Rules of Behavior</desc>
1685 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">rules-of-behavior</prop>
1686 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">rob</prop>
1687 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1688 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1689 |       <rlink href="https://sample"></rlink>
1690 |       <base64>00000000</base64>
1691 |       <remarks>
1692 |             <p>Table 15-1 Attachments: Rules of Behavior (ROB)</p>
1693 |          </remarks>
1694 |     </resource>
1695 |     <resource uuid="c7860916-f2f4-43aa-b578-d48cf8e6d381">
1696 |       <title>Document Title</title>
1697 |       <desc>Contingency Plan (CP)</desc>
1698 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">plan</prop>
1699 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1700 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1701 |       <rlink href="https://sample"></rlink>
1702 |       <base64>00000000</base64>
1703 |       <remarks>
1704 |             <p>Table 15-1 Attachments: Contingency Plan (CP) Attachment</p>
1705 |          </remarks>
1706 |     </resource>
1707 |     <resource uuid="ab56cf27-0dae-40d6-89b7-d750137309af">
1708 |       <title>Document Title</title>
1709 |       <desc>Configuration Management (CM) Plan</desc>
1710 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">plan</prop>
1711 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1712 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1713 |       <rlink href="https://sample"></rlink>
1714 |       <base64>00000000</base64>
1715 |       <remarks>
1716 |             <p>Table 15-1 Attachments: Configuration Management (CM) Plan Attachment</p>
1717 |          </remarks>
1718 |     </resource>
1719 |     <resource uuid="3f771ab5-8016-4571-98d1-f0fb962e15e2">
1720 |       <title>Document Title</title>
1721 |       <desc>Incident Response (IR) Plan</desc>
1722 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">plan</prop>
1723 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1724 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1725 |       <rlink href="https://sample"></rlink>
1726 |       <base64>00000000</base64>
1727 |       <remarks>
1728 |             <p>Table 15-1 Attachments: Incident Response (IR) Plan Attachment</p>
1729 |          </remarks>
1730 |     </resource>
1731 |     <resource uuid="49fb4631-1da2-41ca-b0b3-e1b1006d4025">
1732 |       <title>Separation of Duties Matrix</title>
1733 |       <desc>Separation of Duties Matrix</desc>
1734 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1735 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1736 |       <rlink href="https://sample"></rlink>
1737 |       <base64>00000000</base64>
1738 |       <remarks>
1739 |             <p>Table 15-1 Attachments: Separation of Duties Matrix Attachment</p>
1740 |          </remarks>
1741 |     </resource>
1742 |     <resource uuid="9f1aae37-7359-411f-86c1-768aaab85e63">
1743 |       <title>FedRAMP High Baseline</title>
1744 |       <rlink href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.0-milestone3/content/fedramp.gov/xml/FedRAMP_HIGH-baseline_profile.xml" media-type="application/xml"></rlink>
1745 |       <remarks>
1746 |             <p>Pointer to High baseline content in OSCAL.</p>
1747 |          </remarks>
1748 |     </resource>
1749 |     <resource uuid="890170c3-d4fa-4d25-ab96-8e4bf7cc237c">
1750 |       <title>FedRAMP Moderate Baseline</title>
1751 |       <rlink href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.0-milestone3/content/fedramp.gov/xml/FedRAMP_MODERATE-baseline_profile.xml" media-type="application/xml"></rlink>
1752 |       <remarks>
1753 |             <p>Pointer to Moderate baseline content in OSCAL.</p>
1754 |          </remarks>
1755 |     </resource>
1756 |     <resource uuid="2acaf846-5496-4d36-8565-9a15b48aef2c">
1757 |       <title>FedRAMP Low Baseline</title>
1758 |       <rlink href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.0-milestone3/content/fedramp.gov/xml/FedRAMP_LOW-baseline_profile.xml" media-type="application/xml"></rlink>
1759 |       <remarks>
1760 |             <p>Pointer to Low baseline content in OSCAL.</p>
1761 |          </remarks>
1762 |     </resource>
1763 |   </back-matter>
1764 | </system-security-plan>


--------------------------------------------------------------------------------
/xml/rhel-8-fedramp-Low.xml:
--------------------------------------------------------------------------------
   1 | <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="373329de-fe84-4ae6-9e10-60e1cbeddf44">
   2 |   <metadata>
   3 |     <title></title>
   4 |     <published>2020-07-01T00:00:00.00-04:00</published>
   5 |     <last-modified>2023-03-02T01:19:03.51+00:00</last-modified>
   6 |     <version>0.0.1</version>
   7 |     <oscal-version>1.0.0-milestone3</oscal-version>
   8 |     <revision-history>
   9 |       <revision>
  10 |         <published>2019-06-01T00:00:00.00-04:00</published>
  11 |         <version>1.0</version>
  12 |         <oscal-version>1.0-Milestone3</oscal-version>
  13 |         <prop name="party-uuid" ns="https://fedramp.gov/ns/oscal">6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</prop>
  14 |         <remarks>
  15 |                <p>Initial publication.</p>
  16 |             </remarks>
  17 |       </revision>
  18 |       <revision>
  19 |         <published>2020-06-01T00:00:00.00-04:00</published>
  20 |         <version>2.0</version>
  21 |         <oscal-version>1.0-Milestone3</oscal-version>
  22 |         <prop name="party-id" ns="https://fedramp.gov/ns/oscal">csp</prop>
  23 |         <remarks>
  24 |                <p>Updated for annual assessment.</p>
  25 |             </remarks>
  26 |       </revision>
  27 |     </revision-history>
  28 |     <prop name="marking">Controlled Unclassified Information</prop>
  29 |     <role id="prepared-by">
  30 |       <title>Prepared By</title>
  31 |       <desc>The organization that prepared this SSP. If developed in-house, this is the CSP itself.</desc>
  32 |     </role>
  33 |     <role id="prepared-for">
  34 |       <title>Prepared For</title>
  35 |       <desc>The organization for which this SSP was prepared. Typically the CSP.</desc>
  36 |     </role>
  37 |     <role id="content-approver">
  38 |       <title>System Security Plan Approval</title>
  39 |       <desc>The individual or individuals accountable for the accuracy of this SSP.</desc>
  40 |     </role>
  41 |     <role id="cloud-service-provider">
  42 |       <title>Cloud Service Provider</title>
  43 |       <short-name>CSP</short-name>
  44 |     </role>
  45 |     <role id="system-owner">
  46 |       <title>Information System Owner</title>
  47 |       <desc>The individual within the CSP who is ultimately accountable for everything related to this system.</desc>
  48 |     </role>
  49 |     <role id="authorizing-official">
  50 |       <title>Authorizing Official</title>
  51 |       <desc>The individual or individuals who must grant this system an authorization to operate.</desc>
  52 |     </role>
  53 |     <role id="authorizing-official-poc">
  54 |       <title>Authorizing Official's Point of Contact</title>
  55 |       <desc>The individual representing the authorizing official.</desc>
  56 |     </role>
  57 |     <role id="system-poc-management">
  58 |       <title>Information System Management Point of Contact (POC)</title>
  59 |       <desc>The highest level manager who responsible for system operation on behalf of the System Owner.</desc>
  60 |     </role>
  61 |     <role id="system-poc-technical">
  62 |       <title>Information System Technical Point of Contact</title>
  63 |       <desc>The individual or individuals leading the technical operation of the system.</desc>
  64 |     </role>
  65 |     <role id="system-poc-other">
  66 |       <title>General Point of Contact (POC)</title>
  67 |       <desc>A general point of contact for the system, designated by the system owner.</desc>
  68 |     </role>
  69 |     <role id="information-system-security-officer">
  70 |       <title>System Information System Security Officer (or Equivalent)</title>
  71 |       <desc>The individual accountable for the security posture of the system on behalf of the system owner.</desc>
  72 |     </role>
  73 |     <role id="privacy-poc">
  74 |       <title>Privacy Official's Point of Contact</title>
  75 |       <desc>The individual responsible for the privacy threshold analysis and if necessary the privacy impact assessment.</desc>
  76 |     </role>
  77 |     <role id="asset-owner">
  78 |       <title>Owner of an inventory item within the system.</title>
  79 |     </role>
  80 |     <role id="asset-administrator">
  81 |       <title>Administrative responsibility an inventory item within the system.</title>
  82 |     </role>
  83 |     <role id="isa-poc-local">
  84 |       <title>ICA POC (Local)</title>
  85 |       <desc>The point of contact for an interconnection on behalf of this system.</desc>
  86 |       <remarks>
  87 |             <p>Remove this role if there are no ICAs.</p>
  88 |          </remarks>
  89 |     </role>
  90 |     <role id="isa-poc-remote">
  91 |       <title>ICA POC (Remote)</title>
  92 |       <desc>The point of contact for an interconnection on behalf of this external system to which this system connects.</desc>
  93 |       <remarks>
  94 |             <p>Remove this role if there are no ICAs.</p>
  95 |          </remarks>
  96 |     </role>
  97 |     <role id="isa-authorizing-official-local">
  98 |       <title>ICA Signatory (Local)</title>
  99 |       <desc>Responsible for signing an interconnection security agreement on behalf of this system.</desc>
 100 |       <remarks>
 101 |             <p>Remove this role if there are no ICAs.</p>
 102 |          </remarks>
 103 |     </role>
 104 |     <role id="isa-authorizing-official-remote">
 105 |       <title>ICA Signatory (Remote)</title>
 106 |       <desc>Responsible for signing an interconnection security agreement on behalf of the external system to which this system connects.</desc>
 107 |       <remarks>
 108 |             <p>Remove this role if there are no ICAs.</p>
 109 |          </remarks>
 110 |     </role>
 111 |     <role id="consultant">
 112 |       <title>Consultant</title>
 113 |       <desc>Any consultants involved with developing or maintaining this content.</desc>
 114 |     </role>
 115 |     <role id="admin-unix">
 116 |       <title>[SAMPLE]Unix Administrator</title>
 117 |       <desc>This is a sample role.</desc>
 118 |     </role>
 119 |     <role id="admin-client">
 120 |       <title>[SAMPLE]Client Administrator</title>
 121 |       <desc>This is a sample role.</desc>
 122 |     </role>
 123 |     <role id="program-director">
 124 |       <title>[SAMPLE]Program Director</title>
 125 |       <desc>This is a sample role.</desc>
 126 |     </role>
 127 |     <role id="fedramp-pmo">
 128 |       <title>Federal Risk and Authorization Management Program (FedRAMP) Program Management Office (PMO)</title>
 129 |       <short-name>FedRAMP PMO</short-name>
 130 |     </role>
 131 |     <role id="fedramp-jab">
 132 |       <title>Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB)</title>
 133 |       <short-name>FedRAMP JAB</short-name>
 134 |     </role>
 135 |     <location uuid="27b78960-59ef-4619-82b0-ae20b9c709ac">
 136 |       <title>CSP HQ</title>
 137 |       <address type="work">
 138 |         <addr-line>Suite 0000</addr-line>
 139 |         <addr-line>1234 Some Street</addr-line>
 140 |         <city>Haven</city>
 141 |         <state>ME</state>
 142 |         <postal-code>00000</postal-code>
 143 |       </address>
 144 |       <remarks>
 145 |             <p>There must be one location identifying the CSP's primary business address, such as the CSP's HQ, or the address of the system owner's primary business location.</p>
 146 |          </remarks>
 147 |     </location>
 148 |     <location uuid="16adcc8d-65d8-4583-80d3-9cf007744fec">
 149 |       <title>Primary Data Center</title>
 150 |       <address>
 151 |         <addr-line>2222 Main Street</addr-line>
 152 |         <city>Anywhere</city>
 153 |         <state>--</state>
 154 |         <postal-code>00000-0000</postal-code>
 155 |       </address>
 156 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">data-center</prop>
 157 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">primary-data-center</prop>
 158 |       <remarks>
 159 |             <p>There must be one location for each data center.</p>
 160 |             <p>There must be at least two data centers.</p>
 161 |             <p>For a data center, briefly summarize the components at this location.</p>
 162 |             <p>All data centers must have a conformity tag of "data-center".</p>
 163 |             <p>A primary data center must also have a conformity tag of "primary-data-center".</p>
 164 |          </remarks>
 165 |     </location>
 166 |     <location uuid="ad321514-7b9f-4374-8409-efb18eea6e5d">
 167 |       <title>Secondary Data Center</title>
 168 |       <address>
 169 |         <addr-line>3333 Small Road</addr-line>
 170 |         <city>Anywhere</city>
 171 |         <state>--</state>
 172 |         <postal-code>00000-0000</postal-code>
 173 |       </address>
 174 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">data-center</prop>
 175 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">alternate-data-center</prop>
 176 |       <remarks>
 177 |             <p>There must be one location for each data center.</p>
 178 |             <p>There must be at least two data centers.</p>
 179 |             <p>For a data center, briefly summarize the components at this location.</p>
 180 |             <p>All data centers must have a conformity tag of "data-center"</p>
 181 |             <p>An alternate or backup data center must also have a conformity tag of "alternate-data-center".</p>
 182 |          </remarks>
 183 |     </location>
 184 |     <party uuid="6b286b5d-8f07-4fa7-8847-1dd0d88f73fb" type="organization">
 185 |       <party-name>Cloud Service Provider (CSP) Name</party-name>
 186 |       <short-name>CSP Acronym/Short Name</short-name>
 187 |       <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
 188 |       <remarks>
 189 |             <p>Replace sample CSP information.</p>
 190 |          </remarks>
 191 |     </party>
 192 |     <party uuid="77e0e2c8-2560-4fe9-ac78-c3ff4ffc9f6d" type="organization">
 193 |       <party-name>Federal Risk and Authorization Management Program: Program Management Office</party-name>
 194 |       <short-name>FedRAMP PMO</short-name>
 195 |       <link href="https://fedramp.gov"></link>
 196 |       <address type="work">
 197 |         <addr-line>1800 F St. NW</addr-line>
 198 |         <city>Washington</city>
 199 |         <state>DC</state>
 200 |         <country>US</country>
 201 |       </address>
 202 |       <email>info@fedramp.gov</email>
 203 |       <remarks>
 204 |             <p>This party entry must be present in a FedRAMP SSP.</p>
 205 |             <p>The uuid may be different; however, the uuid must be associated with the "fedramp-pmo" role in the responsible-party assemblies.</p>
 206 |          </remarks>
 207 |     </party>
 208 |     <party uuid="49017ec3-9f51-4dbd-9253-858c2b1295fd" type="organization">
 209 |       <party-name>Federal Risk and Authorization Management Program: Joint Authorization Board</party-name>
 210 |       <short-name>FedRAMP JAB</short-name>
 211 |       <remarks>
 212 |             <p>This party entry must be present in a FedRAMP SSP.</p>
 213 |             <p>The uuid may be different; however, the uuid must be associated with the "fedramp-jab" role in the responsible-party assemblies.</p>
 214 |          </remarks>
 215 |     </party>
 216 |     <party uuid="78992555-4a99-4eaa-868c-f2c249679dd3" type="organization">
 217 |       <party-name>External Organization</party-name>
 218 |       <short-name>External</short-name>
 219 |       <remarks>
 220 |             <p>Generic placeholder for any external organization.</p>
 221 |          </remarks>
 222 |     </party>
 223 |     <party uuid="f595397b-cbe4-4a87-8c86-9bff91c4e7fd" type="organization">
 224 |       <party-name>Agency Name</party-name>
 225 |       <short-name>A.N.</short-name>
 226 |       <remarks>
 227 |             <p>Generic placeholder for an authorizing agency.</p>
 228 |          </remarks>
 229 |     </party>
 230 |     <party uuid="8e3d39da-4851-4d2a-adb5-4b5585ded952" type="organization">
 231 |       <party-name>Name of Consulting Org</party-name>
 232 |       <short-name>NOCO</short-name>
 233 |       <link href="https://consulting.sample"></link>
 234 |       <address type="work">
 235 |         <addr-line>3333 Corporate Way</addr-line>
 236 |         <city>Washington</city>
 237 |         <state>DC</state>
 238 |         <country>US</country>
 239 |       </address>
 240 |       <email>poc@consulting.sample</email>
 241 |     </party>
 242 |     <party uuid="80361ec4-bfce-4b5c-85c8-313d6ebd220b" type="organization">
 243 |       <party-name>[SAMPLE]Remote System Org Name</party-name>
 244 |     </party>
 245 |     <party uuid="09ad840f-aa79-43aa-9f22-25182c2ab11b" type="person">
 246 |       <party-name>[SAMPLE]ICA POC&#39;s Name</party-name>
 247 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 248 |       <email>person@ica.org.example</email>
 249 |       <phone>202-555-1212</phone>
 250 |       <member-of-organization>80361ec4-bfce-4b5c-85c8-313d6ebd220b</member-of-organization>
 251 |     </party>
 252 |     <party uuid="f0bc13a4-3303-47dd-80d3-380e159c8362" type="organization">
 253 |       <party-name>[SAMPLE]Example IaaS Provider</party-name>
 254 |       <short-name>E.I.P.</short-name>
 255 |       <remarks>
 256 |             <p>Underlying service provider. Leveraged Authorization.</p>
 257 |          </remarks>
 258 |     </party>
 259 |     <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
 260 |       <party-name>[SAMPLE]Person Name 1</party-name>
 261 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 262 |       <address>
 263 |         <addr-line>Mailstop A-1</addr-line>
 264 |       </address>
 265 |       <email>name@org.domain</email>
 266 |       <phone>202-000-0001</phone>
 267 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 268 |       <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
 269 |     </party>
 270 |     <party uuid="36b8d6c0-3b25-42cc-b529-cf4066145cdd" type="person">
 271 |       <party-name>[SAMPLE]Person Name 2</party-name>
 272 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 273 |       <address type="work">
 274 |         <addr-line>Address Line</addr-line>
 275 |         <city>City</city>
 276 |         <state>ST</state>
 277 |         <postal-code>00000</postal-code>
 278 |         <country>US</country>
 279 |       </address>
 280 |       <email>name@org.domain</email>
 281 |       <phone>202-000-0002</phone>
 282 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 283 |     </party>
 284 |     <party uuid="0cec09d9-20c6-470b-9ffc-85763375880b" type="person">
 285 |       <party-name>[SAMPLE]Person Name 3</party-name>
 286 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 287 |       <address type="work">
 288 |         <addr-line>Address Line</addr-line>
 289 |         <city>City</city>
 290 |         <state>ST</state>
 291 |         <postal-code>00000</postal-code>
 292 |         <country>US</country>
 293 |       </address>
 294 |       <email>name@org.domain</email>
 295 |       <phone>202-000-0003</phone>
 296 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 297 |     </party>
 298 |     <party uuid="f75e21f6-43d8-46ab-890d-7f2eebc5a830" type="person">
 299 |       <party-name>[SAMPLE]Person Name 4</party-name>
 300 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 301 |       <address type="work">
 302 |         <addr-line>Address Line</addr-line>
 303 |         <city>City</city>
 304 |         <state>ST</state>
 305 |         <postal-code>00000</postal-code>
 306 |         <country>US</country>
 307 |       </address>
 308 |       <email>name@org.domain</email>
 309 |       <phone>202-000-0004</phone>
 310 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 311 |     </party>
 312 |     <party uuid="132953a9-640c-46f7-9de9-3fa15ec99361" type="person">
 313 |       <party-name>[SAMPLE]Person Name 5</party-name>
 314 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 315 |       <address type="work">
 316 |         <addr-line>Address Line</addr-line>
 317 |         <city>City</city>
 318 |         <state>ST</state>
 319 |         <postal-code>00000</postal-code>
 320 |         <country>US</country>
 321 |       </address>
 322 |       <email>name@org.domain</email>
 323 |       <phone>202-000-0005</phone>
 324 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 325 |     </party>
 326 |     <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
 327 |       <party-name>[SAMPLE]Person Name 6</party-name>
 328 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 329 |       <address type="work">
 330 |         <addr-line>Address Line</addr-line>
 331 |         <city>City</city>
 332 |         <state>ST</state>
 333 |         <postal-code>00000</postal-code>
 334 |         <country>US</country>
 335 |       </address>
 336 |       <email>name@org.domain</email>
 337 |       <phone>202-000-0006</phone>
 338 |       <member-of-organization>78992555-4a99-4eaa-868c-f2c249679dd3</member-of-organization>
 339 |     </party>
 340 |     <party uuid="db234cb7-1776-425c-9ac4-b067c1723011" type="person">
 341 |       <party-name>[SAMPLE]Person Name 7</party-name>
 342 |       <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual&#39;s Title</prop>
 343 |       <address type="work">
 344 |         <addr-line>Address Line</addr-line>
 345 |         <city>City</city>
 346 |         <state>ST</state>
 347 |         <postal-code>00000</postal-code>
 348 |         <country>US</country>
 349 |       </address>
 350 |       <email>name@org.domain</email>
 351 |       <phone>202-000-0007</phone>
 352 |       <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
 353 |     </party>
 354 |     <party uuid="b306f5af-b93a-4a7f-a2b2-37a44fc92a79" type="organization">
 355 |       <party-name>[SAMPLE] IT Department</party-name>
 356 |     </party>
 357 |     <party uuid="59cdc953-5902-4fa4-a878-f3163854624c" type="organization">
 358 |       <party-name>[SAMPLE]Security Team</party-name>
 359 |     </party>
 360 |     <responsible-party role-id="cloud-service-provider">
 361 |       <party-uuid>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</party-uuid>
 362 |       <remarks>
 363 |             <p>Exactly one</p>
 364 |          </remarks>
 365 |     </responsible-party>
 366 |     <responsible-party role-id="prepared-by">
 367 |       <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
 368 |       <remarks>
 369 |             <p>Exactly one</p>
 370 |          </remarks>
 371 |     </responsible-party>
 372 |     <responsible-party role-id="prepared-for">
 373 |       <party-uuid>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</party-uuid>
 374 |     </responsible-party>
 375 |     <responsible-party role-id="content-approver">
 376 |       <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
 377 |       <party-uuid>36b8d6c0-3b25-42cc-b529-cf4066145cdd</party-uuid>
 378 |       <remarks>
 379 |             <p>One or more</p>
 380 |          </remarks>
 381 |     </responsible-party>
 382 |     <responsible-party role-id="system-owner">
 383 |       <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
 384 |       <remarks>
 385 |             <p>Exactly one</p>
 386 |          </remarks>
 387 |     </responsible-party>
 388 |     <responsible-party role-id="authorizing-official">
 389 |       <party-uuid>49017ec3-9f51-4dbd-9253-858c2b1295fd</party-uuid>
 390 |       <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
 391 |       <remarks>
 392 |             <p>One or more</p>
 393 |          </remarks>
 394 |     </responsible-party>
 395 |     <responsible-party role-id="system-poc-management">
 396 |       <party-uuid>0cec09d9-20c6-470b-9ffc-85763375880b</party-uuid>
 397 |       <remarks>
 398 |             <p>Exactly one</p>
 399 |          </remarks>
 400 |     </responsible-party>
 401 |     <responsible-party role-id="system-poc-technical">
 402 |       <party-uuid>f75e21f6-43d8-46ab-890d-7f2eebc5a830</party-uuid>
 403 |       <remarks>
 404 |             <p>Exactly one</p>
 405 |          </remarks>
 406 |     </responsible-party>
 407 |     <responsible-party role-id="information-system-security-officer">
 408 |       <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
 409 |       <remarks>
 410 |             <p>Exactly one</p>
 411 |          </remarks>
 412 |     </responsible-party>
 413 |     <responsible-party role-id="authorizing-official-poc">
 414 |       <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
 415 |       <remarks>
 416 |             <p>Exactly one</p>
 417 |          </remarks>
 418 |     </responsible-party>
 419 |     <responsible-party role-id="privacy-poc">
 420 |       <party-uuid>db234cb7-1776-425c-9ac4-b067c1723011</party-uuid>
 421 |       <remarks>
 422 |             <p>Exactly one</p>
 423 |          </remarks>
 424 |     </responsible-party>
 425 |     <responsible-party role-id="fedramp-pmo">
 426 |       <party-uuid>77e0e2c8-2560-4fe9-ac78-c3ff4ffc9f6d</party-uuid>
 427 |       <remarks>
 428 |             <p>Exactly one</p>
 429 |          </remarks>
 430 |     </responsible-party>
 431 |     <responsible-party role-id="fedramp-jab">
 432 |       <party-uuid>49017ec3-9f51-4dbd-9253-858c2b1295fd</party-uuid>
 433 |       <remarks>
 434 |             <p>Exactly one</p>
 435 |          </remarks>
 436 |     </responsible-party>
 437 |     <remarks>
 438 |          <p>This OSCAL-based FedRAMP SSP Template can be used for the FedRAMP Low, Moderate, and
 439 |             High baselines.</p>
 440 |          <p>Guidance for OSCAL-based FedRAMP Tailored content has not yet been developed.</p>
 441 |       </remarks>
 442 |   </metadata>
 443 |   <import-profile href="https://raw.githubusercontent.com/usnistgov/OSCAL/master/content/fedramp.gov/xml/FedRAMP_LOW-baseline_profile.xml"></import-profile>
 444 |   <system-characteristics>
 445 |     <system-id identifier-type="https://fedramp.gov">F00000000</system-id>
 446 |     <system-name>Red Hat Enterprise Linux 8.x</system-name>
 447 |     <system-name-short>rhel-8</system-name-short>
 448 |     <description><p>Automatically generated OSCAL SSP from OpenControl guidance for Red Hat Enterprise Linux 8.x</p></description>
 449 |     <security-sensitivity-level>low</security-sensitivity-level>
 450 |     <system-information>
 451 |       <information-type>
 452 |         <title>Information Type Name</title>
 453 |         <description><p>This item is useless nevertheless required.</p></description>
 454 |         <confidentiality-impact>
 455 |           <base>fips-199-moderate</base>
 456 |         </confidentiality-impact>
 457 |         <integrity-impact>
 458 |           <base>fips-199-moderate</base>
 459 |         </integrity-impact>
 460 |         <availability-impact>
 461 |           <base>fips-199-moderate</base>
 462 |         </availability-impact>
 463 |       </information-type>
 464 |     </system-information>
 465 |     <security-impact-level>
 466 |       <security-objective-confidentiality>fips-199-moderate</security-objective-confidentiality>
 467 |       <security-objective-integrity>fips-199-moderate</security-objective-integrity>
 468 |       <security-objective-availability>fips-199-moderate</security-objective-availability>
 469 |     </security-impact-level>
 470 |     <status state="operational"></status>
 471 |     <authorization-boundary>
 472 |       <description><p>A holistic, top-level explanation of the FedRAMP authorization boundary.</p></description>
 473 |     </authorization-boundary>
 474 |   </system-characteristics>
 475 |   <system-implementation>
 476 |     <user uuid="ebddf85a-2c8b-493f-89af-2e03c5ede486">
 477 |       <role-id>generator</role-id>
 478 |     </user>
 479 |     <component uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" component-type="system">
 480 |       <title>This system</title>
 481 |       <description><p>The entire system as depicted in the system authorization boundary</p></description>
 482 |       <status state="under-development"></status>
 483 |     </component>
 484 |   </system-implementation>
 485 |   <control-implementation>
 486 |     <description><p>FedRAMP SSP Template Section 13</p></description>
 487 |     <implemented-requirement uuid="a5f7c261-b143-4932-bafe-56a203d2974f" control-id="at-1">
 488 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 489 |       <statement statement-id="at-1_stmt.a" uuid="4fb55f92-8f7a-4b68-9edf-48625ce3a62a">
 490 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 491 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 492 |           <remarks><p>This control reflects organizational procedure/policy and is not
 493 | applicable to component-level configuration.
 494 | </p></remarks>
 495 |         </by-component>
 496 |       </statement>
 497 |       <statement statement-id="at-1_stmt.b" uuid="faf43c77-46a3-41ed-8d55-a238c5c3c300">
 498 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 499 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 500 |           <remarks><p>This control reflects organizational procedure/policy and is not
 501 | applicable to component-level configuration.
 502 | </p></remarks>
 503 |         </by-component>
 504 |       </statement>
 505 |     </implemented-requirement>
 506 |     <implemented-requirement uuid="187bbf86-112c-43bb-a6b1-0370ac67b459" control-id="at-2">
 507 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 508 |       <statement statement-id="at-2_stmt.a" uuid="11e87d5e-a558-4352-8418-864f48a3fa5a">
 509 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 510 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 511 |           <remarks><p>This control reflects organizational procedure/policy and is not
 512 | applicable to component-level configuration.
 513 | </p></remarks>
 514 |         </by-component>
 515 |       </statement>
 516 |       <statement statement-id="at-2_stmt.b" uuid="6b809c4b-ae3b-448a-b599-1cc724f41ce5">
 517 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 518 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 519 |           <remarks><p>This control reflects organizational procedure/policy and is not
 520 | applicable to component-level configuration.
 521 | </p></remarks>
 522 |         </by-component>
 523 |       </statement>
 524 |       <statement statement-id="at-2_stmt.c" uuid="326f3d80-8c5a-4a2a-ab26-8a3a290f2d01">
 525 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 526 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 527 |           <remarks><p>This control reflects organizational procedure/policy and is not
 528 | applicable to component-level configuration.
 529 | </p></remarks>
 530 |         </by-component>
 531 |       </statement>
 532 |     </implemented-requirement>
 533 |     <implemented-requirement uuid="6b128074-d806-4839-b3ec-d1afd70507f0" control-id="at-3">
 534 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 535 |       <statement statement-id="at-3_stmt.a" uuid="9fd8bcd9-0953-4643-8659-30a875b9bf4e">
 536 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 537 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 538 |           <remarks><p>This control reflects organizational procedure/policy and is not
 539 | applicable to component-level configuration.
 540 | </p></remarks>
 541 |         </by-component>
 542 |       </statement>
 543 |       <statement statement-id="at-3_stmt.b" uuid="c069e62b-112d-4576-aa88-f8728db3cd66">
 544 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 545 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 546 |           <remarks><p>This control reflects organizational procedure/policy and is not
 547 | applicable to component-level configuration.
 548 | </p></remarks>
 549 |         </by-component>
 550 |       </statement>
 551 |       <statement statement-id="at-3_stmt.c" uuid="e21d0bf9-7aac-4595-be92-736aeec4ec3e">
 552 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 553 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 554 |           <remarks><p>This control reflects organizational procedure/policy and is not
 555 | applicable to component-level configuration.
 556 | </p></remarks>
 557 |         </by-component>
 558 |       </statement>
 559 |     </implemented-requirement>
 560 |     <implemented-requirement uuid="2ff212e3-ac02-4eba-8546-8fa25721828c" control-id="at-4">
 561 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 562 |       <statement statement-id="at-4_stmt.a" uuid="07d09c72-058c-4b7e-be8b-044b9a8f8236">
 563 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 564 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 565 |           <remarks><p>This control reflects organizational procedure/policy and is not
 566 | applicable to component-level configuration.
 567 | </p></remarks>
 568 |         </by-component>
 569 |       </statement>
 570 |       <statement statement-id="at-4_stmt.b" uuid="2ffa39fb-db05-43b4-83ff-65762cef8c30">
 571 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="fec21d0a-8f0b-4ec3-935b-62a5310fc014">
 572 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 573 |           <remarks><p>This control reflects organizational procedure/policy and is not
 574 | applicable to component-level configuration.
 575 | </p></remarks>
 576 |         </by-component>
 577 |       </statement>
 578 |     </implemented-requirement>
 579 |     <implemented-requirement uuid="b2074ca2-3314-40e0-a322-f76401c98bfa" control-id="ir-1">
 580 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 581 |       <statement statement-id="ir-1_stmt.a" uuid="ed383cd8-fcef-44ad-940f-ea4fc52b0aa2">
 582 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 583 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 584 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 585 | applicable to the configuration of Red Hat Enterprise Linux.
 586 | </p></remarks>
 587 |         </by-component>
 588 |       </statement>
 589 |       <statement statement-id="ir-1_stmt.a.1" uuid="a3341e3c-19c6-4b0b-b637-9735c61cc5f6">
 590 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 591 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 592 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 593 | applicable to the configuration of Red Hat Enterprise Linux.
 594 | </p></remarks>
 595 |         </by-component>
 596 |       </statement>
 597 |       <statement statement-id="ir-1_stmt.a.2" uuid="e91da04a-dbf5-4de9-b6e9-746ea1986315">
 598 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 599 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 600 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 601 | applicable to the configuration of Red Hat Enterprise Linux.
 602 | </p></remarks>
 603 |         </by-component>
 604 |       </statement>
 605 |       <statement statement-id="ir-1_stmt.b" uuid="f045f5f3-7433-450a-8514-a5d958b6f756">
 606 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 607 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 608 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 609 | applicable to the configuration of Red Hat Enterprise Linux.
 610 | </p></remarks>
 611 |         </by-component>
 612 |       </statement>
 613 |       <statement statement-id="ir-1_stmt.b.1" uuid="2cee221e-32d8-4226-a9f9-301ed97dd459">
 614 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 615 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 616 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 617 | applicable to the configuration of Red Hat Enterprise Linux.
 618 | </p></remarks>
 619 |         </by-component>
 620 |       </statement>
 621 |       <statement statement-id="ir-1_stmt.b.2" uuid="fa61c208-6617-4235-b59c-eca7c1a95820">
 622 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 623 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 624 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 625 | applicable to the configuration of Red Hat Enterprise Linux.
 626 | </p></remarks>
 627 |         </by-component>
 628 |       </statement>
 629 |     </implemented-requirement>
 630 |     <implemented-requirement uuid="0a75b64e-e699-48d4-8f39-5739080a53eb" control-id="ir-2">
 631 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 632 |       <statement statement-id="ir-2_stmt.a" uuid="fb410b5c-35f6-43a9-bc42-1eb15f6561a9">
 633 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 634 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 635 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 636 | applicable to the configuration of Red Hat Enterprise Linux.
 637 | </p></remarks>
 638 |         </by-component>
 639 |       </statement>
 640 |       <statement statement-id="ir-2_stmt.b" uuid="7503c5a4-5d5e-4dc7-8423-09cfaaed0c90">
 641 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 642 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 643 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 644 | applicable to the configuration of Red Hat Enterprise Linux.
 645 | </p></remarks>
 646 |         </by-component>
 647 |       </statement>
 648 |       <statement statement-id="ir-2_stmt.c" uuid="eae5a6d6-5743-4c18-a1ff-417213648ba8">
 649 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 650 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 651 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 652 | applicable to the configuration of Red Hat Enterprise Linux.
 653 | </p></remarks>
 654 |         </by-component>
 655 |       </statement>
 656 |     </implemented-requirement>
 657 |     <implemented-requirement uuid="d5f43da4-0738-4742-b982-9078b37c5e7a" control-id="ir-4">
 658 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 659 |       <statement statement-id="ir-4_stmt.a" uuid="df767cc6-026f-47e6-b828-78dde7ffea92">
 660 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 661 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 662 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 663 | applicable to the configuration of Red Hat Enterprise Linux.
 664 | </p></remarks>
 665 |         </by-component>
 666 |       </statement>
 667 |       <statement statement-id="ir-4_stmt.b" uuid="a776cf6b-5456-46a0-8971-aea647e59336">
 668 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 669 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 670 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 671 | applicable to the configuration of Red Hat Enterprise Linux.
 672 | </p></remarks>
 673 |         </by-component>
 674 |       </statement>
 675 |       <statement statement-id="ir-4_stmt.c" uuid="f50b8c8c-add4-42c9-8c3b-c2a614a4652b">
 676 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 677 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 678 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 679 | applicable to the configuration of Red Hat Enterprise Linux.
 680 | </p></remarks>
 681 |         </by-component>
 682 |       </statement>
 683 |     </implemented-requirement>
 684 |     <implemented-requirement uuid="fb3375f1-e4be-45d8-98a3-89897298fca4" control-id="ir-5">
 685 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 686 |       <statement statement-id="ir-5_stmt" uuid="5e6ba516-299c-4800-a996-f5a5d9edbb09">
 687 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f064814e-36c6-448e-8f0d-4eca9db77025">
 688 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 689 |           <remarks><p>This control reflects organizational procedure/policies and is not
 690 | applicable to Red Hat Enterprise Linux configuration.
 691 | </p></remarks>
 692 |         </by-component>
 693 |       </statement>
 694 |     </implemented-requirement>
 695 |     <implemented-requirement uuid="655e23ea-73f9-42c9-b7d4-3a94e7a2ad57" control-id="ir-6">
 696 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 697 |       <statement statement-id="ir-6_stmt.a" uuid="40d636d6-6964-4610-aa7c-d86737531f1a">
 698 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 699 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 700 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 701 | applicable to the configuration of Red Hat Enterprise Linux.
 702 | </p></remarks>
 703 |         </by-component>
 704 |       </statement>
 705 |       <statement statement-id="ir-6_stmt.b" uuid="9a1f52a2-b2a3-42dd-9f4e-07b0a9e5562a">
 706 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 707 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 708 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 709 | applicable to the configuration of Red Hat Enterprise Linux.
 710 | </p></remarks>
 711 |         </by-component>
 712 |       </statement>
 713 |     </implemented-requirement>
 714 |     <implemented-requirement uuid="3e04a01d-4a41-444a-bdc8-bb8ddeb427e9" control-id="ir-7">
 715 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 716 |       <statement statement-id="ir-7_stmt" uuid="1defce0f-835b-45b2-a8b4-0bbf79eb06a7">
 717 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 718 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 719 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 720 | applicable to the configuration of Red Hat Enterprise Linux.
 721 | </p></remarks>
 722 |         </by-component>
 723 |       </statement>
 724 |     </implemented-requirement>
 725 |     <implemented-requirement uuid="98e7a79d-ec6b-4253-a247-3dfa3a97f274" control-id="ir-8">
 726 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 727 |       <statement statement-id="ir-8_stmt.a" uuid="f226ef5d-c4e5-453e-8f06-806363fc976a">
 728 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 729 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 730 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 731 | applicable to the configuration of Red Hat Enterprise Linux.
 732 | </p></remarks>
 733 |         </by-component>
 734 |       </statement>
 735 |       <statement statement-id="ir-8_stmt.a.1" uuid="a45f4789-b326-476a-873c-2c0f287832d3">
 736 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 737 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 738 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 739 | applicable to the configuration of Red Hat Enterprise Linux.
 740 | </p></remarks>
 741 |         </by-component>
 742 |       </statement>
 743 |       <statement statement-id="ir-8_stmt.a.2" uuid="813f981f-6923-4235-a648-7b076ee3eea6">
 744 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 745 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 746 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 747 | applicable to the configuration of Red Hat Enterprise Linux.
 748 | </p></remarks>
 749 |         </by-component>
 750 |       </statement>
 751 |       <statement statement-id="ir-8_stmt.a.3" uuid="30328a20-0b4a-46b8-8f1a-7ba21adae16c">
 752 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 753 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 754 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 755 | applicable to the configuration of Red Hat Enterprise Linux.
 756 | </p></remarks>
 757 |         </by-component>
 758 |       </statement>
 759 |       <statement statement-id="ir-8_stmt.a.4" uuid="df0171a6-7b99-4a7d-94b4-05f839870539">
 760 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 761 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 762 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 763 | applicable to the configuration of Red Hat Enterprise Linux.
 764 | </p></remarks>
 765 |         </by-component>
 766 |       </statement>
 767 |       <statement statement-id="ir-8_stmt.a.5" uuid="0f112da4-8f39-4059-9b59-5e79408d6400">
 768 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 769 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 770 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 771 | applicable to the configuration of Red Hat Enterprise Linux.
 772 | </p></remarks>
 773 |         </by-component>
 774 |       </statement>
 775 |       <statement statement-id="ir-8_stmt.a.6" uuid="c5f5033e-b926-4c39-8ed6-ce6973cf1003">
 776 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 777 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 778 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 779 | applicable to the configuration of Red Hat Enterprise Linux.
 780 | </p></remarks>
 781 |         </by-component>
 782 |       </statement>
 783 |       <statement statement-id="ir-8_stmt.a.7" uuid="7165cc37-0212-473c-b692-b82782d977cd">
 784 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 785 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 786 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 787 | applicable to the configuration of Red Hat Enterprise Linux.
 788 | </p></remarks>
 789 |         </by-component>
 790 |       </statement>
 791 |       <statement statement-id="ir-8_stmt.a.8" uuid="d9359977-60b1-407b-b570-0a5f1196cc94">
 792 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 793 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 794 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 795 | applicable to the configuration of Red Hat Enterprise Linux.
 796 | </p></remarks>
 797 |         </by-component>
 798 |       </statement>
 799 |       <statement statement-id="ir-8_stmt.b" uuid="0a5d4e19-2307-43f4-bc0b-8e40d51b1709">
 800 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 801 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 802 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 803 | applicable to the configuration of Red Hat Enterprise Linux.
 804 | </p></remarks>
 805 |         </by-component>
 806 |       </statement>
 807 |       <statement statement-id="ir-8_stmt.c" uuid="410ad22d-49e8-4aa4-89cf-ba7d90b82231">
 808 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 809 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 810 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 811 | applicable to the configuration of Red Hat Enterprise Linux.
 812 | </p></remarks>
 813 |         </by-component>
 814 |       </statement>
 815 |       <statement statement-id="ir-8_stmt.d" uuid="b8b6ffaa-f874-46b5-a0e8-919d4d22db03">
 816 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 817 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 818 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 819 | applicable to the configuration of Red Hat Enterprise Linux.
 820 | </p></remarks>
 821 |         </by-component>
 822 |       </statement>
 823 |       <statement statement-id="ir-8_stmt.e" uuid="987ad1c7-67d9-44bb-9bdf-070d5bef811c">
 824 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 825 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 826 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 827 | applicable to the configuration of Red Hat Enterprise Linux.
 828 | </p></remarks>
 829 |         </by-component>
 830 |       </statement>
 831 |       <statement statement-id="ir-8_stmt.f" uuid="78a2096f-5c01-4a63-a51b-4652d85f1821">
 832 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
 833 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 834 |           <remarks><p>This control reflects organizational procedures/policies, and is not
 835 | applicable to the configuration of Red Hat Enterprise Linux.
 836 | </p></remarks>
 837 |         </by-component>
 838 |       </statement>
 839 |     </implemented-requirement>
 840 |     <implemented-requirement uuid="42a8e6e7-ba47-4673-aa26-921fc065444d" control-id="pe-1">
 841 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 842 |       <statement statement-id="pe-1_stmt.a" uuid="c83f6fe7-f379-4d26-b467-b6d8eee9b69d">
 843 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b9ec3101-88dd-4b31-8554-cb58a661cf37">
 844 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 845 |           <remarks><p>Development, documentation, and dissemination of a physical
 846 | and environmental protection policy reflects organizational
 847 | procedure/policy and is not applicable to component-level
 848 | configuration.
 849 | </p></remarks>
 850 |         </by-component>
 851 |       </statement>
 852 |       <statement statement-id="pe-1_stmt.b" uuid="da7d9481-1921-47cd-a889-16afb00309d7">
 853 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="e2f86c0a-2a8a-4fb1-bba7-bcb67201d575">
 854 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 855 |           <remarks><p>Organizational review and updates to the physical and
 856 | environmental protection policy reflects organizational
 857 | procedure/policy and is not applicable to component-level
 858 | configuration.
 859 | </p></remarks>
 860 |         </by-component>
 861 |       </statement>
 862 |     </implemented-requirement>
 863 |     <implemented-requirement uuid="7ec32282-917b-4e33-9f1b-1cc83c5f2126" control-id="pe-2">
 864 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 865 |       <statement statement-id="pe-2_stmt.a" uuid="b5066467-2113-4017-8031-35011f19a450">
 866 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="038e04b3-3dbe-4b39-92c2-c785877f4bcd">
 867 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 868 |           <remarks><p>Development, approval, and maintenance of a list
 869 | of individuals with authorized access to the facility
 870 | where the information system resides reflects organizational
 871 | procedure/policy and is not applicable to component-level
 872 | configuration.
 873 | </p></remarks>
 874 |         </by-component>
 875 |       </statement>
 876 |       <statement statement-id="pe-2_stmt.b" uuid="392ae166-9512-48e9-aa07-42183889708c">
 877 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="669f2834-4e92-4717-871b-ae33fdaeaaa1">
 878 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 879 |           <remarks><p>Issuing authorization credentials for facility access
 880 | reflects organizational procedure/policy and is not
 881 | applicable to component-level configuration.
 882 | </p></remarks>
 883 |         </by-component>
 884 |       </statement>
 885 |       <statement statement-id="pe-2_stmt.c" uuid="d5469cdc-724a-4322-9129-d5934c105c10">
 886 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="bfb7d2d8-d63a-49c4-b3fb-7ca6924e9d98">
 887 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 888 |           <remarks><p>Reviewing the access list detailing authorized facility
 889 | access by individuals at an organization-defined frequency
 890 | reflects organizational procedure/policy and is not
 891 | applicable to component-level configuration.
 892 | </p></remarks>
 893 |         </by-component>
 894 |       </statement>
 895 |       <statement statement-id="pe-2_stmt.d" uuid="a967db64-9e28-4b4e-b8c7-3f44a166c394">
 896 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="859bce49-462e-42c3-a22c-f485a8e44724">
 897 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 898 |           <remarks><p>Removal of individuals from the facility access list when access
 899 | is no longer required reflects organizational procedure/policy
 900 | and is not applicable to component-level configuration.
 901 | </p></remarks>
 902 |         </by-component>
 903 |       </statement>
 904 |     </implemented-requirement>
 905 |     <implemented-requirement uuid="042703fc-da12-4f5b-9c7a-6d0137e53335" control-id="pe-3">
 906 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 907 |       <statement statement-id="pe-3_stmt.a" uuid="5441c93a-ece5-4408-89a4-3016425351ad">
 908 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="d32678f5-5c72-4ec3-81f0-9d87d5406f5a">
 909 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 910 |           <remarks><p>Enforcing physical access authorizations at organization-defined
 911 | entry/exit points to the facility where the information system resides
 912 | reflects organizational procedure/policy and is not applicable to
 913 | component-level configuration.
 914 | </p></remarks>
 915 |         </by-component>
 916 |       </statement>
 917 |       <statement statement-id="pe-3_stmt.b" uuid="ff052ff3-128f-4899-bd0b-2ab818502631">
 918 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="6fa063ec-7fbd-43c2-b09c-7d1a0f27e663">
 919 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 920 |           <remarks><p>Maintaining physical access audit logs for organization-defined
 921 | entry/exit points reflects organizational procedure/policy and
 922 | is not applicable to component-level configuration.
 923 | </p></remarks>
 924 |         </by-component>
 925 |       </statement>
 926 |       <statement statement-id="pe-3_stmt.c" uuid="6d431649-93fd-40ed-82a5-a10123b36d13">
 927 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="ab51d315-44ab-420d-a34a-fe28a1bb5d8d">
 928 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 929 |           <remarks><p>Providing organization-defined security safeguards to control access
 930 | to areas within the facility officially designated as publicly
 931 | accessible reflects organizational procedure/policy and
 932 | is not applicable to component-level configuration.
 933 | </p></remarks>
 934 |         </by-component>
 935 |       </statement>
 936 |       <statement statement-id="pe-3_stmt.d" uuid="73ada1b1-2cb7-4e33-92b5-d49db0460f18">
 937 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="89f5db7a-50c1-41a4-bd2f-b0515b74cd9d">
 938 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 939 |           <remarks><p>Escorting visitors and monitoring visitor activity during
 940 | organization-defined circumstances requiring visitor escorts
 941 | and monitoring reflects organizational procedure/policy and
 942 | is not applicable to component-level configuration.
 943 | </p></remarks>
 944 |         </by-component>
 945 |       </statement>
 946 |       <statement statement-id="pe-3_stmt.e" uuid="cf7ec606-b6be-4f32-87a2-b69aacb9c9b8">
 947 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="49afbd68-3163-4721-b4a1-6da04653789f">
 948 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 949 |           <remarks><p>Securing keys, combinations, and other physical access devices
 950 | reflects organizational procedure/policy and
 951 | is not applicable to component-level configuration.
 952 | </p></remarks>
 953 |         </by-component>
 954 |       </statement>
 955 |       <statement statement-id="pe-3_stmt.f" uuid="ac8fc9a1-95dd-4d7c-b1c2-7e8aba4d5be6">
 956 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="0938121d-1df5-4128-b99d-0c772958da88">
 957 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 958 |           <remarks><p>Inventory of organization-defined physical access devices
 959 | at an organization-defined frequency reflects organizational
 960 | procedure/policy and is not applicable to component-level
 961 | configuration.
 962 | </p></remarks>
 963 |         </by-component>
 964 |       </statement>
 965 |       <statement statement-id="pe-3_stmt.g" uuid="38201073-f9fa-470b-be12-c08647c86ac2">
 966 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="12ae89c8-84dd-48ee-a198-3e89b569638f">
 967 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 968 |           <remarks><p>Changing combinations and keys at an organization-defined frequency
 969 | and/or when keys are lost, combinations are compromised, or individuals
 970 | are transferred or terminated, reflects organizational procedure/policy
 971 | and is not applicable to component-level configuration.
 972 | </p></remarks>
 973 |         </by-component>
 974 |       </statement>
 975 |     </implemented-requirement>
 976 |     <implemented-requirement uuid="dc8a7092-0aab-4dd5-a47a-e857656e5f0b" control-id="pe-6">
 977 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
 978 |       <statement statement-id="pe-6_stmt.a" uuid="33cd6b74-63d4-460b-823f-b5f28b85efcd">
 979 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="d819c998-1e4d-48ac-b59d-ad2866825484">
 980 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 981 |           <remarks><p>Monitoring physical access to the facility where the information
 982 | system resides to detect and respond to physical security incidents
 983 | reflects organizational procedure/policy and is outside the scope
 984 | of component-level configuration.
 985 | </p></remarks>
 986 |         </by-component>
 987 |       </statement>
 988 |       <statement statement-id="pe-6_stmt.b" uuid="f3362c58-4214-4a7c-80a0-b105d2e1c71b">
 989 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="ce190ad7-f714-44fa-bfc0-8945d32c13e1">
 990 |           <description><p>Describe how is the software component satisfying the control.</p></description>
 991 |           <remarks><p>Reviewing physical access logs at an organization-defined
 992 | frequency and upon occurence of organization-defined events
 993 | or potential indications of events, reflects organizational
 994 | procedure/policy and is not applicable to component-level
 995 | configuration.
 996 | </p></remarks>
 997 |         </by-component>
 998 |       </statement>
 999 |       <statement statement-id="pe-6_stmt.c" uuid="b92908ce-4745-4711-bcb3-6a5960563a2d">
1000 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="84fe10a0-60dc-47d9-90ba-d0f6f61bca15">
1001 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1002 |           <remarks><p>Coordinating results of reviews and investigations with
1003 | the organizational incident response capability reflects
1004 | organizational procedure/policy and is not applicable to
1005 | component-level configuration.
1006 | </p></remarks>
1007 |         </by-component>
1008 |       </statement>
1009 |     </implemented-requirement>
1010 |     <implemented-requirement uuid="e4329b69-a2bc-496f-aef9-60af3f2ba616" control-id="pe-8">
1011 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1012 |       <statement statement-id="pe-8_stmt.a" uuid="91b8d93b-c8fa-417c-ae8c-4951597fe883">
1013 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1014 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1015 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1016 | </p></remarks>
1017 |         </by-component>
1018 |       </statement>
1019 |       <statement statement-id="pe-8_stmt.b" uuid="02093793-e0dd-4d1a-949f-013f040ae8a0">
1020 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1021 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1022 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1023 | </p></remarks>
1024 |         </by-component>
1025 |       </statement>
1026 |     </implemented-requirement>
1027 |     <implemented-requirement uuid="11b8b7ee-c378-4425-b296-6f56eb703c76" control-id="pe-12">
1028 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1029 |       <statement statement-id="pe-12_stmt" uuid="4845a568-565f-40f8-976c-5c1d1f1eb9ef">
1030 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1031 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1032 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1033 | </p></remarks>
1034 |         </by-component>
1035 |       </statement>
1036 |     </implemented-requirement>
1037 |     <implemented-requirement uuid="6657211f-e3b9-43c5-9477-02767cef12b4" control-id="pe-13">
1038 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1039 |       <statement statement-id="pe-13_stmt" uuid="4c7ac6a7-5677-47f5-ad33-e8a4d982c01d">
1040 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1041 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1042 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1043 | </p></remarks>
1044 |         </by-component>
1045 |       </statement>
1046 |     </implemented-requirement>
1047 |     <implemented-requirement uuid="4bf3d533-2f44-44d2-9003-a104380b30e9" control-id="pe-14">
1048 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1049 |       <statement statement-id="pe-14_stmt.a" uuid="e2719a38-2d72-4d39-9c9f-344e9d3342b6">
1050 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1051 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1052 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1053 | </p></remarks>
1054 |         </by-component>
1055 |       </statement>
1056 |       <statement statement-id="pe-14_stmt.b" uuid="6b2d96a7-6a9d-4448-99d5-89a5443be73b">
1057 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1058 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1059 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1060 | </p></remarks>
1061 |         </by-component>
1062 |       </statement>
1063 |     </implemented-requirement>
1064 |     <implemented-requirement uuid="07a3be45-5937-4bfd-98b8-b8f9ea1b21a2" control-id="pe-15">
1065 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1066 |       <statement statement-id="pe-15_stmt" uuid="a6f71100-a32c-4b0b-bd03-ef3d792de1ad">
1067 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1068 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1069 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1070 | </p></remarks>
1071 |         </by-component>
1072 |       </statement>
1073 |     </implemented-requirement>
1074 |     <implemented-requirement uuid="e9fecabe-ac5c-4e3c-9e8b-dcd8923787f8" control-id="pe-16">
1075 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1076 |       <statement statement-id="pe-16_stmt" uuid="29136d47-d918-4593-8b2b-6516d3c01915">
1077 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="90eeb4a5-5f8d-4bee-9f00-0e22c33d8db6">
1078 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1079 |           <remarks><p>This control is outside the scope of Red Hat Enterprise Linux configuration.
1080 | </p></remarks>
1081 |         </by-component>
1082 |       </statement>
1083 |     </implemented-requirement>
1084 |     <implemented-requirement uuid="5a6a70cd-e241-4b52-bf70-dbb9f62a0c75" control-id="pl-1">
1085 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1086 |       <statement statement-id="pl-1_stmt.a" uuid="094d50b5-ebc2-442d-9031-7bc8a1196c57">
1087 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1088 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1089 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1090 | applicable to the configuration of Red Hat Enterprise Linux.
1091 | </p></remarks>
1092 |         </by-component>
1093 |       </statement>
1094 |       <statement statement-id="pl-1_stmt.b" uuid="8a288e6e-1641-49e0-acf5-684f40de5b21">
1095 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1096 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1097 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1098 | applicable to the configuration of Red Hat Enterprise Linux.
1099 | </p></remarks>
1100 |         </by-component>
1101 |       </statement>
1102 |     </implemented-requirement>
1103 |     <implemented-requirement uuid="567a49c4-0184-47f0-854f-4ef1fb836ae8" control-id="pl-2">
1104 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1105 |       <statement statement-id="pl-2_stmt.a" uuid="b0c294fd-f8da-43a1-91a5-5a8f1ce16aa8">
1106 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1107 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1108 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1109 | applicable to the configuration of Red Hat Enterprise Linux.
1110 | </p></remarks>
1111 |         </by-component>
1112 |       </statement>
1113 |       <statement statement-id="pl-2_stmt.b" uuid="0ae636b7-3308-4de6-985d-bee23fd586cc">
1114 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1115 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1116 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1117 | applicable to the configuration of Red Hat Enterprise Linux.
1118 | </p></remarks>
1119 |         </by-component>
1120 |       </statement>
1121 |       <statement statement-id="pl-2_stmt.c" uuid="d878723c-436f-4131-bcf9-a63cff332b30">
1122 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1123 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1124 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1125 | applicable to the configuration of Red Hat Enterprise Linux.
1126 | </p></remarks>
1127 |         </by-component>
1128 |       </statement>
1129 |       <statement statement-id="pl-2_stmt.d" uuid="b4235c44-8baf-4bda-8d26-1e2fd25a910d">
1130 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1131 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1132 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1133 | applicable to the configuration of Red Hat Enterprise Linux.
1134 | </p></remarks>
1135 |         </by-component>
1136 |       </statement>
1137 |       <statement statement-id="pl-2_stmt.e" uuid="0336a419-949e-41a7-9586-7844675ee2a5">
1138 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1139 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1140 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1141 | applicable to the configuration of Red Hat Enterprise Linux.
1142 | </p></remarks>
1143 |         </by-component>
1144 |       </statement>
1145 |     </implemented-requirement>
1146 |     <implemented-requirement uuid="aa60b190-b436-428f-82d3-5e609134ce39" control-id="pl-4">
1147 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1148 |       <statement statement-id="pl-4_stmt.a" uuid="42ef50ea-2c10-46a2-9bdc-76d8adf7560c">
1149 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1150 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1151 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1152 | applicable to the configuration of Red Hat Enterprise Linux.
1153 | </p></remarks>
1154 |         </by-component>
1155 |       </statement>
1156 |       <statement statement-id="pl-4_stmt.b" uuid="c46e6105-5a63-49db-bf1f-73b389843af6">
1157 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1158 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1159 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1160 | applicable to the configuration of Red Hat Enterprise Linux.
1161 | </p></remarks>
1162 |         </by-component>
1163 |       </statement>
1164 |       <statement statement-id="pl-4_stmt.c" uuid="2f333acf-78a0-4ff4-b462-cff0758b291b">
1165 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1166 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1167 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1168 | applicable to the configuration of Red Hat Enterprise Linux.
1169 | </p></remarks>
1170 |         </by-component>
1171 |       </statement>
1172 |       <statement statement-id="pl-4_stmt.d" uuid="4f93d123-f0b7-41ec-8ad8-3b8862704db2">
1173 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8a38c107-7dd3-417b-bd56-95c3002123b8">
1174 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1175 |           <remarks><p>This control reflects organizational procedures/policies, and is not
1176 | applicable to the configuration of Red Hat Enterprise Linux.
1177 | </p></remarks>
1178 |         </by-component>
1179 |       </statement>
1180 |     </implemented-requirement>
1181 |     <implemented-requirement uuid="c988b60d-465a-4ff5-b48a-725e3a78d86a" control-id="ps-1">
1182 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1183 |       <statement statement-id="ps-1_stmt.a" uuid="0d51f17d-3553-4efc-8ffd-225ef6ca9909">
1184 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1185 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1186 |           <remarks><p>Organizational development, documentation, and dissemination of
1187 | a personnel security policy to organization-defined personnel
1188 | is outside the scope of Red Hat Enterprise Linux configuration.
1189 | </p></remarks>
1190 |         </by-component>
1191 |       </statement>
1192 |       <statement statement-id="ps-1_stmt.a.1" uuid="0aa5b922-5a46-4e23-a13b-3c3dc4d2394e">
1193 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1194 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1195 |           <remarks><p>Organizational development, documentation, and dissemination of
1196 | a personnel security policy to organization-defined personnel
1197 | is outside the scope of Red Hat Enterprise Linux configuration.
1198 | </p></remarks>
1199 |         </by-component>
1200 |       </statement>
1201 |       <statement statement-id="ps-1_stmt.a.2" uuid="c46c9f16-3014-47ad-bcf4-7fe5b7f7eef3">
1202 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1203 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1204 |           <remarks><p>Organizational development, documentation, and dissemination of
1205 | a personnel security policy to organization-defined personnel
1206 | is outside the scope of Red Hat Enterprise Linux configuration.
1207 | </p></remarks>
1208 |         </by-component>
1209 |       </statement>
1210 |       <statement statement-id="ps-1_stmt.b" uuid="3b162d5f-320a-4980-96a4-827861f26603">
1211 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="8e1a01d7-b935-4923-a72b-5fdab355ca76">
1212 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1213 |           <remarks><p>Organizational reviews and updates to the personnel security policy
1214 | and personnel security procedures at an organization-defined frequency
1215 | is outside the scope of Red Hat Enterprise Linux configuration.
1216 | </p></remarks>
1217 |         </by-component>
1218 |       </statement>
1219 |       <statement statement-id="ps-1_stmt.b.1" uuid="40256f60-3c90-424b-8d79-8a8be97a6d02">
1220 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1221 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1222 |           <remarks><p>Organizational development, documentation, and dissemination of
1223 | a personnel security policy to organization-defined personnel
1224 | is outside the scope of Red Hat Enterprise Linux configuration.
1225 | </p></remarks>
1226 |         </by-component>
1227 |       </statement>
1228 |       <statement statement-id="ps-1_stmt.b.2" uuid="390198da-0711-49ba-ba04-7e623e2f872f">
1229 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f35720a2-4c26-47e0-b150-10fbdef09485">
1230 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1231 |           <remarks><p>Organizational development, documentation, and dissemination of
1232 | a personnel security policy to organization-defined personnel
1233 | is outside the scope of Red Hat Enterprise Linux configuration.
1234 | </p></remarks>
1235 |         </by-component>
1236 |       </statement>
1237 |     </implemented-requirement>
1238 |     <implemented-requirement uuid="4013a119-4669-4462-b32c-a13a61913347" control-id="ps-2">
1239 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1240 |       <statement statement-id="ps-2_stmt.a" uuid="1388f2d8-ae86-4819-97e2-5768ca9dc4b7">
1241 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="a1f82811-f626-4ecb-9987-0e5c056a792f">
1242 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1243 |           <remarks><p>Organizational assignment of a risk designation to all organizational
1244 | positions is outside the scope of Red Hat Enterprise Linux configuration.
1245 | </p></remarks>
1246 |         </by-component>
1247 |       </statement>
1248 |       <statement statement-id="ps-2_stmt.b" uuid="277a1997-199e-4df9-9aff-3a28c98b2569">
1249 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="76dc6db9-0389-4e6b-b889-0cfc81206704">
1250 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1251 |           <remarks><p>Organizational establishment of screening criteria for individuals
1252 | filling those positions is outside the scope of Red Hat Enterprise Linux
1253 | configuration.
1254 | </p></remarks>
1255 |         </by-component>
1256 |       </statement>
1257 |       <statement statement-id="ps-2_stmt.c" uuid="421af13e-3066-4d91-89e9-3327af5f2d90">
1258 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="2e37e2c3-8e83-48a9-a8f0-3e10cbda33b0">
1259 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1260 |           <remarks><p>Organizational review and updating of position risk
1261 | designations at an organization-defined frequency is outside the scope
1262 | of Red Hat Enterprise Linux configuration.
1263 | </p></remarks>
1264 |         </by-component>
1265 |       </statement>
1266 |     </implemented-requirement>
1267 |     <implemented-requirement uuid="f7be1dbd-86aa-41f8-b1d0-67ff78c56022" control-id="ps-3">
1268 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1269 |       <statement statement-id="ps-3_stmt.a" uuid="4b0f8c16-3670-44f5-9304-3dfbb1e47801">
1270 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="f5ce677b-00ef-4acd-a893-6a1108779fe0">
1271 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1272 |           <remarks><p>Organizational screening of individuals prior to authorizing access
1273 | to the information system is outside the scope of Red Hat Enterprise Linux
1274 | configuration.
1275 | </p></remarks>
1276 |         </by-component>
1277 |       </statement>
1278 |       <statement statement-id="ps-3_stmt.b" uuid="94fdd023-e571-45e2-96ea-e752c9f6f201">
1279 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="e4e0488e-a97a-4a7d-b05d-a628a196dcf4">
1280 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1281 |           <remarks><p>Organizational processes to rescreen individuals according to
1282 | organization-defined conditions requiring rescreening and,
1283 | where rescreening is so indicated, the frequency of such
1284 | rescreening, is outside the scope of Red Hat Enterprise Linux
1285 | configuration.
1286 | </p></remarks>
1287 |         </by-component>
1288 |       </statement>
1289 |     </implemented-requirement>
1290 |     <implemented-requirement uuid="b4b68dad-4698-4307-b5d5-368927e4ca81" control-id="ps-4">
1291 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1292 |       <statement statement-id="ps-4_stmt.a" uuid="e713072c-cd4d-4957-8a6a-89312c814a72">
1293 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="4131e0d9-2ae1-439c-9390-594d5fe724b4">
1294 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1295 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1296 | employment, information system access is disabled within an
1297 | organization-defined time period, are outside the scope of
1298 | Red Hat Enterprise Linux configuration.
1299 | </p></remarks>
1300 |         </by-component>
1301 |       </statement>
1302 |       <statement statement-id="ps-4_stmt.b" uuid="82bbc369-291d-41ad-8142-adf503f51a3b">
1303 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="855c02d1-a80b-4fe4-9e88-b9f1541c7966">
1304 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1305 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1306 | employment, any authenticators/credentials associated with the individual
1307 | are terminated/revoked, are outside the scope of
1308 | Red Hat Enterprise Linux configuration.
1309 | </p></remarks>
1310 |         </by-component>
1311 |       </statement>
1312 |       <statement statement-id="ps-4_stmt.c" uuid="89d535f9-c9da-406c-89e0-4a5fdf524ef0">
1313 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="6fe3d101-0b7e-4306-8a60-a83386d2902b">
1314 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1315 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1316 | employment, exit interviews are conducted that include a discussion of
1317 | organization-defined information security topics, are outside the scope
1318 | of Red Hat Enterprise Linux configuration.
1319 | </p></remarks>
1320 |         </by-component>
1321 |       </statement>
1322 |       <statement statement-id="ps-4_stmt.d" uuid="e84edbfc-357a-4010-a60d-3d3a9101fb6a">
1323 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="e2fcf347-7359-4cb0-9b78-4495cb51f9fe">
1324 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1325 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1326 | employment, all security-related organizational information
1327 | system-related property is retrieved, are outside the scope
1328 | of Red Hat Enterprise Linux configuration.
1329 | </p></remarks>
1330 |         </by-component>
1331 |       </statement>
1332 |       <statement statement-id="ps-4_stmt.e" uuid="3e3d11bc-4f79-45e6-a8c8-5027ae4fa3cf">
1333 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="09c8db57-2a8e-432e-bfcf-7751092dc5cf">
1334 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1335 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1336 | employment, the organization retains access to organizational
1337 | information systems formerly controlled by the terminated individual,
1338 | are outside the scope of Red Hat Enterprise Linux configuration.
1339 | </p></remarks>
1340 |         </by-component>
1341 |       </statement>
1342 |       <statement statement-id="ps-4_stmt.f" uuid="1dced8bb-23f9-4853-9127-e579658554b6">
1343 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="a0416027-169d-43e4-816d-a7d11f28ab5c">
1344 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1345 |           <remarks><p>Organizational processes ensuring that, upon termination of individual
1346 | employment, the organization notifies organization-defined personnel
1347 | or roles within an organization-defined time period, are outside
1348 | the scope of Red Hat Enterprise Linux configuration.
1349 | </p></remarks>
1350 |         </by-component>
1351 |       </statement>
1352 |     </implemented-requirement>
1353 |     <implemented-requirement uuid="c13693a6-8717-4c41-b9a5-4f30ce6f8101" control-id="ps-5">
1354 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1355 |       <statement statement-id="ps-5_stmt.a" uuid="e1489dc0-a117-42be-b778-82b7750998cd">
1356 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="479491e8-8dea-4f0e-b7d3-ffd22903d2b4">
1357 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1358 |           <remarks><p>Organizational processes to review and confirm ongoing operational
1359 | need for current logical and physical access authorizations to
1360 | information systems/facilities when individuals are reassigned or
1361 | transferred to other positions within the organization are
1362 | outside the scope of Red Hat Enterprise Linux configuration.
1363 | </p></remarks>
1364 |         </by-component>
1365 |       </statement>
1366 |       <statement statement-id="ps-5_stmt.b" uuid="4a9feaa8-de4f-4163-ade4-79cc444243ab">
1367 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="4f79abd4-01cc-4a13-9688-27c5d024bfcb">
1368 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1369 |           <remarks><p>Organizational processes to initiate organization-defined transfer
1370 | or reassignment actions within organization-defined time period
1371 | following the formal transfer action are outside the scope of
1372 | Red Hat Enterprise Linux configuration.
1373 | </p></remarks>
1374 |         </by-component>
1375 |       </statement>
1376 |       <statement statement-id="ps-5_stmt.c" uuid="dc70a4f1-e6f7-413e-b681-a8c1bc3c046e">
1377 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="0e9e3993-12c2-4701-b54f-a4840a0c6bd7">
1378 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1379 |           <remarks><p>Organizational processes to modify access authorizations as needed to
1380 | correspond with any changes in oeprational need due to reassignment
1381 | or transfer are outside the scope of Red Hat Enterprise Linux configuration.
1382 | </p></remarks>
1383 |         </by-component>
1384 |       </statement>
1385 |       <statement statement-id="ps-5_stmt.d" uuid="1db9f2d5-379b-4c98-a6e4-00940b0e110f">
1386 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="5065e649-c75c-4114-b472-32d24cbfad15">
1387 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1388 |           <remarks><p>Organizational notifications of organization-defined personnel
1389 | or roles within an organization-defined time period are outside
1390 | the scope of Red Hat Enterprise Linux configuration.
1391 | </p></remarks>
1392 |         </by-component>
1393 |       </statement>
1394 |     </implemented-requirement>
1395 |     <implemented-requirement uuid="170cfb24-bb93-4702-90d1-8d17b5c354fd" control-id="ps-6">
1396 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1397 |       <statement statement-id="ps-6_stmt.a" uuid="2d92b85d-052e-41e8-a286-e555d06de10f">
1398 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="21e5d497-9123-4f23-8057-62ef9c31ccbd">
1399 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1400 |           <remarks><p>Organizational process to develop and document access agreements for
1401 | organizational information systems are outside the scope of
1402 | Red Hat Enterprise Linux configuration.
1403 | </p></remarks>
1404 |         </by-component>
1405 |       </statement>
1406 |       <statement statement-id="ps-6_stmt.b" uuid="4f3ef13a-e090-4d16-8b0c-9e889bae67db">
1407 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="adb9b134-e07a-4289-b7d5-9b540c238761">
1408 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1409 |           <remarks><p>Organizational reviews and updates to the access agreements at an
1410 | organization-defined frequency are outside the scope of
1411 | Red Hat Enterprise Linux configuration.
1412 | </p></remarks>
1413 |         </by-component>
1414 |       </statement>
1415 |       <statement statement-id="ps-6_stmt.c" uuid="32edf3e6-203c-4450-83ff-cf925412a8ac">
1416 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b16478ac-2be8-4826-a331-d89f1f9c817e">
1417 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1418 |           <remarks><p>Organizational processes that ensure individuals requiring access to
1419 | organizational information and information systems sign and re-sign
1420 | access agreements are outside the scope of Red Hat Enterprise Linux configuration.
1421 | </p></remarks>
1422 |         </by-component>
1423 |       </statement>
1424 |       <statement statement-id="ps-6_stmt.c.1" uuid="0ec17fd5-01a5-418d-88b7-f844e61ca31b">
1425 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b16478ac-2be8-4826-a331-d89f1f9c817e">
1426 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1427 |           <remarks><p>Organizational processes that ensure individuals requiring access to
1428 | organizational information and information systems sign and re-sign
1429 | access agreements are outside the scope of Red Hat Enterprise Linux configuration.
1430 | </p></remarks>
1431 |         </by-component>
1432 |       </statement>
1433 |       <statement statement-id="ps-6_stmt.c.2" uuid="085ff1ac-a28c-4d4d-ac7c-a9458cceb105">
1434 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="b16478ac-2be8-4826-a331-d89f1f9c817e">
1435 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1436 |           <remarks><p>Organizational processes that ensure individuals requiring access to
1437 | organizational information and information systems sign and re-sign
1438 | access agreements are outside the scope of Red Hat Enterprise Linux configuration.
1439 | </p></remarks>
1440 |         </by-component>
1441 |       </statement>
1442 |     </implemented-requirement>
1443 |     <implemented-requirement uuid="71d0c115-792b-462a-a349-f36740aa5544" control-id="ps-7">
1444 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1445 |       <statement statement-id="ps-7_stmt.a" uuid="0adf029f-4aec-4849-a44d-24e76dd274e1">
1446 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="5a6b68a7-216e-4f2d-a7d6-017baa605b65">
1447 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1448 |           <remarks><p>Organizational processes to establish security requirements including
1449 | security roles and responsibilities for third-party providers are
1450 | outside the scope of Red Hat Enterprise Linux configuration.
1451 | </p></remarks>
1452 |         </by-component>
1453 |       </statement>
1454 |       <statement statement-id="ps-7_stmt.b" uuid="d7de56d7-ee30-475c-99c9-c76655387b24">
1455 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="72edc7fa-1400-43a6-a419-b63392aa46b5">
1456 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1457 |           <remarks><p>Organizational processes requiring third-party providers to comply
1458 | with personnel security polocies and procedures established by
1459 | the organization are outside the scope of Red Hat Enterprise Linux configuration.
1460 | </p></remarks>
1461 |         </by-component>
1462 |       </statement>
1463 |       <statement statement-id="ps-7_stmt.c" uuid="c93764f1-b0bd-4889-bd27-cb577fb9109c">
1464 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="71831662-dfd7-442f-8e95-0142f1d3c5c4">
1465 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1466 |           <remarks><p>Organizational processes to document presonnel security requirements
1467 | are outside the scope of Red Hat Enterprise Linux configuration.
1468 | </p></remarks>
1469 |         </by-component>
1470 |       </statement>
1471 |       <statement statement-id="ps-7_stmt.d" uuid="c6d320d9-3ce8-46fd-a00c-8963e666aee0">
1472 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="7757d8f6-0ae6-42b5-ae0f-9e3059c7efe9">
1473 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1474 |           <remarks><p>Organizational processes to require third-party providers to notify
1475 | organization-defined personnel or roles of any personnel transfers or
1476 | terminations of third-party personnel who possess organizational
1477 | credentials and/or badges, or who have information system privileges
1478 | within an organization-defined time period, are outside the
1479 | scope of Red Hat Enterprise Linux configuration.
1480 | </p></remarks>
1481 |         </by-component>
1482 |       </statement>
1483 |       <statement statement-id="ps-7_stmt.e" uuid="85911840-5a9f-4809-8966-3b61e611f684">
1484 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="9c5a474a-0081-488e-8770-80e2de25b009">
1485 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1486 |           <remarks><p>Organizational monitoring of provider compliance is outside
1487 | the scope of Red Hat Enterprise Linux configuration.
1488 | </p></remarks>
1489 |         </by-component>
1490 |       </statement>
1491 |     </implemented-requirement>
1492 |     <implemented-requirement uuid="7a65e74d-e2e7-493a-a7ba-b05985a49cb2" control-id="ps-8">
1493 |       <annotation name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable"></annotation>
1494 |       <statement statement-id="ps-8_stmt.a" uuid="53be986d-9088-4b95-a7f2-9920267fa519">
1495 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="660bfa1c-231a-4b9c-9f2a-dbc99d75ef46">
1496 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1497 |           <remarks><p>Organizational employment of a formal sanctions process for individuals
1498 | failing to comply with established information security policies
1499 | and procedures is outside the scope of Red Hat Enterprise Linux configuration.
1500 | </p></remarks>
1501 |         </by-component>
1502 |       </statement>
1503 |       <statement statement-id="ps-8_stmt.b" uuid="65d1d313-0f08-45cb-a619-0c2f61acfa0b">
1504 |         <by-component component-uuid="bdba9d56-2be4-498d-8d31-b43cab6a44bd" uuid="4a62645f-0cd3-49e8-9156-210ee0518aac">
1505 |           <description><p>Describe how is the software component satisfying the control.</p></description>
1506 |           <remarks><p>Organizational notification of organization-defined personnel
1507 | or roles within an organization-defined time period when a formal
1508 | employee santions process is initiated, identifying the individual
1509 | sanctioned and the reason for the sanction.
1510 | </p></remarks>
1511 |         </by-component>
1512 |       </statement>
1513 |     </implemented-requirement>
1514 |   </control-implementation>
1515 |   <back-matter>
1516 |     <resource uuid="3a5ca2de-0f66-47e6-844d-6ccdf214b767">
1517 |       <title>FedRAMP Applicable Laws and Regulations</title>
1518 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">fedramp-citations</prop>
1519 |       <rlink href="https://www.fedramp.gov/assets/resources/templates/SSP-A12-FedRAMP-Laws-and-Regulations-Template.xlsx"></rlink>
1520 |     </resource>
1521 |     <resource uuid="12da89ef-51dd-4404-948d-e9f0e25b961e">
1522 |       <title>FedRAMP Master Acronym and Glossary</title>
1523 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">fedramp-acronyms</prop>
1524 |       <rlink href="https://www.fedramp.gov/assets/resources/documents/FedRAMP_Master_Acronym_and_Glossary.pdf"></rlink>
1525 |     </resource>
1526 |     <resource uuid="d45612a9-cf25-4ef6-b2dd-69e38ba2967a">
1527 |       <title>[SAMPLE]Name or Title of Document</title>
1528 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">law</prop>
1529 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Publication Date</prop>
1530 |       <doc-id type="doi">Identification Number</doc-id>
1531 |       <rlink href="https://domain.example/path/to/document.pdf"></rlink>
1532 |     </resource>
1533 |     <resource uuid="a8a0cc81-800f-479f-93d3-8b8743d9b98d">
1534 |       <title>[SAMPLE]Privacy-Related Law Citation</title>
1535 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">law</prop>
1536 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">pii</prop>
1537 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Publication Date</prop>
1538 |       <doc-id type="doi">Identification Number</doc-id>
1539 |       <rlink href="https://domain.example/path/to/document.pdf"></rlink>
1540 |     </resource>
1541 |     <resource uuid="545e75c3-537f-48fe-9630-95337916d982">
1542 |       <title>[SAMPLE]Regulation Citation</title>
1543 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">regulation</prop>
1544 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Publication Date</prop>
1545 |       <doc-id type="doi">Identification Number</doc-id>
1546 |       <rlink href="https://domain.example/path/to/document.pdf"></rlink>
1547 |     </resource>
1548 |     <resource uuid="9d6cf2b4-8e88-4040-a33c-7bc206553a1a">
1549 |       <title>[SAMPLE]Interconnection Security Agreement Title</title>
1550 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1551 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1552 |     </resource>
1553 |     <resource uuid="31a46c4f-2959-4287-bc1c-67297d7da60b">
1554 |       <desc>CSP Logo</desc>
1555 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">prepared-for-logo</prop>
1556 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">csp-logo</prop>
1557 |       <rlink href="./logo.png" media-type="image/png"></rlink>
1558 |       <base64>00000000</base64>
1559 |     </resource>
1560 |     <resource uuid="c5866ad8-8ed7-49b4-844a-0276fa9f8f51">
1561 |       <desc>Preparer Logo</desc>
1562 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">prepared-by-logo</prop>
1563 |       <rlink href="./party-1-logo.png" media-type="image/png"></rlink>
1564 |       <base64>00000000</base64>
1565 |     </resource>
1566 |     <resource uuid="0846b6ef-cfa4-4bb3-8280-717f7e7b04d4">
1567 |       <desc>FedRAMP Logo</desc>
1568 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">fedramp-logo</prop>
1569 |       <rlink href="https://github.com/GSA/fedramp-automation/raw/master/assets/FedRAMP_LOGO.png"></rlink>
1570 |     </resource>
1571 |     <resource uuid="2c1747d6-874a-49a2-8488-2fd9735416bf">
1572 |       <desc>3PAO Logo</desc>
1573 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">3pao-logo</prop>
1574 |       <rlink href="./logo.png" media-type="image/png"></rlink>
1575 |       <base64>00000000</base64>
1576 |     </resource>
1577 |     <resource uuid="d2eb3c18-6754-4e3a-a933-03d289e3fad5">
1578 |       <desc>The primary authorization boundary diagram.</desc>
1579 |       <rlink href="./diagrams/boundary.png"></rlink>
1580 |       <base64>00000000</base64>
1581 |       <remarks>
1582 |             <p>Section 9.2, Figure 9-1 Authorization Boundary Diagram (graphic)</p>
1583 |             <p>This should be referenced in the
1584 |                system-characteristics/authorization-boundary/diagram/link/@href flag using a value
1585 |                of "#d2eb3c18-6754-4e3a-a933-03d289e3fad5"</p>
1586 |          </remarks>
1587 |     </resource>
1588 |     <resource uuid="61081e81-850b-43c1-bf43-1ecbddcb9e7f">
1589 |       <desc>The primary network diagram.</desc>
1590 |       <rlink href="./diagrams/network.png"></rlink>
1591 |       <base64>00000000</base64>
1592 |       <remarks>
1593 |             <p>Section 9.4, Figure 9-2 Network Diagram (graphic)</p>
1594 |             <p>This should be referenced in the
1595 |                system-characteristics/network-architecture/diagram/link/@href flag using a value
1596 |                of "#61081e81-850b-43c1-bf43-1ecbddcb9e7f"</p>
1597 |          </remarks>
1598 |     </resource>
1599 |     <resource uuid="ac5d7535-f3b8-45d3-bf3b-735c82c64547">
1600 |       <desc>The primary data flow diagram.</desc>
1601 |       <rlink href="./diagrams/dataflow.png"></rlink>
1602 |       <base64>00000000</base64>
1603 |       <remarks>
1604 |             <p>Section 10, Figure 10-1 Data Flow Diagram (graphic)</p>
1605 |             <p>This should be referenced in the
1606 |                system-characteristics/data-flow/diagram/link/@href flag using a value
1607 |                of "#ac5d7535-f3b8-45d3-bf3b-735c82c64547"</p>
1608 |          </remarks>
1609 |     </resource>
1610 |     <resource uuid="090ab379-2089-4830-b9fd-26d0729e22e9">
1611 |       <title>Policy Title</title>
1612 |       <desc>Policy document</desc>
1613 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">policy</prop>
1614 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1615 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1616 |       <rlink href="./sample_policy.pdf"></rlink>
1617 |       <base64>00000000</base64>
1618 |       <remarks>
1619 |             <p>Table 15-1 Attachments: Policy Attachment</p>
1620 |          </remarks>
1621 |     </resource>
1622 |     <resource uuid="ab300133-d749-4abb-b858-1cd6ffd8af9e">
1623 |       <title>Policy Title</title>
1624 |       <desc>Policy document</desc>
1625 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">policy</prop>
1626 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1627 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1628 |       <rlink href="./sample_policy.pdf"></rlink>
1629 |       <base64>00000000</base64>
1630 |       <remarks>
1631 |             <p>Table 15-1 Attachments: Policy Attachment</p>
1632 |          </remarks>
1633 |     </resource>
1634 |     <resource uuid="1002a58e-9e11-4aa6-9ab4-2bde52995952">
1635 |       <title>Procedure Title</title>
1636 |       <desc>Procedure document</desc>
1637 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">procedure</prop>
1638 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1639 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1640 |       <rlink href="./sample_procedure.pdf"></rlink>
1641 |       <base64>00000000</base64>
1642 |       <remarks>
1643 |             <p>Table 15-1 Attachments: Procedure Attachment</p>
1644 |          </remarks>
1645 |     </resource>
1646 |     <resource uuid="4bb1e2e5-261c-4b5c-b22c-e1627c2e8be6">
1647 |       <title>Procedure Title</title>
1648 |       <desc>Procedure document</desc>
1649 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">procedure</prop>
1650 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1651 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1652 |       <rlink href="./sample_procedure.pdf"></rlink>
1653 |       <base64>00000000</base64>
1654 |       <remarks>
1655 |             <p>Table 15-1 Attachments: Procedure Attachment</p>
1656 |          </remarks>
1657 |     </resource>
1658 |     <resource uuid="90a128ac-c850-48f6-8fff-a55692f80b41">
1659 |       <title>User's Guide</title>
1660 |       <desc>User&#39;s Guide</desc>
1661 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">user-guide</prop>
1662 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">guide</prop>
1663 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1664 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1665 |       <rlink href="./sample_guide.pdf"></rlink>
1666 |       <base64>00000000</base64>
1667 |       <remarks>
1668 |             <p>Table 15-1 Attachments: User's Guide Attachment</p>
1669 |          </remarks>
1670 |     </resource>
1671 |     <resource uuid="fab59751-b855-40cb-93c1-492562e20e18">
1672 |       <title>Privacy Impact Assessment</title>
1673 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">privacy-impact-assessment</prop>
1674 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1675 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1676 |       <rlink href="./pia.docx"></rlink>
1677 |       <base64 filename="pia.docx">00000000</base64>
1678 |       <remarks>
1679 |             <p>Table 15-1 Attachments: Privacy Impact Assessment</p>
1680 |          </remarks>
1681 |     </resource>
1682 |     <resource uuid="489112e1-57f2-4c29-8dd0-95b1442fbf3b">
1683 |       <title>Document Title</title>
1684 |       <desc>Rules of Behavior</desc>
1685 |       <prop name="conformity" ns="https://fedramp.gov/ns/oscal">rules-of-behavior</prop>
1686 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">rob</prop>
1687 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1688 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1689 |       <rlink href="https://sample"></rlink>
1690 |       <base64>00000000</base64>
1691 |       <remarks>
1692 |             <p>Table 15-1 Attachments: Rules of Behavior (ROB)</p>
1693 |          </remarks>
1694 |     </resource>
1695 |     <resource uuid="c7860916-f2f4-43aa-b578-d48cf8e6d381">
1696 |       <title>Document Title</title>
1697 |       <desc>Contingency Plan (CP)</desc>
1698 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">plan</prop>
1699 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1700 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1701 |       <rlink href="https://sample"></rlink>
1702 |       <base64>00000000</base64>
1703 |       <remarks>
1704 |             <p>Table 15-1 Attachments: Contingency Plan (CP) Attachment</p>
1705 |          </remarks>
1706 |     </resource>
1707 |     <resource uuid="ab56cf27-0dae-40d6-89b7-d750137309af">
1708 |       <title>Document Title</title>
1709 |       <desc>Configuration Management (CM) Plan</desc>
1710 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">plan</prop>
1711 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1712 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1713 |       <rlink href="https://sample"></rlink>
1714 |       <base64>00000000</base64>
1715 |       <remarks>
1716 |             <p>Table 15-1 Attachments: Configuration Management (CM) Plan Attachment</p>
1717 |          </remarks>
1718 |     </resource>
1719 |     <resource uuid="3f771ab5-8016-4571-98d1-f0fb962e15e2">
1720 |       <title>Document Title</title>
1721 |       <desc>Incident Response (IR) Plan</desc>
1722 |       <prop name="type" ns="https://fedramp.gov/ns/oscal">plan</prop>
1723 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1724 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1725 |       <rlink href="https://sample"></rlink>
1726 |       <base64>00000000</base64>
1727 |       <remarks>
1728 |             <p>Table 15-1 Attachments: Incident Response (IR) Plan Attachment</p>
1729 |          </remarks>
1730 |     </resource>
1731 |     <resource uuid="49fb4631-1da2-41ca-b0b3-e1b1006d4025">
1732 |       <title>Separation of Duties Matrix</title>
1733 |       <desc>Separation of Duties Matrix</desc>
1734 |       <prop name="publication" ns="https://fedramp.gov/ns/oscal">Document Date</prop>
1735 |       <prop name="version" ns="https://fedramp.gov/ns/oscal">Document Version</prop>
1736 |       <rlink href="https://sample"></rlink>
1737 |       <base64>00000000</base64>
1738 |       <remarks>
1739 |             <p>Table 15-1 Attachments: Separation of Duties Matrix Attachment</p>
1740 |          </remarks>
1741 |     </resource>
1742 |     <resource uuid="9f1aae37-7359-411f-86c1-768aaab85e63">
1743 |       <title>FedRAMP High Baseline</title>
1744 |       <rlink href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.0-milestone3/content/fedramp.gov/xml/FedRAMP_HIGH-baseline_profile.xml" media-type="application/xml"></rlink>
1745 |       <remarks>
1746 |             <p>Pointer to High baseline content in OSCAL.</p>
1747 |          </remarks>
1748 |     </resource>
1749 |     <resource uuid="890170c3-d4fa-4d25-ab96-8e4bf7cc237c">
1750 |       <title>FedRAMP Moderate Baseline</title>
1751 |       <rlink href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.0-milestone3/content/fedramp.gov/xml/FedRAMP_MODERATE-baseline_profile.xml" media-type="application/xml"></rlink>
1752 |       <remarks>
1753 |             <p>Pointer to Moderate baseline content in OSCAL.</p>
1754 |          </remarks>
1755 |     </resource>
1756 |     <resource uuid="2acaf846-5496-4d36-8565-9a15b48aef2c">
1757 |       <title>FedRAMP Low Baseline</title>
1758 |       <rlink href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.0-milestone3/content/fedramp.gov/xml/FedRAMP_LOW-baseline_profile.xml" media-type="application/xml"></rlink>
1759 |       <remarks>
1760 |             <p>Pointer to Low baseline content in OSCAL.</p>
1761 |          </remarks>
1762 |     </resource>
1763 |   </back-matter>
1764 | </system-security-plan>


--------------------------------------------------------------------------------