TAMUS OSCAL Namespace Dictionary

This documentation defines the custom extensions to the NIST OSCAL schema used by the Texas A&M University System (TAMUS). These extensions allow for the tracking of institutional baselines, compliance deadlines, and common control inheritance within OSCAL Profile and Catalog documents.

Namespace Identifier

URL: https://cyber.tamus.edu/ns/oscal

When utilizing these fields in OSCAL YAML, ensure the ns attribute points to the URL above to maintain schema validity and clarity.

---

Profile Extensions

Properties (props)

These properties provide TAMUS-specific metadata for specific control selections.

Name	Value Type	Allowed Values / Format	Description
tamus_baseline	string	LOW, MODERATE, HIGH	Indicates the specific NIST 800-53B baseline targeted by this control.
tamus_required_by	date	YYYY-MM-DD (ISO 8601)	The deadline for full implementation or compliance with the associated control.
tamus_control_type	string	common, hybrid	Categorizes the control based on its inheritance model within the system.
tamus_control_provider	string	Free text	The name of the entity or office providing the common control.

Parts (parts)

Used to inject TAMUS-specific narrative or requirements into control definitions.

Name	Content Type	Description
tamus_implementation	prose (Markdown)	The official TAMUS implementation standard or system-wide requirement for the control.

---

YAML Implementation Example

The following example demonstrates how to reference the TAMUS namespace and apply these custom attributes within an OSCAL Profile.

---
profile:
  metadata:
    title: Texas A&M University System Security Control Profile
    version: "1.0"
    oscal-version: 1.1.2
    alters:
      - control-id: ac-2.7
        adds: 
          - position: ending
            props: 
              - ns: "https://cyber.tamus.edu/ns/oscal"
                name: tamus_baseline
                value: MODERATE
              - ns: "https://cyber.tamus.edu/ns/oscal"
                name: tamus_required_by
                value: 2022-08-01
      - control-id: ac-19
        adds:
          - position: before
            by-id: ac-19_gdn
            parts:
              - id: ac-19_tamus_smt
                ns: "https://cyber.tamus.edu/ns/oscal"
                name: tamus_implementation
                prose: >-
                  Require the implementation of a mobile device management (MDM) product on all organization-controlled
                  mobile devices.
      - control-id: at-2
        adds:
          - position: ending
            props:
              - ns: "https://cyber.tamus.edu/ns/oscal"
                name: tamus_control_type
                value: common
              - ns: "https://cyber.tamus.edu/ns/oscal"
                name: tamus_control_provider
                value: "TAMUS Cybersecurity"