Assessment Plan (SAP)
OSCAL Model: Security Assessment Plan
The Security Assessment Plan (SAP) model defines the plan for assessing the security controls of an information system. It describes the scope, methodology, schedule, and resources required for a security assessment.
Summit Context
This directory contains the OSCAL Assessment Plan artifacts for the Summit system by Oscalate Systems. These files define how the Summit system’s security controls will be assessed.
What Belongs Here
- OSCAL Assessment Plan files (JSON, XML, or YAML)
- Assessment scope and methodology definitions
- Assessment schedules and resource assignments
- Test case definitions
Key Concepts
- Import SSP: Reference to the SSP being assessed
- Assessment Subjects: Components, inventory items, and users in scope
- Assessment Activities: Specific test methods and procedures
- Tasks: Scheduled assessment activities and milestones
- Reviewed Controls: Controls selected for assessment
OSCAL Reference