Add documentation for "authorization-type"

[Rene2mt]

This is a ...

fix - something needs to be different

This relates to ...

• the FedRAMP OSCAL baselines
• the FedRAMP SSP OSCAL Example
• the FedRAMP SAP OSCAL Example
• the FedRAMP SAR OSCAL Example
• the FedRAMP POA&M OSCAL Example
• the FedRAMP OSCAL Validations
• the Not sure

User Story

As a FedRAMP OSCAL stakeholder, I need to understand how to represent the various authorization types (e.g., agency authorizations, and LI-SaaS), so that how "this system" and/or leveraged authorizations were authorized.

Goals

FedRAMP has an extension prop called "authorization-type" that indicates whether a system received via the FedRAMP JAB, FedRAMP Agency , or FedRAMP Tailored for LI-SaaS path. Note that the JAB ATO path is being discontinued. Upon review of issue #1190, it was noted that the "authorization-type" FedRAMP extension prop is under documented.

The goal of this issue is to add the following to a new FedRAMP OSCAL SSP > SSP Template Topic Areas > Authorization Paths page in the FedRAMP developer hub:

• Add a section for the "Agency Authorization Path" and "LI-SaaS Authorization Path" to document the "authorization-type" FedRAMP extension.
• Include documentation on the allowed values for this FedRAMP extension
• Include JSON, XML, and YAML examples
• Address any validation rules / constraints that apply to this content

For LI-SaaS Only

Need to make sure documentation explains clearly some of the special handling for LI-SaaS, specifically:

• The SSP must import the LI-SaaS baseline (profile or resolved profile catalog)
• The SSP must have the cloud service model set to “saas”: <prop name="cloud-service-model" value="saas">
• The SSP must have the authorization type set accordingly: <prop ns="http://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-li-saas"/>
  • Allowed values are “fedramp-agency” and “fedramp-li-saas”. "fedramp-jab" is deprecated.
• The SSP must have the security sensitivity level set to “fips-199-low”
• The SSP must have all the security impact levels set to “fips-199-low”

Dependencies

No response

Acceptance Criteria

• All FedRAMP Documents Related to OSCAL Adoption (https://github.com/GSA/fedramp-automation) affected by the changes in this issue have been updated.
• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.

Other information

No response

[aj-stein-gsa]

I am cool with this moving forward @Rene2mt, I moved it to ready state.