Leveraged Authorization

[TelosPO]

Question

It seems like Leveraged Authorization shouldn't be part of Control Implementation section

[david-waltermire]

@TelosPO Would you explain why Leveraged Authorization shouldn't be part of Control Implementation section and provide a suggestion of how to address this concern?

[TelosPO]

When we have inherited controls we use the component definitions to leverage the control, so the Prop Leveraged Authorization would in essence be legacy and not needed for the inherited control

[aj-stein-nist]

When we have inherited controls we use the component definitions to leverage the control, so the Prop Leveraged Authorization would in essence be legacy and not needed for the inherited control

I think to the point posed here, can you please provide some minimal example to explain the challenge with this particular construct in the SSP with leveraged authorization and how it would be used today? If you need assistance with that, perhaps we can discuss that synchronously in a meeting @TelosPO and post it here? Thanks.

[iMichaela]

When we have inherited controls we use the component definitions to leverage the control, so the Prop Leveraged Authorization would in essence be legacy and not needed for the inherited control

I think to the point posed here, can you please provide some minimal example to explain the challenge with this particular construct in the SSP with leveraged authorization and how it would be used today? If you need assistance with that, perhaps we can discuss that synchronously in a meeting @TelosPO and post it here? Thanks.

I would like to also better understand if the OSCAL Component Definition model is used (as stated) to convey any control inheritance information or it is the component of the SSP. Looping in @Compton-NIST too due to his CRM work and the relation to the leveraged/leveraging authorizations.