diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
index 2a94a8c82..7b863e096 100644
--- a/features/fedramp_extensions.feature
+++ b/features/fedramp_extensions.feature
@@ -9,6 +9,7 @@ Scenario Outline: Documents that should be valid are pass
   Then I should have valid results "<valid_file>"
 Examples:
 | valid_file     |
+| fedramp-ssp-example.oscal.xml |
 # | ssp-all-VALID.xml |
 # | ../../../content/awesome-cloud/xml/AwesomeCloudSSP1.xml |
 # | ../../../content/awesome-cloud/xml/AwesomeCloudSSP2.xml |
diff --git a/src/validations/constraints/content/fedramp-ssp-example.oscal.xml b/src/validations/constraints/content/fedramp-ssp-example.oscal.xml
index a8272221a..732bbc089 100644
--- a/src/validations/constraints/content/fedramp-ssp-example.oscal.xml
+++ b/src/validations/constraints/content/fedramp-ssp-example.oscal.xml
@@ -1,7 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <?xml-model href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.4/xml/schema/oscal_complete_schema.xsd" schematypens="http://www.w3.org/2001/XMLSchema" title="OSCAL complete schema"?>
-<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
-   uuid="11111111-2222-4000-8000-000000000000">
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="11111111-2222-4000-8000-000000000000">
    <metadata>
       <title>FedRAMP [Baseline Name] System Security Plan (SSP)</title>
       <published>2024-12-31T23:59:59Z</published>
@@ -13,8 +12,7 @@
             <published>2023-06-30T00:00:00Z</published>
             <version>1.0</version>
             <oscal-version>1.0.4</oscal-version>
-            <prop ns="http://fedramp.gov/ns/oscal" name="party-uuid"
-               value="11111111-2222-4000-8000-004000000001"/>
+            <prop ns="https://fedramp.gov/ns/oscal" name="party-uuid" value="11111111-2222-4000-8000-004000000001"/>
             <remarks>
                <p>Initial publication.</p>
             </remarks>
@@ -23,15 +21,14 @@
             <published>2023-07-06T00:00:00Z</published>
             <version>1.1</version>
             <oscal-version>1.0.4</oscal-version>
-            <prop ns="http://fedramp.gov/ns/oscal" name="party-uuid"
-               value="11111111-2222-4000-8000-004000000001"/>
+            <prop ns="https://fedramp.gov/ns/oscal" name="party-uuid" value="11111111-2222-4000-8000-004000000001"/>
             <remarks>
                <p>Minor <code>prop</code> updates.</p>
             </remarks>
          </revision>
       </revisions>
       <prop name="marking" value="cui" class="fedramp.gov"/>
-      <prop name="fedramp-version" ns="http://fedramp.gov/ns/oscal" value="fedramp-3.0.0-oscal-1.1.2" />
+      <prop name="fedramp-version" ns="https://fedramp.gov/ns/oscal" value="fedramp-3.0.0rc1-oscal-1.1.2"/>
       <!-- The following role definitions are required by FedRAMP -->
       <!-- Do not change the ID's or titles. -->
       <role id="fedramp-pmo">
@@ -287,7 +284,8 @@
          <remarks>
             <p>Replace sample CSP information.</p>
             <p>CSP information must be present and associated with the "cloud-service-provider" role
-               via <code>responsible-party</code>.</p>
+               via <code>responsible-party</code>.
+            </p>
          </remarks>
       </party>
       <party uuid="11111111-2222-4000-8000-004000000002" type="organization">
@@ -563,8 +561,7 @@
 
 
    </metadata>
-   <import-profile
-      href="https://raw.githubusercontent.com/GSA/fedramp-automation/refs/heads/master/dist/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml">
+   <import-profile href="https://raw.githubusercontent.com/GSA/fedramp-automation/refs/heads/master/dist/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml">
       <remarks>
          <p>This example points to the FedRAMP Rev 5 Moderate baseline that is part of the official
             FedRAMP 3.0.0 release.</p>
@@ -574,7 +571,7 @@
    <system-characteristics>
       <!-- Section 3 - System Information -->
       <!-- Table 3.1 Information System Name and Title -->
-      <system-id identifier-type="http://fedramp.gov">F00000000</system-id>
+      <system-id identifier-type="https://fedramp.gov">F00000000</system-id>
       <system-name>System's Full Name</system-name>
       <system-name-short>System's Short Name or Acronym</system-name-short>
       <!-- General System Description -->
@@ -608,10 +605,10 @@
       <prop name="identity-assurance-level" value="2"/>
       <prop name="authenticator-assurance-level" value="2"/>
       <prop name="federation-assurance-level" value="2"/>
-      <prop ns="http://fedramp.gov/ns/oscal" name="fully-operational-date" value="2023-12031T00:00:00z"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="fully-operational-date" value="2023-01-01+00:00"/>
       <!-- Rev5 update - new prop -->
       <!-- FedRAMP Authorization Path: fedramp-jab, fedramp-agency, or fedramp-li-saas -->
-      <prop ns="http://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency"/>
       <!-- FIPS PUB 199 Level -->
       <security-sensitivity-level>fips-199-moderate</security-sensitivity-level>
       <system-information>
@@ -777,16 +774,16 @@
 
       <leveraged-authorization uuid="11111111-2222-4000-8000-019000000001">
          <title>AwesomeCloud Commercial(IaaS)</title>
-         <prop ns="http://fedramp.gov/ns/oscal" name="leveraged-system-identifier"
-            value="F9999999999"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency">
+
+         <prop ns="https://fedramp.gov/ns/oscal" name="leveraged-system-identifier" value="F9999999999"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency">
             <remarks>
                <p>For now, this is a required field. In the future we intend 
                   to pull this information directly from FedRAMP's records
                   based on the "leveraged-system-identifier" property's value.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="impact-level" value="fips-199-moderate">
+         <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="fips-199-moderate">
             <remarks>
                <p>For now, this is a required field. In the future we intend 
                   to pull this information directly from FedRAMP's records
@@ -807,9 +804,17 @@
       </leveraged-authorization>
 
       <user uuid="11111111-2222-4000-8000-008000000001">
+         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
+         <prop name="type" value="internal"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+         <role-id>system-poc-technical</role-id>
          <authorized-privilege>
-            <title></title>
-            <function-performed>none</function-performed>
+            <title>Admin</title>
+            <description>
+               <p>admin user</p>
+            </description>
+            <function-performed>administration</function-performed>
          </authorized-privilege>
          <remarks>
             <p>The user assembly is being reviewed for continued applicability 
@@ -820,31 +825,57 @@
          </remarks>
       </user>
       <user uuid="11111111-2222-4000-8000-008000000002">
-         <prop name="separation-of-duties-matrix" value="yes" ns="http://fedramp.gov/ns/oscal" />
+         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
+         <prop name="type" value="internal"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
+
+         <role-id>system-poc-technical</role-id>
          <authorized-privilege>
             <title>Add/Remove Admins</title>
             <function-performed>This can add and remove admins.</function-performed>
          </authorized-privilege>
       </user>
       <user uuid="11111111-2222-4000-8000-008000000003">
-         <prop name="separation-of-duties-matrix" value="yes" ns="http://fedramp.gov/ns/oscal" />
+         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
+         <prop name="type" value="internal"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
+         <role-id>system-poc-technical</role-id>
          <authorized-privilege>
-            <title></title>
-            <function-performed>add/remove non-privliged admins</function-performed>
+            <title>Admin</title>
+            <description>
+               <p>admin user</p>
+            </description>
+            <function-performed>administration</function-performed>
          </authorized-privilege>
       </user>
       <user uuid="11111111-2222-4000-8000-008000000004">
-         <prop name="separation-of-duties-matrix" value="yes" ns="http://fedramp.gov/ns/oscal" />
+         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
+         <prop name="type" value="internal"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+         <role-id>system-poc-technical</role-id>
          <authorized-privilege>
-            <title></title>
-            <function-performed>Manage services and components within the virtual cloud environment.</function-performed>
+            <title>Admin</title>
+            <description>
+               <p>admin user</p>
+            </description>
+            <function-performed>administration</function-performed>
          </authorized-privilege>
       </user>
       <user uuid="11111111-2222-4000-8000-008000000005">
-         <prop name="separation-of-duties-matrix" value="yes" ns="http://fedramp.gov/ns/oscal" />
+         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
+         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
+         <prop name="type" value="internal"/>
+         <role-id>system-owner</role-id>
          <authorized-privilege>
-            <title></title>
-            <function-performed>Add and remove users from the virtual cloud environment.</function-performed>
+            <title>Admin</title>
+            <description>
+               <p>admin user</p>
+            </description>
+            <function-performed>administration</function-performed>
          </authorized-privilege>
       </user>
       <!-- ========= MINIMUM REQUIRED COMPONENT: THIS SYSTEM ======= -->
@@ -883,16 +914,16 @@
          <prop name="leveraged-authorization-uuid" value="11111111-2222-4000-8000-019000000001"/>
          <prop name="implementation-point" value="external"/>
          <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001" />
-         <prop ns="http://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
             <remarks>
                <p>If 'yes', describe the authentication method.</p>
                <p>If 'no', explain why no authentication is used.</p>
                <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
          <status state="operational"/>
 
          <responsible-role role-id="provider">
@@ -905,8 +936,8 @@
             </remarks>
          </responsible-role>
          <responsible-role role-id="administrator">
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="http://fedramp.gov/ns/oscal" />
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000005" ns="http://fedramp.gov/ns/oscal" />
+            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="https://fedramp.gov/ns/oscal" />
+            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000005" ns="https://fedramp.gov/ns/oscal" />
          </responsible-role>
          <remarks>
             <p>This is a leveraged system within which this system operates.
@@ -942,7 +973,7 @@
             </ul>
             <p/>
             <p>Links to the vendor website describing the system are encouraged, but not required.</p>
-            
+
             <h1>Services</h1>
             <p>A service within the scope of the leveraged system's authorization boundary 
                is considered an "authorized service". Any other service offered by the 
@@ -961,12 +992,13 @@
                a "poam-item" link that references a corrisponding entry in this system's
                POA&amp;M.</li>
             </ul>
-            
+
             <p>Both authorized and non-authorized leveraged services include:</p>
             <ul>
                <li>a "provided-by" link with a URI fragment that points
                to the "system" component representing the leveraged system. 
-               (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)</li>
+               (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)
+               </li>
                <li>the name of the service in the title (for authorized services this should be 
                   exactly as it appears in the FedRAMP Marketplace</li>
                <li>an "implementation-point" core property with a value of "external"</li>
@@ -978,7 +1010,7 @@
                <li>a status with a state value of "operational"</li>
                <li>At least one responsible-role (other than "provider") that indicates any authorized
                   users. This must have one or more "privilege-uuid" property/extensions. Each references
-                  a user assembly entry.</li>               
+                  a user assembly entry.</li>
             </ul>
 
             <p>Although SSP Table 7.1 also requires data categoriation and hosting
@@ -996,13 +1028,13 @@
          </description>
          <prop name="leveraged-authorization-uuid" value="11111111-2222-4000-8000-019000000001"/>
          <prop name="implementation-point" value="external"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
          <link rel="provided-by" href="#11111111-2222-4000-8000-009000100001"/>
          <status state="operational"/>
          <responsible-role role-id="administrator">
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="http://fedramp.gov/ns/oscal" />
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000005" ns="http://fedramp.gov/ns/oscal" />
+            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="https://fedramp.gov/ns/oscal" />
+            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000005" ns="https://fedramp.gov/ns/oscal" />
          </responsible-role>
          <remarks>
             <p>This is a service offered by a leveraged system and used by this system.
@@ -1017,7 +1049,8 @@
                leveraged-authorization entry</li>
                <li>an "implementation-point" property with a value of "external"; and</li>
                <li>a "provided-by" link with a URI fragment that points  to the 
-                  "system" component representing the leveraged system. (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)</li>
+                  "system" component representing the leveraged system. (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)
+               </li>
             </ul>
             <p/>
             <p>Where relevant, this component should also have:</p>
@@ -1055,23 +1088,27 @@
             <p>Describe the service and what it is used for.</p>
          </description>
          <prop name="implementation-point" value="external" />
-         <prop name="direction" value="outgoing"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="still-supported" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="provider" value="self"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="still-supported" value="yes"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
             <remarks>
                <p>If 'yes', describe the authentication method.</p>
                <p>If 'no', explain why no authentication is used.</p>
                <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1" />
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8" />
-         <prop name="poam-item-uuid" ns="http://fedramp.gov/ns/oscal" value="11111111-3333-4000-8000-000000000001" />
-         <prop name="poam-id" ns="http://fedramp.gov/ns/oscal" value="ID-0001" />
-         <link  rel="provided-by" href="#11111111-2222-4000-8000-009000100001" />
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1" />
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8" />
+         <prop name="poam-item-uuid" ns="https://fedramp.gov/ns/oscal" value="11111111-3333-4000-8000-000000000001" />
+         <prop name="poam-id" ns="https://fedramp.gov/ns/oscal" value="ID-0001" />
+         <link rel="provided-by" href="#11111111-2222-4000-8000-009000100001" />
          <status state="operational" />
          <responsible-role role-id="admin">
-            
+
+         </responsible-role>
+         <responsible-role role-id="provider">
+            <party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
          </responsible-role>
          <remarks>
             <p>This is a service offered by a leveraged system and used by this system.
@@ -1092,7 +1129,8 @@
                   POAM&amp;M ID (legacy) in a Excel workbook or poam-item-uuid (preferred)
                   in an OSCAL-based POA&amp;M.</li>
                <li>a "provided-by" link with a URI fragment that points to the 
-                  "system" component representing the leveraged system. (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)</li>
+                  "system" component representing the leveraged system. (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)
+               </li>
                <li></li>
                <li></li>
 
@@ -1101,7 +1139,7 @@
                tools are able to distinguish between authorized and non-authorized services
                from the same leveraged provider.</p>
             <p/>
-            
+
             <p>Where relevant, this component should also have:</p>
             <ul>
                <li>At least one responsible-role that indicates the authorized userswith a role-id of "leveraged-authorization-users" and exactly
@@ -1118,7 +1156,7 @@
                <li>Package ID, Authorization Type, Impact Level</li>
             </ul>
             <p/>
-            
+
             <p>- An "inherited-uuid" property if the leveraged system's owner provides a UUID for
                their system (such as in an OSCAL-based CRM).</p>
             <p>Link(s) to the vendor's web site describing the service are encouraged, but not
@@ -1138,20 +1176,20 @@
 
       <!-- Scenario 2: An interconnection between this system and an external system -->
       <!-- Scenario 2 - Part 1: An external system with which this system has an interconnection -->
-      <component uuid="11111111-2222-4000-8000-009000100002" type="system">
+      <component uuid="11111111-2222-4000-8000-009000100002" type="service">
          <title>Other Cloud SaaS</title>
          <description>
             <p>An external system to which this system shares an interconnection.</p>
          </description>
          <prop name="asset-type" value="saas"/>
-         
+
          <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001" />
-         
+
          <status state="operational"/>
 
          <responsible-role role-id="provider">
             <party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
-         </responsible-role>         
+         </responsible-role>
          <responsible-role role-id="authorizing-official">
             <party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
          </responsible-role>
@@ -1183,7 +1221,7 @@
                   remote listening ports, one or more "protocol" assemblies must
                   be provided.</li>
             </ul>
-            
+
             <p>While not required, each "system" component should have:</p>
             <ul>
                <li>an "inherited-uuid" property if the value was provided by the system owner</li>
@@ -1192,7 +1230,7 @@
                <li>an "system-owner" responsible-role</li>
                <li>an "system-poc-management" responsible-role</li>
                <li>an "system-poc-technical" responsible-role</li>
-            </ul>  
+            </ul>
             <p>Unlike prior FedRAMP OSCAL publications, avoid the use of FedRAMP 
                properties/extensions for these roles, instead favor the core OSCAL
                responsible-roles constructs, and the NIST-standard roles of 
@@ -1202,50 +1240,50 @@
       </component>
 
       <!-- Scenario 2 - Part 2: Interconnection to external system -->
-      <component uuid="11111111-2222-4000-8000-009000200001" type="interconnection">
+      <component uuid="11111111-2222-4000-8000-009000200001" type="service">
          <!-- Use title element to provid System/ Service/ API/CLI Name -->
          <title>[EXAMPLE]Authorized Connection Information System Name</title>
          <description>
             <p>Describe the purpose of the external system/service; specifically, provide reasons
                for connectivity (e.g., system monitoring, system alerting, download updates, etc.)</p>
          </description>
-         <prop name="direction" value="incoming"/>
-         <prop name="direction" value="outgoing"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="nature-of-agreement" value="contract"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="incoming"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="contract"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
             <remarks>
                <p>If 'yes', describe the authentication method in the remarks.</p>
                <p>If 'no', explain why no authentication is used in the remarks.</p>
                <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="compliance" value="soc-2-type-1"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="compliance" value="pci-dss"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="compliance" value="iso-27001"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="hosting-environment" value="see-remarks">
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="compliance" value="soc-2-type-1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="compliance" value="pci-dss"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="compliance" value="iso-27001"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="hosting-environment" value="see-remarks">
             <remarks>
                <p>Describe the hosting of the interconnection itself (NOT the hosting of the remote system).</p>
             </remarks>
          </prop>
 
 
-         <prop name="ipv4-address" class="local" value="10.1.1.1"/>
-         <prop name="ipv6-address" class="local" value="::ffff:10.1.1.1"/>
-         <prop name="ipv4-address" class="remote" value="10.2.2.2"/>
-         <prop name="ipv6-address" class="remote" value="::ffff:10.2.2.2"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="ipv4-address" class="local" value="10.1.1.1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="ipv6-address" class="local" value="::ffff:10.1.1.1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="ipv4-address" class="remote" value="10.2.2.2"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="ipv6-address" class="remote" value="::ffff:10.2.2.2"/>
 
-         <prop ns="http://fedramp.gov/ns/oscal" name="connection-security" value="ipsec" />
+         <prop ns="https://fedramp.gov/ns/oscal" name="connection-security" value="ipsec" />
 
          <link rel="agreement" href="#11111111-2222-4000-8000-001000000058"/>
-         <link rel="used-by"   href="#11111111-2222-4000-8000-009000000000" />
-         <link rel="used-by"   href="#11111111-2222-4000-8000-009000100002" />
+         <link rel="used-by" href="#11111111-2222-4000-8000-009000000000" />
+         <link rel="used-by" href="#11111111-2222-4000-8000-009000100002" />
+
 
-         
 
          <status state="operational"/>
-         
+
          <responsible-role role-id="provider">
             <party-uuid>44444444-2222-4000-8000-004000000001</party-uuid>
          </responsible-role>
@@ -1293,7 +1331,7 @@
                <li>a "compliance" property/extension if appropriate</li>
                <li>an "system-poc-management" responsible-role</li>
                <li>an "system-poc-technical" responsible-role</li>
-            </ul>  
+            </ul>
             <p>Unlike prior FedRAMP OSCAL publications, avoid the use of FedRAMP 
                properties/extensions for these roles, instead favor the core OSCAL
                responsible-roles constructs, and the NIST-standard roles of 
@@ -1309,13 +1347,13 @@
          <description>
             <p/>
          </description>
-         <prop ns="http://fedramp.gov/ns/oscal" name="asset-type" value="saas"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="nature-of-agreement" value="isa" /> 
+         <prop ns="https://fedramp.gov/ns/oscal" name="asset-type" value="saas"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="isa" />
          <prop name="implementation-point" value="external" />
          <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001" />
-         
+
          <status state="operational"/>
-         
+
          <responsible-role role-id="system-owner">
             <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
          </responsible-role>
@@ -1337,8 +1375,8 @@
                here.</p>
             <p>For an external system, the "implementation-point" property must always be present
                with a value of "external".</p>
-            
-            
+
+
             <p>Each interconnection must be defined with both an "system" component and an
                "interconnection" component.</p>
             <p>Must include all leveraged services and features from the leveraged authorization
@@ -1354,17 +1392,18 @@
             <p>Describe the service and what it is used for.</p>
          </description>
          <prop name="implementation-point" value="external"/>
-<!--         <prop name="direction" value="outgoing"/>-->
-         <prop ns="http://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+         <!--         <prop name="direction" value="outgoing"/>-->
+         <prop name="leveraged-authorization-uuid" value="11111111-2222-4000-8000-019000000001"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
             <remarks>
                <p>If 'yes', describe the authentication method in the remarks.</p>
                <p>If 'no', explain why no authentication is used in the remarks.</p>
                <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
          <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001">
             <remarks>
                <p>This can only be known if provided by the leveraged system.
@@ -1374,20 +1413,21 @@
          </prop>
          <link rel="provided-by" href="#11111111-2222-4000-8000-009000100003" />
          <status state="operational"/>
-         
-         <responsible-role role-id="provider">
-            <party-uuid>11111111-2222-4000-8000-c0040000000a</party-uuid>
-         </responsible-role>
+
          <responsible-role role-id="leveraged-authorization-users">
             <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
             <party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
          </responsible-role>
+         <responsible-role role-id="provider">
+            <party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
+         </responsible-role>
+
          <protocol name="abc" uuid="11111111-2222-4000-8000-010000000003">
             <title></title>
-            <port-range start="5432" end="5432" transport="tcp" />
+            <port-range start="5432" end="5432" transport="TCP" />
          </protocol>
-         
+
          <remarks>
             <p>This is a service provided by an external system other than the leveraged system.</p>
             <p>As a result, the "leveraged-authorization-uuid" property is not applicable and must
@@ -1404,7 +1444,8 @@
             <p>- An "implementation-point" property with a value of "external".</p>
             <p>- A "provided-by" link with a URI fragment that points to the UUID of the above
                "system" component.</p>
-            <p> - Example: <code>"#11111111-2222-4000-8000-009000100001"</code></p>
+            <p> - Example: <code>"#11111111-2222-4000-8000-009000100001"</code>
+            </p>
             <p> - IMPORTANT: Due to a known error in core OSCAL (versions &lt;=1.1.2) constraints,
                this property is blocked from proper use.</p>
             <p>- a status with a state value of "operational"</p>
@@ -1435,50 +1476,58 @@
       <!-- Scenario 4: A service from this system offered to external systems -->
       <component uuid="11111111-2222-4000-8000-009000500004" type="service">
          <title>Service C</title>
+
          <description>
             <p>A service provided by an external system other than the leveraged system.</p>
             <p>Describe the service and what it is used for.</p>
          </description>
+
          <prop name="implementation-point" value="internal"/>
-         <prop name="direction" value="outgoing"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+         <prop ns="https://fedramp.gov/ns/oscal" name="provider" value="self"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
             <remarks>
                <p>If 'yes', describe the authentication method in the remarks.</p>
                <p>If 'no', explain why no authentication is used in the remarks.</p>
                <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="risk" value="see-remarks">
+         <prop ns="https://fedramp.gov/ns/oscal" name="risk" value="see-remarks">
             <remarks>
                <p>Either describe a risk associated with this service, or indicate there is no identified risk.</p>
                <p>If there is no risk, please explain your basis for that conclusion.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="impact" value="see-remarks">
+         <prop ns="https://fedramp.gov/ns/oscal" name="impact" value="see-remarks">
             <remarks>
                <p>If there are one or more identified risks, describe any resulting impact.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="mitigation" value="see-remarks">
+         <prop ns="https://fedramp.gov/ns/oscal" name="mitigation" value="see-remarks">
             <remarks>
                <p>If there are one or more identified risks, describe any mitigating factors.</p>
             </remarks>
-         </prop>      
-         
+         </prop>
+
          <!-- <link href="11111111-2222-4000-8000-009000000000" rel="used-by"/> -->
          <link rel="api" href="https://api.example.com/v1" />
          <status state="operational"/>
+         <responsible-role role-id="provider">
+            <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
+         </responsible-role>
+
          <protocol name="remote" uuid="11111111-2222-4000-8000-010000000002">
             <title>Remote API Service</title>
             <port-range start="443" end="443" transport="TCP"/>
          </protocol>
+
          <remarks>
             <p>This is a service provided by an external system other than the leveraged system.</p>
 
 
 
             <p>- A "risk" property/extension - using the remarks, either describe any risk or state there is no risk and provide a basis for that assertion.</p>
-            
+
 
 
             <p>As a result, the "leveraged-authorization-uuid" property is not applicable and must
@@ -1490,10 +1539,10 @@
             <p>If the leveraged system owner provides a UUID for their service (such as in an
                OSCAL-based CRM), it should be reflected in the <code>inherited-uuid</code>
                property.</p>
-            
-            
-            
-            
+
+
+
+
          </remarks>
       </component>
 
@@ -1505,32 +1554,33 @@
          </description>
          <prop name="asset-type" value="cli"/>
          <prop name="implementation-point" value="internal"/>
-         <prop name="direction" value="outgoing"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+         <prop ns="https://fedramp.gov/ns/oscal" name="provider" value="self"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
             <remarks>
                <p>If 'yes', describe the authentication method in the remarks.</p>
                <p>If 'no', explain why no authentication is used in the remarks.</p>
                <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
             </remarks>
-         </prop>         
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="web"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="login-url" value="https://admin.offering.com/login"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="risk" value="see-remarks">
+         </prop>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="web"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="login-url" value="https://admin.offering.com/login"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="risk" value="see-remarks">
             <remarks>
                <p>Either describe a risk associated with this CLI, or indicate there is no identified risk.</p>
                <p>If there is no risk, please explain your basis for that conclusion.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="impact" value="see-remarks">
+         <prop ns="https://fedramp.gov/ns/oscal" name="impact" value="see-remarks">
             <remarks>
                <p>If there are one or more identified risks, describe any resulting impact.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="mitigation" value="see-remarks">
+         <prop ns="https://fedramp.gov/ns/oscal" name="mitigation" value="see-remarks">
             <remarks>
                <p>If there are one or more identified risks, describe any mitigating factors.</p>
             </remarks>
-         </prop>      
+         </prop>
          <prop name="allows-authenticated-scan" value="no">
             <remarks>
                <p/>
@@ -1538,6 +1588,9 @@
          </prop>
          <link rel='provided-by' href="#11111111-2222-4000-8000-009000100001" />
          <status state="operational"/>
+         <responsible-role role-id="provider">
+            <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
+         </responsible-role>
       </component>
 
 
@@ -1570,16 +1623,14 @@
                compliance (e.g., Module in Process).</p>
          </description>
          <!-- Rev 5 new props for CMs -->
-         <prop ns="http://fedramp.gov/ns/oscal" name="asset-type" value="cryptographic-module"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="vendor-name" value="CM Vendor"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="cryptographic-module-usage"
-            value="data-at-rest"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="asset-type" value="cryptographic-module"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="vendor-name" value="CM Vendor"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="cryptographic-module-usage" value="data-at-rest"/>
          <!-- Provide the validation type for this CM -->
          <prop name="validation-type" value="fips-140-2"/>
          <!-- Provide the certificate number (CMVP #) -->
          <prop name="validation-reference" value="3928"/>
-         <link rel="validation-details"
-            href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3928"/>
+         <link rel="validation-details" href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3928"/>
          <status state="operational"/>
       </component>
       <!-- List all cryptographic modules for Data-in-Transit (DIT) - must referenced by using component(s), provide CMVP #, FIPS validation status, Vendor Name, Module Name, and brief usage description -->
@@ -1591,16 +1642,14 @@
                compliance (e.g., Module in Process).</p>
          </description>
          <!-- Rev5 new props for CMs -->
-         <prop ns="http://fedramp.gov/ns/oscal" name="asset-type" value="cryptographic-module"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="vendor-name" value="CM Vendor"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="cryptographic-module-usage"
-            value="data-in-transit"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="asset-type" value="cryptographic-module"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="vendor-name" value="CM Vendor"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="cryptographic-module-usage" value="data-in-transit"/>
          <!-- Provide the validation type for this CM -->
          <prop name="validation-type" value="fips-140-3"/>
          <!-- Provide the certificate number (CMVP #) -->
          <prop name="validation-reference" value="3920"/>
-         <link rel="validation-details"
-            href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3920"/>
+         <link rel="validation-details" href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3920"/>
          <status state="operational"/>
       </component>
 
@@ -1618,7 +1667,7 @@
             <p>FUNCTION: Describe typical component function.</p>
          </description>
          <prop name="asset-type" value="operating-system"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
          <prop name="vendor-name" value="Vendor Name"/>
          <prop name="model" value="Model Number"/>
          <prop name="version" value="Version Number"/>
@@ -1639,7 +1688,7 @@
             <p>FUNCTION: Describe typical component function.</p>
          </description>
          <prop name="asset-type" value="operating-system"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
          <prop name="vendor-name" value="Vendor Name"/>
          <prop name="model" value="Model Number"/>
          <prop name="version" value="Version Number"/>
@@ -1661,8 +1710,8 @@
             <p>FUNCTION: Describe typical component function.</p>
          </description>
          <prop name="asset-type" value="database"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="database"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="database"/>
          <prop name="vendor-name" value="Vendor Name"/>
          <prop name="model" value="Model Number"/>
          <prop name="version" value="Version Number"/>
@@ -1683,18 +1732,18 @@
             <p>None</p>
          </description>
          <prop name="asset-type" value="operating-system"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
          <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
          <prop name="allows-authenticated-scan" value="yes"/>
          <status state="operational"/>
       </component>
-      <component uuid="11111111-2222-4000-8000-009000300005" type="software">
+      <component uuid="11111111-2222-4000-8000-009000300005" type="service">
          <title>Database Sample</title>
          <description>
             <p>None</p>
          </description>
          <prop name="asset-type" value="database"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="database"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="database"/>
          <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
          <prop name="allows-authenticated-scan" value="yes"/>
          <link href="#11111111-2222-4000-8000-009000500006" rel="used-by" />
@@ -1710,9 +1759,8 @@
             <p>None</p>
          </description>
          <prop name="asset-type" value="appliance"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="web"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="login-url"
-            value="https://admin.offering.com/login"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="web"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="login-url" value="https://admin.offering.com/login"/>
          <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
          <prop name="allows-authenticated-scan" value="no">
             <remarks>
@@ -2126,8 +2174,8 @@
          <prop name="asset-tag" value="Asset Tag"/>
          <prop name="vlan-id" value="VLAN Identifier"/>
          <prop name="network-id" value="Network Identifier"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <!-- <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="database"/>-->
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <!-- <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="database"/>-->
          <prop name="allows-authenticated-scan" value="no">
             <remarks>
                <p>If no, explain why. If yes, omit remarks field.</p>
@@ -2187,7 +2235,7 @@
                <p>If no, explain why. If yes, omit remark.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
          <responsible-party role-id="asset-owner">
             <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
          </responsible-party>
@@ -2213,9 +2261,8 @@
          <!-- Todo: check why schematron validation is indicating that this is not a valid ipv4 value -->
          <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a03:0303"/>
          <prop name="is-scanned" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000008"
-         > </implemented-component>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000008"></implemented-component>
       </inventory-item>
       <inventory-item uuid="11111111-2222-4000-8000-011000000004">
          <description>
@@ -2228,9 +2275,8 @@
          <prop name="ipv4-address" value="10.4.4.4"/>
          <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a04:0404"/>
          <prop name="is-scanned" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"
-         > </implemented-component>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"></implemented-component>
       </inventory-item>
       <inventory-item uuid="11111111-2222-4000-8000-011000000005">
          <description>
@@ -2243,9 +2289,8 @@
          <prop name="virtual" value="no"/>
          <prop name="public" value="yes"/>
          <prop name="is-scanned" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000011"
-         > </implemented-component>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000011"></implemented-component>
       </inventory-item>
       <inventory-item uuid="11111111-2222-4000-8000-011000000006">
          <description>
@@ -2262,8 +2307,7 @@
                <p>Asset wasn't running at time of scan.</p>
             </remarks>
          </prop>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"
-         > </implemented-component>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"></implemented-component>
       </inventory-item>
       <inventory-item uuid="11111111-2222-4000-8000-011000000007">
          <description>
@@ -2276,9 +2320,8 @@
          <prop name="virtual" value="no"/>
          <prop name="public" value="no"/>
          <prop name="is-scanned" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000008"
-         > </implemented-component>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000008"></implemented-component>
       </inventory-item>
       <inventory-item uuid="11111111-2222-4000-8000-011000000008">
          <description>
@@ -2295,8 +2338,7 @@
                <p>Asset wasn't running at time of scan.</p>
             </remarks>
          </prop>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"
-         > </implemented-component>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"></implemented-component>
       </inventory-item>
       <inventory-item uuid="11111111-2222-4000-8000-011000000009">
          <description>
@@ -2309,9 +2351,8 @@
          <prop name="virtual" value="yes"/>
          <prop name="public" value="no"/>
          <prop name="is-scanned" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000018"
-         > </implemented-component>
+         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
+         <implemented-component component-uuid="11111111-2222-4000-8000-009000000018"></implemented-component>
       </inventory-item>
    </system-implementation>
    <!-- Appendix A - FedRAMP Security Controls (in the rev 5 SSP template, control implementations go in appendix A) -->
@@ -2327,7 +2368,7 @@
          <p>FedRAMP does not require any specific information here.</p>
       </description>
       <implemented-requirement control-id="ac-1" uuid="11111111-2222-4000-8000-012000000001">
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000005" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000023" rel="procedure"/>
 
@@ -2342,8 +2383,7 @@
          </set-parameter>
 
          <statement statement-id="ac-1_smt.a.1" uuid="11111111-2222-4000-8000-013000000001">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000001">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000001">
                <description>
                   <p>Describe how Part a is satisfied within the system.</p>
                   <p>Legacy approach. If no policy component is defined, describe here how the
@@ -2361,8 +2401,7 @@
                      component is associated with the component representing the system.</p>
                </remarks>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000002">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000002">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Identity
@@ -2374,26 +2413,22 @@
             </by-component>
          </statement>
          <statement statement-id="ac-1_smt.a.2" uuid="11111111-2222-4000-8000-013000000002">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000003">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000003">
                <description>
                   <p>There </p>
                </description>
-               <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date"
-                  value="2024-01-31Z"/>
+               <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
                <implementation-status state="partial">
                   <remarks>
                      <p>Describe the plan to complete the implementation.</p>
                   </remarks>
                </implementation-status>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000004">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000004">
                <description>
                   <p>Describe how this policy currently satisfies part a.</p>
                </description>
-               <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date"
-                  value="2024-01-31Z">
+               <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z">
                   <remarks>
                      <p>Describe the plan for addressing the missing policy elements.</p>
                   </remarks>
@@ -2406,8 +2441,7 @@
             </by-component>
          </statement>
          <statement statement-id="ac-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000003">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000005">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000005">
                <description>
                   <p>Describe how Part b-1 is satisfied.</p>
                </description>
@@ -2415,8 +2449,7 @@
             </by-component>
          </statement>
          <statement statement-id="ac-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000004">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000006">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000006">
                <description>
                   <p>Describe how Part b-2 is satisfied.</p>
                </description>
@@ -2425,16 +2458,15 @@
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ac-2" uuid="11111111-2222-4000-8000-012000000002">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
          <!-- sample implementation-status below -->
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination"
-            value="customer-configured">
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="customer-configured">
             <remarks>
                <p>Describe any customer-configured requirements for satisfying this control.</p>
             </remarks>
@@ -2446,8 +2478,7 @@
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ac-2_smt" uuid="11111111-2222-4000-8000-013000000005">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000007">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000007">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2466,8 +2497,7 @@
             </by-component>
          </statement>
          <statement statement-id="ac-2_smt.a" uuid="11111111-2222-4000-8000-013000000006">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000008">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000008">
                <description>
                   <p>Describe how AC-2, part a is satisfied within this system.</p>
                   <p>This points to the "This System" component, and is used any time a more
@@ -2480,8 +2510,7 @@
                            leveraging systems to satisfy AC-2, part a.</p>
                      </description>
                   </provided>
-                  <responsibility uuid="11111111-2222-4000-8000-016000000001"
-                     provided-uuid="11111111-2222-4000-8000-015000000001">
+                  <responsibility uuid="11111111-2222-4000-8000-016000000001" provided-uuid="11111111-2222-4000-8000-015000000001">
                      <description>
                         <p>Leveraged system's statement of a leveraging system's responsibilities in
                            satisfaction of AC-2, part a.</p>
@@ -2494,8 +2523,7 @@
                   </responsibility>
                </export>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000014"
-               uuid="11111111-2222-4000-8000-014000000009">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000014" uuid="11111111-2222-4000-8000-014000000009">
                <description>
                   <p>For the portion of the control satisfied by the application component of this
                      system, describe <strong>how</strong> the control is met.</p>
@@ -2512,8 +2540,7 @@
                         <party-uuid>11111111-2222-4000-8000-004000000005</party-uuid>
                      </responsible-role>
                   </provided>
-                  <responsibility uuid="11111111-0000-4000-9009-002001002002"
-                     provided-uuid="11111111-2222-4000-8000-015000000002">
+                  <responsibility uuid="11111111-0000-4000-9009-002001002002" provided-uuid="11111111-2222-4000-8000-015000000002">
                      <description>
                         <p>Leveraging system's responsibilities with respect to inheriting this
                            capability from this application.</p>
@@ -2532,17 +2559,15 @@
                   <p>This can also be used to provide a summary, such as a holistic overview of how
                      multiple components work together.</p>
                   <p>While the "this system" component is not explicitly required within every
-                        <code>statement</code>, it will typically be present.</p>
+                     <code>statement</code>, it will typically be present.</p>
                </remarks>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000004"
-               uuid="11111111-2222-4000-8000-014000000010">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000004" uuid="11111111-2222-4000-8000-014000000010">
                <description>
                   <p>For the portion inherited from an underlying FedRAMP-authorized provider,
                      describe <strong>what</strong> is inherited.</p>
                </description>
-               <inherited provided-uuid="11111111-0000-4000-9009-002001002001"
-                  uuid="11111111-2222-4000-8000-017000000001">
+               <inherited provided-uuid="11111111-0000-4000-9009-002001002001" uuid="11111111-2222-4000-8000-017000000001">
                   <description>
                      <p>Optional description.</p>
                      <p>Consumer-appropriate description of what may be inherited as provided by the
@@ -2554,8 +2579,7 @@
                         CRM (Inheritance and Responsibility Model).</p>
                   </description>
                </inherited>
-               <satisfied responsibility-uuid="11111111-0000-4000-9009-002001002002"
-                  uuid="11111111-2222-4000-8000-018000000001">
+               <satisfied responsibility-uuid="11111111-0000-4000-9009-002001002002" uuid="11111111-2222-4000-8000-018000000001">
                   <description>
                      <p>Description of how the responsibility was satisfied.</p>
                      <p>The <code>responsibility-uuid</code> links this to the same statement in the
@@ -2563,8 +2587,8 @@
                      <p>It may be linked directly, but is more commonly provided via an OSCAL-based
                         CRM (Inheritance and Responsibility Model).</p>
                      <p>Tools should use this to ensure all identified customer
-                           <code>responsibility</code> statements have a corresponding
-                           <code>satisfied</code> statement in the leveraging system's SSP.</p>
+                        <code>responsibility</code> statements have a corresponding
+                        <code>satisfied</code> statement in the leveraging system's SSP.</p>
                      <p>Tool developers should be mindful that </p>
                   </description>
                </satisfied>
@@ -2572,21 +2596,20 @@
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="at-1" uuid="11111111-2222-4000-8000-012000000003">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000006" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000024" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="at-1_smt" uuid="11111111-2222-4000-8000-013000000007">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000011">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000011">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2602,14 +2625,12 @@
             </by-component>
          </statement>
          <statement statement-id="at-1_smt.a" uuid="11111111-2222-4000-8000-013000000008">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000012">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000012">
                <description>
                   <p>Describe how Part a is satisfied.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000013">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000013">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -2617,8 +2638,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000014">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000014">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -2628,16 +2648,14 @@
             </by-component>
          </statement>
          <statement statement-id="at-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000009">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000015">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000015">
                <description>
                   <p>Describe how Part b-1 is satisfied.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="at-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000010">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000016">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000016">
                <description>
                   <p>Describe how Part b-2 is satisfied.</p>
                </description>
@@ -2645,21 +2663,20 @@
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="au-1" uuid="11111111-2222-4000-8000-012000000004">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000025" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="au-1_smt" uuid="11111111-2222-4000-8000-013000000011">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000017">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000017">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2675,16 +2692,14 @@
             </by-component>
          </statement>
          <statement statement-id="au-1_smt.a" uuid="11111111-2222-4000-8000-013000000012">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000018">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000018">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
                <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000019">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000019">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -2692,8 +2707,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000020">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000020">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -2703,42 +2717,39 @@
             </by-component>
          </statement>
          <statement statement-id="au-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000013">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000021">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000021">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
                <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
             </by-component>
          </statement>
          <statement statement-id="au-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000014">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000022">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000022">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
                <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ca-1" uuid="11111111-2222-4000-8000-012000000005">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000008" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000026" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ca-1_smt" uuid="11111111-2222-4000-8000-013000000015">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000023">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000023">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2754,15 +2765,13 @@
             </by-component>
          </statement>
          <statement statement-id="ca-1_smt.a" uuid="11111111-2222-4000-8000-013000000016">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000024">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000024">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000025">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000025">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -2770,8 +2779,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000026">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000026">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -2781,40 +2789,37 @@
             </by-component>
          </statement>
          <statement statement-id="ca-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000017">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000027">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000027">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="ca-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000018">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000028">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000028">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="cm-1" uuid="11111111-2222-4000-8000-012000000006">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000009" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000027" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="cm-1_smt" uuid="11111111-2222-4000-8000-013000000019">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000029">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000029">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2830,15 +2835,13 @@
             </by-component>
          </statement>
          <statement statement-id="cm-1_smt.a" uuid="11111111-2222-4000-8000-013000000020">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000030">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000030">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000031">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000031">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -2846,8 +2849,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000032">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000032">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -2857,38 +2859,35 @@
             </by-component>
          </statement>
          <statement statement-id="cm-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000021">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000033">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000033">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="cm-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000022">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000034">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000034">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="cp-1" uuid="11111111-2222-4000-8000-012000000007">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="cp-1_smt" uuid="11111111-2222-4000-8000-013000000023">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000035">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000035">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2904,15 +2903,13 @@
             </by-component>
          </statement>
          <statement statement-id="cp-1_smt.a" uuid="11111111-2222-4000-8000-013000000024">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000036">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000036">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000037">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000037">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -2920,8 +2917,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000038">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000038">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -2931,40 +2927,37 @@
             </by-component>
          </statement>
          <statement statement-id="cp-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000025">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000039">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000039">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="cp-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000026">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000040">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000040">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ia-1" uuid="11111111-2222-4000-8000-012000000008">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000011" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000029" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ia-1_smt" uuid="11111111-2222-4000-8000-013000000027">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000041">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000041">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -2980,15 +2973,13 @@
             </by-component>
          </statement>
          <statement statement-id="ia-1_smt.a" uuid="11111111-2222-4000-8000-013000000028">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000042">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000042">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000043">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000043">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -2996,8 +2987,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000044">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000044">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3007,40 +2997,37 @@
             </by-component>
          </statement>
          <statement statement-id="ia-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000029">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000045">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000045">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="ia-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000030">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000046">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000046">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ir-1" uuid="11111111-2222-4000-8000-012000000009">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000011" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000030" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ir-1_smt" uuid="11111111-2222-4000-8000-013000000031">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000047">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000047">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3056,15 +3043,13 @@
             </by-component>
          </statement>
          <statement statement-id="ir-1_smt.a" uuid="11111111-2222-4000-8000-013000000032">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000048">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000048">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000049">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000049">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3072,8 +3057,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000050">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000050">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3083,40 +3067,37 @@
             </by-component>
          </statement>
          <statement statement-id="ir-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000033">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000051">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000051">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="ir-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000034">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000052">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000052">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ma-1" uuid="11111111-2222-4000-8000-012000000010">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000013" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000031" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ma-1_smt" uuid="11111111-2222-4000-8000-013000000035">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000053">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000053">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3132,15 +3113,13 @@
             </by-component>
          </statement>
          <statement statement-id="ma-1_smt.a" uuid="11111111-2222-4000-8000-013000000036">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000054">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000054">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000055">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000055">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3148,8 +3127,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000056">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000056">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3159,40 +3137,37 @@
             </by-component>
          </statement>
          <statement statement-id="ma-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000037">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000057">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000057">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="ma-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000038">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000058">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000058">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="mp-1" uuid="11111111-2222-4000-8000-012000000011">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000014" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000032" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="_smt" uuid="11111111-2222-4000-8000-013000000039">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000059">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000059">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3208,15 +3183,13 @@
             </by-component>
          </statement>
          <statement statement-id="mp-1_smt.a" uuid="11111111-2222-4000-8000-013000000040">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000060">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000060">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000061">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000061">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3224,8 +3197,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000062">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000062">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3235,40 +3207,37 @@
             </by-component>
          </statement>
          <statement statement-id="mp-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000041">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000063">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000063">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="mp-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000042">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000064">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000064">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="pe-1" uuid="11111111-2222-4000-8000-012000000012">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000015" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000033" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="_smt" uuid="11111111-2222-4000-8000-013000000043">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000065">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000065">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3284,15 +3253,13 @@
             </by-component>
          </statement>
          <statement statement-id="pe-1_smt.a" uuid="11111111-2222-4000-8000-013000000044">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000066">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000066">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000067">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000067">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3300,8 +3267,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000068">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000068">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3311,40 +3277,37 @@
             </by-component>
          </statement>
          <statement statement-id="pe-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000045">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000069">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000069">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="pe-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000046">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000070">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000070">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="pl-1" uuid="11111111-2222-4000-8000-012000000013">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#de28452-4b02-4b49-b316-59142a7633c1" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000034" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="pl-1_smt" uuid="11111111-2222-4000-8000-013000000047">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000071">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000071">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3360,15 +3323,13 @@
             </by-component>
          </statement>
          <statement statement-id="pl-1_smt.a" uuid="11111111-2222-4000-8000-013000000048">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000072">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000072">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000073">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000073">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3376,8 +3337,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000074">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000074">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3387,40 +3347,37 @@
             </by-component>
          </statement>
          <statement statement-id="pl-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000049">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000075">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000075">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="pl-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000050">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000076">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000076">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ps-1" uuid="11111111-2222-4000-8000-012000000014">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000017" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000035" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ps-1_smt" uuid="11111111-2222-4000-8000-013000000051">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000077">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000077">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3436,15 +3393,13 @@
             </by-component>
          </statement>
          <statement statement-id="ps-1_smt.a" uuid="11111111-2222-4000-8000-013000000052">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000078">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000078">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000079">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000079">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3452,8 +3407,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000080">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000080">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3463,40 +3417,37 @@
             </by-component>
          </statement>
          <statement statement-id="ps-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000053">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000081">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000081">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="ps-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000054">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000082">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000082">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="ra-1" uuid="11111111-2222-4000-8000-012000000015">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000018" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000036" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="ra-1_smt" uuid="11111111-2222-4000-8000-013000000055">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000083">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000083">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3512,15 +3463,13 @@
             </by-component>
          </statement>
          <statement statement-id="ra-1_smt.a" uuid="11111111-2222-4000-8000-013000000056">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000084">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000084">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000085">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000085">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3528,8 +3477,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000086">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000086">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3539,40 +3487,37 @@
             </by-component>
          </statement>
          <statement statement-id="ra-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000057">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000087">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000087">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="ra-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000058">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000088">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000088">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="sa-1" uuid="11111111-2222-4000-8000-012000000016">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000019" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000037" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="sa-1_smt" uuid="11111111-2222-4000-8000-013000000059">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000089">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000089">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3588,15 +3533,13 @@
             </by-component>
          </statement>
          <statement statement-id="sa-1_smt.a" uuid="11111111-2222-4000-8000-013000000060">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000090">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000090">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000091">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000091">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3604,8 +3547,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000092">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000092">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3615,40 +3557,37 @@
             </by-component>
          </statement>
          <statement statement-id="sa-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000061">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000093">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000093">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="sa-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000062">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000094">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000094">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="sc-1" uuid="11111111-2222-4000-8000-012000000017">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000020" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000038" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="sc-1_smt" uuid="11111111-2222-4000-8000-013000000063">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000095">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000095">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3664,15 +3603,13 @@
             </by-component>
          </statement>
          <statement statement-id="sc-1_smt.a" uuid="11111111-2222-4000-8000-013000000064">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000096">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000096">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000097">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000097">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3680,8 +3617,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000098">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000098">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3691,40 +3627,37 @@
             </by-component>
          </statement>
          <statement statement-id="sc-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000065">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000099">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000099">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="sc-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000066">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000100">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000100">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="si-1" uuid="11111111-2222-4000-8000-012000000018">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000021" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000039" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="si-1_smt" uuid="11111111-2222-4000-8000-013000000067">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000101">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000101">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3740,15 +3673,13 @@
             </by-component>
          </statement>
          <statement statement-id="si-1_smt.a" uuid="11111111-2222-4000-8000-013000000068">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000102">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000102">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000103">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000103">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3756,8 +3687,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000104">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000104">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3767,35 +3697,32 @@
             </by-component>
          </statement>
          <statement statement-id="si-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000069">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000105">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000105">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
          <statement statement-id="si-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000070">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000106">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000106">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="si-8" uuid="11111111-2222-4000-8000-012000000019">
          <!--Spam Protection-->
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="implemented"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="implemented"/>
          <!--There are no control parameters-->
          <responsible-role role-id="asset-administrator">
             <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
          </responsible-role>
          <statement statement-id="si-8_smt" uuid="11111111-2222-4000-8000-013000000071">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000018"
-               uuid="11111111-2222-4000-8000-014000000107">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000018" uuid="11111111-2222-4000-8000-014000000107">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                   <p>DMARC is employed.</p>
@@ -3815,21 +3742,20 @@
          </statement>
       </implemented-requirement>
       <implemented-requirement control-id="sr-1" uuid="11111111-2222-4000-8000-012000000020">
-         <prop ns="http://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
+         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
             <remarks>
                <p>Describe the plan to complete the implementation.</p>
             </remarks>
          </prop>
-         <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
          <link href="#11111111-2222-4000-8000-001000000022" rel="policy"/>
          <link href="#11111111-2222-4000-8000-001000000040" rel="procedure"/>
          <responsible-role role-id="information-system-security-officer">
             <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
          </responsible-role>
          <statement statement-id="sr-1_smt" uuid="11111111-2222-4000-8000-013000000072">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000108">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000108">
                <description>
                   <p>Describe how the control is satisfied within the system.</p>
                </description>
@@ -3845,15 +3771,13 @@
             </by-component>
          </statement>
          <statement statement-id="sr-1_smt.a" uuid="11111111-2222-4000-8000-013000000073">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000"
-               uuid="11111111-2222-4000-8000-014000000109">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000109">
                <description>
                   <p>For the portion of the control satisfied by the service provider, describe
-                        <strong>how</strong> the control is met.</p>
+                     <strong>how</strong> the control is met.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012"
-               uuid="11111111-2222-4000-8000-014000000110">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000110">
                <description>
                   <p>Describe how this policy component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the Policy.</p>
@@ -3861,8 +3785,7 @@
                      here too.</p>
                </description>
             </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013"
-               uuid="11111111-2222-4000-8000-014000000111">
+            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000111">
                <description>
                   <p>Describe how this procedure component satisfies part a.</p>
                   <p>Component approach. This links to a component representing the procedure.</p>
@@ -3902,8 +3825,7 @@
       <resource uuid="11111111-2222-4000-8000-001000000003">
          <title>FedRAMP Applicable Laws and Regulations</title>
          <prop name="type" class="fedramp-citations" value="citation"/>
-         <rlink
-            href="https://www.fedramp.gov/assets/resources/templates/FedRAMP-Laws-Regulations-Standards-and-Guidance-Reference.xlsx"/>
+         <rlink href="https://www.fedramp.gov/assets/resources/templates/FedRAMP-Laws-Regulations-Standards-and-Guidance-Reference.xlsx"/>
          <remarks>
             <p>Must be present in a FedRAMP SSP.</p>
          </remarks>
@@ -3925,7 +3847,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000006">
@@ -3942,7 +3865,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000007">
@@ -3959,7 +3883,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000008">
@@ -3976,7 +3901,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000009">
@@ -3993,7 +3919,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000010">
@@ -4011,7 +3938,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000011">
@@ -4028,7 +3956,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000012">
@@ -4045,7 +3974,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000013">
@@ -4062,7 +3992,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000014">
@@ -4079,7 +4010,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000015">
@@ -4096,7 +4028,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000016">
@@ -4113,7 +4046,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000017">
@@ -4130,7 +4064,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000018">
@@ -4147,7 +4082,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000019">
@@ -4164,7 +4100,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000020">
@@ -4181,7 +4118,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000021">
@@ -4198,7 +4136,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000022">
@@ -4215,7 +4154,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Policy Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix C - Security Prodedure documents -->
@@ -4233,7 +4173,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000024">
@@ -4250,7 +4191,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000025">
@@ -4267,7 +4209,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000026">
@@ -4284,7 +4227,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000027">
@@ -4301,7 +4245,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000028">
@@ -4318,7 +4263,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000029">
@@ -4335,7 +4281,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000030">
@@ -4352,7 +4299,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000031">
@@ -4369,7 +4317,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000032">
@@ -4386,7 +4335,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000033">
@@ -4403,7 +4353,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000034">
@@ -4420,7 +4371,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000035">
@@ -4437,7 +4389,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000036">
@@ -4454,7 +4407,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000037">
@@ -4471,7 +4425,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000038">
@@ -4488,7 +4443,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000039">
@@ -4505,7 +4461,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <resource uuid="11111111-2222-4000-8000-001000000040">
@@ -4522,7 +4479,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix D - User Guide -->
@@ -4539,7 +4497,8 @@
          <remarks>
             <p>Table 12-1 Attachments: User's Guide Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix E - Digital Identity Worksheet -->
@@ -4559,7 +4518,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Rules of Behavior (ROB)</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix G - Information System Contingency Plan (ISCP) -->
@@ -4577,7 +4537,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Contingency Plan (CP) Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix H - Configuration Management Plan -->
@@ -4595,7 +4556,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Configuration Management (CM) Plan Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix I - Incident Response Plan (IRP) -->
@@ -4613,7 +4575,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Incident Response (IR) Plan Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix J - CIS and CRM Workbook -->
@@ -4652,7 +4615,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Continuous Monitoring Plan Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix O - POA&M -->
@@ -4682,7 +4646,8 @@
          <remarks>
             <p>Table 12-1 Attachments: Procedure Attachment</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
          </remarks>
       </resource>
       <!-- Appendix Q - Cryptographic Modules Table -->
@@ -4703,7 +4668,7 @@
          <description>
             <p>FedRAMP Logo</p>
          </description>
-         <prop ns="http://fedramp.gov/ns/oscal" name="type" value="fedramp-logo"/>
+         <prop ns="https://fedramp.gov/ns/oscal" name="type" value="fedramp-logo"/>
          <rlink href="https://www.fedramp.gov/assets/img/logo-main-fedramp.png"/>
          <!-- Todo: Make base64 optional -->
          <base64 filename="logo-main-fedramp.png" media-type="image/png">00000000</base64>
@@ -4720,7 +4685,8 @@
          <base64 filename="logo.png" media-type="image/png">00000000</base64>
          <remarks>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
             <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
             <p>Images must be in sufficient resolution to read all detail when rendered in a browser
                via HTML5.</p>
@@ -4735,7 +4701,8 @@
          <base64 filename="logo.png" media-type="image/png">00000000</base64>
          <remarks>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
             <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
             <p>Images must be in sufficient resolution to read all detail when rendered in a browser
                via HTML5.</p>
@@ -4756,7 +4723,8 @@
                system-characteristics/authorization-boundary/diagram/link/@href flag using a value
                of "#11111111-2222-4000-8000-001000000054"</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
             <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
             <p>Images must be in sufficient resolution to read all detail when rendered in a browser
                via HTML5.</p>
@@ -4777,7 +4745,8 @@
                system-characteristics/network-architecture/diagram/link/@href flag using a value of
                "#11111111-2222-4000-8000-001000000055"</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
             <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
             <p>Images must be in sufficient resolution to read all detail when rendered in a browser
                via HTML5.</p>
@@ -4796,7 +4765,8 @@
             <p>This should be referenced in the system-characteristics/data-flow/diagram/link/@href
                flag using a value of "#11111111-2222-4000-8000-001000000056"</p>
             <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.</p>
+               <code>base64</code>.
+            </p>
             <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
             <p>Images must be in sufficient resolution to read all detail when rendered in a browser
                via HTML5.</p>
@@ -4813,7 +4783,8 @@
          <title>41 CFR 201</title>
          <prop name="type" class="law" value="citation"/>
          <citation>
-            <text><q>Federal Acquisition Supply Chain Security Act; Rule,</q> 85 Federal Register 54263 (September 1, 2020), pp 54263-54271.</text>
+            <text>
+               <q>Federal Acquisition Supply Chain Security Act; Rule,</q> 85 Federal Register 54263 (September 1, 2020), pp 54263-54271.</text>
          </citation>
          <rlink href="https://www.federalregister.gov/d/2020-18939"/>
          <remarks>
@@ -4830,5 +4801,32 @@
                and the value is "citation".</p>
          </remarks>
       </resource>
+      <resource uuid="11111111-2222-4000-8000-001000000004">
+         <title>CSP Reference</title>
+         <prop name="type" class="reference" value="citation"/>
+         <rlink href="./attachments/reference.pdf"/>
+         <remarks>
+            <p>CSP-specific reference. Note the "type" property's class is "reference"
+               and the value is "citation".</p>
+         </remarks>
+      </resource>
+      <resource uuid="49fb4631-1da2-41ca-b0b3-e1b1006d4025">
+         <title>Separation of Duties Matrix</title>
+         <description>
+            <p>Separation of Duties Matrix</p>
+         </description>
+         <prop ns="https://fedramp.gov/ns/oscal" name="type" value="separation-of-duties-matrix"/>
+         <prop name="published" value="2023-01-01T00:00:00Z"/>
+         <prop name="version" value="Document Version"/>
+         <rlink href="./documents/Sep_Matrix.docx" media-type="application/msword"/>
+         <base64 filename="Sep_Matrix.docx" media-type="application/msword">00000000</base64>
+         <remarks>
+            <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.
+            </p>
+         </remarks>
+      </resource>
+
+
+
    </back-matter>
 </system-security-plan>
\ No newline at end of file
diff --git a/src/validations/constraints/content/fedramp-ssp-example.xml b/src/validations/constraints/content/fedramp-ssp-example.xml
deleted file mode 100644
index 732bbc089..000000000
--- a/src/validations/constraints/content/fedramp-ssp-example.xml
+++ /dev/null
@@ -1,4832 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<?xml-model href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.4/xml/schema/oscal_complete_schema.xsd" schematypens="http://www.w3.org/2001/XMLSchema" title="OSCAL complete schema"?>
-<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="11111111-2222-4000-8000-000000000000">
-   <metadata>
-      <title>FedRAMP [Baseline Name] System Security Plan (SSP)</title>
-      <published>2024-12-31T23:59:59Z</published>
-      <last-modified>2024-11-05T02:24:00Z</last-modified>
-      <version>fedramp3.0.0-oscal1.1.4</version>
-      <oscal-version>1.1.2</oscal-version>
-      <revisions>
-         <revision>
-            <published>2023-06-30T00:00:00Z</published>
-            <version>1.0</version>
-            <oscal-version>1.0.4</oscal-version>
-            <prop ns="https://fedramp.gov/ns/oscal" name="party-uuid" value="11111111-2222-4000-8000-004000000001"/>
-            <remarks>
-               <p>Initial publication.</p>
-            </remarks>
-         </revision>
-         <revision>
-            <published>2023-07-06T00:00:00Z</published>
-            <version>1.1</version>
-            <oscal-version>1.0.4</oscal-version>
-            <prop ns="https://fedramp.gov/ns/oscal" name="party-uuid" value="11111111-2222-4000-8000-004000000001"/>
-            <remarks>
-               <p>Minor <code>prop</code> updates.</p>
-            </remarks>
-         </revision>
-      </revisions>
-      <prop name="marking" value="cui" class="fedramp.gov"/>
-      <prop name="fedramp-version" ns="https://fedramp.gov/ns/oscal" value="fedramp-3.0.0rc1-oscal-1.1.2"/>
-      <!-- The following role definitions are required by FedRAMP -->
-      <!-- Do not change the ID's or titles. -->
-      <role id="fedramp-pmo">
-         <title>FedRAMP Program Management Office</title>
-         <description>
-            <p>The FedRAMP PMO resides within GSA and supports agencies and cloud service providers
-               through the FedRAMP authorization process and maintains a secure repository of
-               FedRAMP authorizations to enable reuse of security packages.</p>
-         </description>
-      </role>
-      <role id="prepared-by">
-         <title>Prepared By</title>
-         <description>
-            <p>The organization that prepared this SSP. If developed in-house, this is the CSP
-               itself.</p>
-         </description>
-      </role>
-      <role id="prepared-for">
-         <title>Prepared For</title>
-         <description>
-            <p>The organization for which this SSP was prepared. Typically the CSP.</p>
-         </description>
-      </role>
-      <role id="content-approver">
-         <title>System Security Plan Approval</title>
-         <description>
-            <p>The individual or individuals accountable for the accuracy of this SSP.</p>
-         </description>
-      </role>
-      <role id="cloud-service-provider">
-         <title>Cloud Service Provider</title>
-         <short-name>CSP</short-name>
-      </role>
-      <role id="system-owner">
-         <!-- Referenced in Section 4 - System Owner -->
-         <title>Information System Owner</title>
-         <description>
-            <p>The individual within the CSP who is ultimately accountable for everything related to
-               this system.</p>
-         </description>
-      </role>
-      <role id="authorizing-official">
-         <title>Authorizing Official</title>
-         <description>
-            <p>The individual or individuals who must grant this system an authorization to
-               operate.</p>
-         </description>
-      </role>
-      <role id="authorizing-official-poc">
-         <title>Authorizing Official's Point of Contact</title>
-         <description>
-            <p>The individual representing the authorizing official.</p>
-         </description>
-      </role>
-      <role id="system-poc-management">
-         <title>Information System Management Point of Contact (POC)</title>
-         <description>
-            <p>The highest level manager who responsible for system operation on behalf of the
-               System Owner.</p>
-         </description>
-      </role>
-      <role id="system-poc-technical">
-         <title>Information System Technical Point of Contact</title>
-         <description>
-            <p>The individual or individuals leading the technical operation of the system.</p>
-         </description>
-      </role>
-      <role id="system-poc-other">
-         <title>General Point of Contact (POC)</title>
-         <description>
-            <p>A general point of contact for the system, designated by the system owner.</p>
-         </description>
-      </role>
-      <role id="information-system-security-officer">
-         <!-- Referenced in Section 5 - Assignment of Security Responsibility -->
-         <title>System Information System Security Officer (or Equivalent)</title>
-         <description>
-            <p>The individual accountable for the security posture of the system on behalf of the
-               system owner.</p>
-         </description>
-      </role>
-      <role id="privacy-poc">
-         <title>Privacy Official's Point of Contact</title>
-         <description>
-            <p>The individual responsible for the privacy threshold analysis and if necessary the
-               privacy impact assessment.</p>
-         </description>
-      </role>
-      <role id="asset-owner">
-         <title>Owner of an inventory item within the system.</title>
-      </role>
-      <role id="asset-administrator">
-         <title>Administrative responsibility an inventory item within the system.</title>
-      </role>
-      <role id="isa-poc-local">
-         <title>ICA POC (Local)</title>
-         <description>
-            <p>The point of contact for an interconnection on behalf of this system.</p>
-         </description>
-         <remarks>
-            <p>Remove this role if there are no ICAs.</p>
-         </remarks>
-      </role>
-      <role id="isa-poc-remote">
-         <title>ICA POC (Remote)</title>
-         <description>
-            <p>The point of contact for an interconnection on behalf of this external system to
-               which this system connects.</p>
-         </description>
-         <remarks>
-            <p>Remove this role if there are no ICAs.</p>
-         </remarks>
-      </role>
-      <role id="isa-authorizing-official-local">
-         <title>ICA Signatory (Local)</title>
-         <description>
-            <p>Responsible for signing an interconnection security agreement on behalf of this
-               system.</p>
-         </description>
-         <remarks>
-            <p>Remove this role if there are no ICAs.</p>
-         </remarks>
-      </role>
-      <role id="isa-authorizing-official-remote">
-         <title>ICA Signatory (Remote)</title>
-         <description>
-            <p>Responsible for signing an interconnection security agreement on behalf of the
-               external system to which this system connects.</p>
-         </description>
-         <remarks>
-            <p>Remove this role if there are no ICAs.</p>
-         </remarks>
-      </role>
-      <role id="consultant">
-         <title>Consultant</title>
-         <description>
-            <p>Any consultants involved with developing or maintaining this content.</p>
-         </description>
-      </role>
-      <role id="customer">
-         <title>Customer</title>
-         <description>
-            <p>Represents any customers of this system as may be necessary for assigning customer
-               responsibility.</p>
-         </description>
-      </role>
-      <role id="provider">
-         <title>Provider</title>
-         <description>
-            <p>The provider of a leveraged system, external service, API, CLI.</p>
-         </description>
-      </role>
-      <role id="admin-unix">
-         <title>[SAMPLE]Unix Administrator</title>
-         <description>
-            <p>This is a sample role.</p>
-         </description>
-      </role>
-      <role id="admin-client">
-         <title>[SAMPLE]Client Administrator</title>
-         <description>
-            <p>This is a sample role.</p>
-         </description>
-      </role>
-      <role id="leveraged-authorization-users">
-         <title>Leveraged Authorization Users</title>
-         <description>
-            <p>Any internal users of a leveraged authorization.</p>
-         </description>
-      </role>
-      <role id="external-system-owner">
-         <title>External System Owner</title>
-         <description>
-            <p>The owner of an external system.</p>
-         </description>
-      </role>
-      <role id="external-system-poc-management">
-         <title>External System Management Point of Contact (POC)</title>
-         <description>
-            <p>The highest level manager who responsible for an external system's operation on
-               behalf of the System Owner.</p>
-         </description>
-      </role>
-      <role id="external-system-poc-technical">
-         <title>External System Technical Point of Contact</title>
-         <description>
-            <p>The individual or individuals leading the technical operation of an external
-               system.</p>
-         </description>
-      </role>
-      <role id="approver">
-         <title>Approver</title>
-         <description>
-            <p>An internal approving authority.</p>
-         </description>
-      </role>
-      <location uuid="11111111-2222-4000-8000-003000000001">
-         <title>CSP HQ</title>
-         <address type="work">
-            <addr-line>Suite 0000</addr-line>
-            <addr-line>1234 Some Street</addr-line>
-            <city>Haven</city>
-            <state>ME</state>
-            <postal-code>00000</postal-code>
-         </address>
-         <remarks>
-            <p>There must be one location identifying the CSP's primary business address, such as
-               the CSP's HQ, or the address of the system owner's primary business location.</p>
-         </remarks>
-      </location>
-      <location uuid="11111111-2222-4000-8000-003000000002">
-         <title>Primary Data Center</title>
-         <address>
-            <addr-line>2222 Main Street</addr-line>
-            <city>Anywhere</city>
-            <state>--</state>
-            <postal-code>00000-0000</postal-code>
-            <country>US</country>
-         </address>
-         <prop name="type" class="primary" value="data-center"/>
-         <remarks>
-            <p>There must be one location for each data center.</p>
-            <p>There must be at least two data center locations.</p>
-            <p>For a data center, briefly summarize the components at this location.</p>
-            <p>All data centers must have a "type" property with a value of "data-center".</p>
-            <p>The type property must also have a class of "primary" or "alternate".</p>
-         </remarks>
-      </location>
-      <location uuid="11111111-2222-4000-8000-003000000003">
-         <title>Secondary Data Center</title>
-         <address>
-            <addr-line>3333 Small Road</addr-line>
-            <city>Anywhere</city>
-            <state>--</state>
-            <postal-code>00000-0000</postal-code>
-            <country>US</country>
-         </address>
-         <prop name="type" class="alternate" value="data-center"/>
-         <remarks>
-            <p>There must be one location for each data center.</p>
-            <p>There must be at least two data center locations.</p>
-            <p>For a data center, briefly summarize the components at this location.</p>
-            <p>All data centers must have a "type" property with a value of "data-center".</p>
-            <p>The type property must also have a class of "primary" or "alternate".</p>
-         </remarks>
-      </location>
-      <party uuid="11111111-2222-4000-8000-004000000001" type="organization">
-         <!-- CSP Name - referenced in Table 3.1 -->
-         <name>Cloud Service Provider (CSP) Name</name>
-         <short-name>CSP Acronym/Short Name</short-name>
-         <link href="#11111111-2222-4000-8000-001000000052" rel="logo"/>
-         <location-uuid>11111111-2222-4000-8000-003000000001</location-uuid>
-         <remarks>
-            <p>Replace sample CSP information.</p>
-            <p>CSP information must be present and associated with the "cloud-service-provider" role
-               via <code>responsible-party</code>.
-            </p>
-         </remarks>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000002" type="organization">
-         <name>Federal Risk and Authorization Management Program: Program Management Office</name>
-         <short-name>FedRAMP PMO</short-name>
-         <link href="http://fedramp.gov" rel="homepage"/>
-         <link href="#11111111-2222-4000-8000-001000000051" rel="logo"/>
-         <link href="#11111111-2222-4000-8000-001000000004" rel="reference"/>
-         <email-address>info@fedramp.gov</email-address>
-         <address type="work">
-            <addr-line>1800 F St. NW</addr-line>
-            <city>Washington</city>
-            <state>DC</state>
-            <postal-code>20006</postal-code>
-            <country>US</country>
-         </address>
-         <remarks>
-            <p>This party entry must be present in a FedRAMP SSP.</p>
-            <p>The uuid may be different; however, the uuid must be associated with the
-               "fedramp-pmo" role in the responsible-party assemblies.</p>
-         </remarks>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000003" type="organization">
-         <name>Federal Risk and Authorization Management Program: Joint Authorization Board</name>
-         <short-name>FedRAMP JAB</short-name>
-         <link href="#11111111-2222-4000-8000-001000000051" rel="logo"/>
-         <remarks>
-            <p>This party entry must be present in a FedRAMP SSP.</p>
-            <p>The uuid may be different; however, the uuid must be associated with the
-               "fedramp-jab" role in the responsible-party assemblies.</p>
-         </remarks>
-      </party>
-      <!-- The following parties are samples, and may be modified or removed -->
-      <party uuid="11111111-2222-4000-8000-004000000004" type="organization">
-         <name>External Organization</name>
-         <short-name>External</short-name>
-         <remarks>
-            <p>Generic placeholder for any external organization.</p>
-         </remarks>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000005" type="organization">
-         <name>Agency Name</name>
-         <short-name>A.N.</short-name>
-         <remarks>
-            <p>Generic placeholder for an authorizing agency.</p>
-         </remarks>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000006" type="organization">
-         <name>Name of Consulting Org</name>
-         <short-name>NOCO</short-name>
-         <link href="https://example.com"/>
-         <link href="#11111111-2222-4000-8000-001000000053" rel="logo"/>
-         <email-address>poc@example.com</email-address>
-         <address type="work">
-            <addr-line>3333 Corporate Way</addr-line>
-            <city>Washington</city>
-            <state>DC</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000007" type="organization">
-         <name>[SAMPLE]Remote System Org Name</name>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000008" type="person">
-         <name>[SAMPLE]ICA POC's Name</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>person@ica.example.org</email-address>
-         <telephone-number>2025551212</telephone-number>
-         <member-of-organization>11111111-2222-4000-8000-004000000007</member-of-organization>
-      </party>
-      <party uuid="22222222-2222-4000-8000-c0040000000a" type="organization">
-         <name>[SAMPLE]Example IaaS Provider</name>
-         <short-name>E.I.P.</short-name>
-         <remarks>
-            <p>Underlying service provider. Leveraged Authorization.</p>
-         </remarks>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000010" type="person">
-         <name>[SAMPLE]Person Name 1</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <prop name="mail-stop" value="Mailstop A-1"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000001</telephone-number>
-         <location-uuid>11111111-2222-4000-8000-003000000001</location-uuid>
-         <member-of-organization>11111111-2222-4000-8000-004000000001</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000011" type="person">
-         <name>[SAMPLE]Person Name 2</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000002</telephone-number>
-         <address type="work">
-            <addr-line>Address Line</addr-line>
-            <city>City</city>
-            <state>ST</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-         <member-of-organization>11111111-2222-4000-8000-004000000001</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000012" type="person">
-         <name>[SAMPLE]Person Name 3</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000003</telephone-number>
-         <address type="work">
-            <addr-line>Address Line</addr-line>
-            <city>City</city>
-            <state>ST</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-         <member-of-organization>11111111-2222-4000-8000-004000000001</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000013" type="person">
-         <name>[SAMPLE]Person Name 4</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000004</telephone-number>
-         <address type="work">
-            <addr-line>Address Line</addr-line>
-            <city>City</city>
-            <state>ST</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-         <member-of-organization>11111111-2222-4000-8000-004000000001</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000014" type="person">
-         <name>[SAMPLE]Person Name 5</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000005</telephone-number>
-         <address type="work">
-            <addr-line>Address Line</addr-line>
-            <city>City</city>
-            <state>ST</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-         <member-of-organization>11111111-2222-4000-8000-004000000001</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000015" type="person">
-         <name>[SAMPLE]Person Name 6</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000006</telephone-number>
-         <address type="work">
-            <addr-line>Address Line</addr-line>
-            <city>City</city>
-            <state>ST</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-         <member-of-organization>11111111-2222-4000-8000-004000000004</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000016" type="person">
-         <name>[SAMPLE]Person Name 7</name>
-         <prop name="job-title" value="Individual's Title"/>
-         <email-address>name@example.com</email-address>
-         <telephone-number>2020000007</telephone-number>
-         <address type="work">
-            <addr-line>Address Line</addr-line>
-            <city>City</city>
-            <state>ST</state>
-            <postal-code>00000</postal-code>
-            <country>US</country>
-         </address>
-         <member-of-organization>11111111-2222-4000-8000-004000000001</member-of-organization>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000017" type="organization">
-         <name>[SAMPLE] IT Department</name>
-      </party>
-      <party uuid="11111111-2222-4000-8000-004000000018" type="organization">
-         <name>[SAMPLE]Security Team</name>
-      </party>
-      <party uuid="11111111-2222-4000-8000-c0040000000a" type="person">
-         <name>Leveraged Authorization User</name>
-      </party>
-
-
-
-      <party uuid="22222222-2222-4000-8000-004000000001" type="organization">
-         <name>Name of Leveraged System A Provider</name>
-      </party>
-      <party uuid="33333333-2222-4000-8000-004000000001" type="organization">
-         <name>Name of Leveraged System B Provider</name>
-      </party>
-      <party uuid="44444444-2222-4000-8000-004000000001" type="organization">
-         <name>Name of Leveraged System C Provider</name>
-      </party>
-      <party uuid="55555555-2222-4000-8000-004000000001" type="organization">
-         <name>Name of Service Provider</name>
-      </party>
-      <party uuid="66666666-2222-4000-8000-004000000001" type="organization">
-         <name>Name of Telco Provider</name>
-      </party>
-      <responsible-party role-id="provider">
-         <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
-      </responsible-party>
-      <responsible-party role-id="cloud-service-provider">
-         <party-uuid>11111111-2222-4000-8000-004000000001</party-uuid>
-         <party-uuid>22222222-2222-4000-8000-004000000001</party-uuid>
-         <remarks>
-            <p>Zero or more</p>
-         </remarks>
-      </responsible-party>
-      <!-- Page 3 -->
-      <responsible-party role-id="prepared-by">
-         <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="prepared-for">
-         <!-- Exacty one -->
-         <party-uuid>11111111-2222-4000-8000-004000000001</party-uuid>
-      </responsible-party>
-      <!-- Page 6 -->
-      <responsible-party role-id="content-approver">
-         <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         <remarks>
-            <p>One or more</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="system-owner">
-         <!-- Section 4 - System Owner -->
-         <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="authorizing-official">
-         <party-uuid>11111111-2222-4000-8000-004000000003</party-uuid>
-         <party-uuid>11111111-2222-4000-8000-004000000015</party-uuid>
-         <remarks>
-            <p>One or more</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="system-poc-management">
-         <party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="system-poc-technical">
-         <party-uuid>11111111-2222-4000-8000-004000000013</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-      <!-- Section 5 - Assignment of Security Responsibility -->
-      <responsible-party role-id="information-system-security-officer">
-         <party-uuid>11111111-2222-4000-8000-004000000014</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="authorizing-official-poc">
-         <party-uuid>11111111-2222-4000-8000-004000000015</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-      <responsible-party role-id="privacy-poc">
-         <party-uuid>11111111-2222-4000-8000-004000000016</party-uuid>
-         <remarks>
-            <p>Exactly one</p>
-         </remarks>
-      </responsible-party>
-
-
-   </metadata>
-   <import-profile href="https://raw.githubusercontent.com/GSA/fedramp-automation/refs/heads/master/dist/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml">
-      <remarks>
-         <p>This example points to the FedRAMP Rev 5 Moderate baseline that is part of the official
-            FedRAMP 3.0.0 release.</p>
-         <p>Must adjust accordingly for applicable baseline and revision.</p>
-      </remarks>
-   </import-profile>
-   <system-characteristics>
-      <!-- Section 3 - System Information -->
-      <!-- Table 3.1 Information System Name and Title -->
-      <system-id identifier-type="https://fedramp.gov">F00000000</system-id>
-      <system-name>System's Full Name</system-name>
-      <system-name-short>System's Short Name or Acronym</system-name-short>
-      <!-- General System Description -->
-      <description>
-         <p>[Insert CSO Name] is delivered as [a/an] [insert based on the Service Model above]
-            offering using a multi-tenant [insert based on the Deployment Model above] cloud
-            computing environment. It is available to [Insert scope of customers in accordance with
-            instructions above (for example, the public, federal, state, local, and tribal
-            governments, as well as research institutions, federal contractors, government
-            contractors etc.)].</p>
-         <p>NOTE: Additional description, including the purpose and functions of this system may be
-            added here. This includes any narrative text usually included in section 9.1 of the
-            SSP.</p>
-         <p>NOTE: The description is expected to be at least 32 words in length.</p>
-      </description>
-      <!-- Service & Deployment Model -->
-      <prop name="cloud-service-model" value="saas">
-         <remarks>
-            <p>Remarks are required if service model is "other". Optional otherwise.</p>
-         </remarks>
-      </prop>
-      <prop name="cloud-deployment-model" value="government-only-cloud">
-         <!-- Rev5 update - switch to core prop -->
-         <remarks>
-            <p>Remarks are required if deployment model is "hybrid-cloud" or "other". Optional
-               otherwise.</p>
-         </remarks>
-      </prop>
-      <!-- Digital Identity Level (DIL) Determination -->
-      <!-- 1 = low, 2= moderate, 3 = high  -->
-      <prop name="identity-assurance-level" value="2"/>
-      <prop name="authenticator-assurance-level" value="2"/>
-      <prop name="federation-assurance-level" value="2"/>
-      <prop ns="https://fedramp.gov/ns/oscal" name="fully-operational-date" value="2023-01-01+00:00"/>
-      <!-- Rev5 update - new prop -->
-      <!-- FedRAMP Authorization Path: fedramp-jab, fedramp-agency, or fedramp-li-saas -->
-      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency"/>
-      <!-- FIPS PUB 199 Level -->
-      <security-sensitivity-level>fips-199-moderate</security-sensitivity-level>
-      <system-information>
-         <!-- Rev5 update - PIA/PTAs are no longer required by FedRAMP -->
-         <!-- Table K.1 - Use the information-type element to provide details about all information types that are stored, processed, or transmitted by the system -->
-         <information-type uuid="11111111-2222-4000-8000-006000000001">
-            <title>Information Type Name</title>
-            <description>
-               <p>A description of the information.</p>
-            </description>
-            <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-               <information-type-id>C.2.4.1</information-type-id>
-            </categorization>
-            <confidentiality-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-moderate</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </confidentiality-impact>
-            <integrity-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-low</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </integrity-impact>
-            <availability-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-moderate</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </availability-impact>
-         </information-type>
-         <information-type uuid="11111111-2222-4000-8000-006000000002">
-            <title>Information Type Name</title>
-            <description>
-               <p>A description of the information.</p>
-            </description>
-            <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-               <information-type-id>C.3.5.1</information-type-id>
-            </categorization>
-            <confidentiality-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-low</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </confidentiality-impact>
-            <integrity-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-moderate</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </integrity-impact>
-            <availability-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-high</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </availability-impact>
-         </information-type>
-         <information-type uuid="11111111-2222-4000-8000-006000000003">
-            <title>Information Type Name</title>
-            <description>
-               <p>A description of the information.</p>
-            </description>
-            <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-               <information-type-id>C.3.5.8</information-type-id>
-            </categorization>
-            <confidentiality-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-moderate</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </confidentiality-impact>
-            <integrity-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-moderate</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </integrity-impact>
-            <availability-impact>
-               <base>fips-199-moderate</base>
-               <selected>fips-199-moderate</selected>
-               <adjustment-justification>
-                  <p>Required if the base and selected values do not match.</p>
-               </adjustment-justification>
-            </availability-impact>
-         </information-type>
-
-
-      </system-information>
-      <!-- Security Impact Level -->
-      <security-impact-level>
-         <security-objective-confidentiality>fips-199-moderate</security-objective-confidentiality>
-         <security-objective-integrity>fips-199-moderate</security-objective-integrity>
-         <security-objective-availability>fips-199-moderate</security-objective-availability>
-      </security-impact-level>
-
-      <!-- Fully Operational as of -->
-      <status state="operational">
-         <remarks>
-            <p>Remarks are optional if status/state is "operational".</p>
-            <p>Remarks are required otherwise.</p>
-         </remarks>
-      </status>
-
-      <!-- Section 8 - Illustrated Architecture and Narrative -->
-      <authorization-boundary>
-         <!-- Section 8.2 Narrative (boundary) -->
-         <description>
-            <p>A holistic, top-level explanation of the FedRAMP authorization boundary.</p>
-         </description>
-         <!-- Section 8.1 Illustrated Architecture (boundary diagram) -->
-         <diagram uuid="11111111-2222-4000-8000-007000000001">
-            <description>
-               <p>A diagram-specific explanation.</p>
-            </description>
-            <link href="#11111111-2222-4000-8000-001000000054" rel="diagram"/>
-            <caption>Authorization Boundary Diagram</caption>
-         </diagram>
-      </authorization-boundary>
-      <network-architecture>
-         <!-- Section 8.2 Narrative (network) -->
-         <description>
-            <p>A holistic, top-level explanation of the network architecture.</p>
-         </description>
-         <!-- Section 8.1 Illustrated Architecture (network diagram) -->
-         <diagram uuid="11111111-2222-4000-8000-007000000002">
-            <description>
-               <p>A diagram-specific explanation.</p>
-            </description>
-            <link href="#11111111-2222-4000-8000-001000000055" rel="diagram"/>
-            <caption>Network Diagram</caption>
-         </diagram>
-      </network-architecture>
-      <data-flow>
-         <!-- Section 8.2 Narrative (data flows) -->
-         <description>
-            <p>A holistic, top-level explanation of the system's data flows.</p>
-         </description>
-         <!-- Section 8.1 Illustrated Architecture (data flows) -->
-         <diagram uuid="11111111-2222-4000-8000-007000000003">
-            <description>
-               <p>A diagram-specific explanation.</p>
-            </description>
-            <link href="#11111111-2222-4000-8000-001000000056" rel="diagram"/>
-            <caption>Data Flow Diagram</caption>
-         </diagram>
-      </data-flow>
-   </system-characteristics>
-   <system-implementation>
-
-      <!-- Section 6 - Leveraged Authorizations. -->
-      <!--   Add one for each leveraged system -->
-      <!--   There must be a corresponding  component of type "system" for each leveraged authorization. -->
-
-      <leveraged-authorization uuid="11111111-2222-4000-8000-019000000001">
-         <title>AwesomeCloud Commercial(IaaS)</title>
-
-         <prop ns="https://fedramp.gov/ns/oscal" name="leveraged-system-identifier" value="F9999999999"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency">
-            <remarks>
-               <p>For now, this is a required field. In the future we intend 
-                  to pull this information directly from FedRAMP's records
-                  based on the "leveraged-system-identifier" property's value.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="fips-199-moderate">
-            <remarks>
-               <p>For now, this is a required field. In the future we intend 
-                  to pull this information directly from FedRAMP's records
-                  based on the "leveraged-system-identifier" property's value.</p>
-            </remarks>
-         </prop>
-
-         <party-uuid>11111111-2222-4000-8000-c0040000000a</party-uuid>
-         <date-authorized>2015-01-01</date-authorized>
-         <remarks>
-            <p>Use one leveraged-authorization assembly for each underlying authorized 
-               cloud system or general support system (GSS).</p>
-            <p>For each leveraged authorization there must also be a "system" component.
-               The corrisponding "system" component must include a 
-               "leveraged-authorization-uuid" property
-               that links it to this leveraged authorization.</p>
-         </remarks>
-      </leveraged-authorization>
-
-      <user uuid="11111111-2222-4000-8000-008000000001">
-         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
-         <prop name="type" value="internal"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
-         <role-id>system-poc-technical</role-id>
-         <authorized-privilege>
-            <title>Admin</title>
-            <description>
-               <p>admin user</p>
-            </description>
-            <function-performed>administration</function-performed>
-         </authorized-privilege>
-         <remarks>
-            <p>The user assembly is being reviewed for continued applicability 
-               under FedRAMP's adoption of Rev 5.</p>
-            <p>Currently, FedRAMP will only process user content if it includes the
-            FedRAMP "separation-of-duties-matrix" property/extension. All other user 
-            entries will be ignored by validation rules, but may be displayed by tools. </p>
-         </remarks>
-      </user>
-      <user uuid="11111111-2222-4000-8000-008000000002">
-         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
-         <prop name="type" value="internal"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
-
-         <role-id>system-poc-technical</role-id>
-         <authorized-privilege>
-            <title>Add/Remove Admins</title>
-            <function-performed>This can add and remove admins.</function-performed>
-         </authorized-privilege>
-      </user>
-      <user uuid="11111111-2222-4000-8000-008000000003">
-         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
-         <prop name="type" value="internal"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
-         <role-id>system-poc-technical</role-id>
-         <authorized-privilege>
-            <title>Admin</title>
-            <description>
-               <p>admin user</p>
-            </description>
-            <function-performed>administration</function-performed>
-         </authorized-privilege>
-      </user>
-      <user uuid="11111111-2222-4000-8000-008000000004">
-         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
-         <prop name="type" value="internal"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
-         <role-id>system-poc-technical</role-id>
-         <authorized-privilege>
-            <title>Admin</title>
-            <description>
-               <p>admin user</p>
-            </description>
-            <function-performed>administration</function-performed>
-         </authorized-privilege>
-      </user>
-      <user uuid="11111111-2222-4000-8000-008000000005">
-         <prop name="separation-of-duties-matrix" value="yes" ns="https://fedramp.gov/ns/oscal" />
-         <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
-         <prop name="type" value="internal"/>
-         <role-id>system-owner</role-id>
-         <authorized-privilege>
-            <title>Admin</title>
-            <description>
-               <p>admin user</p>
-            </description>
-            <function-performed>administration</function-performed>
-         </authorized-privilege>
-      </user>
-      <!-- ========= MINIMUM REQUIRED COMPONENT: THIS SYSTEM ======= -->
-      <!-- ========= MINIMUM REQUIRED COMPONENT: THIS SYSTEM ======= -->
-      <!-- ========= MINIMUM REQUIRED COMPONENT: THIS SYSTEM ======= -->
-      <!--         There must be a "this-system" component           -->
-      <component uuid="11111111-2222-4000-8000-009000000000" type="this-system">
-         <title>This System</title>
-         <description>
-            <p>This component represents the entire authorization boundary, 
-               as depicted in the system authorization boundary diagram.</p>
-            <p>FedRAMP requires exactly one "this-system" component, which is used
-            in control implementation responses and interconnections.</p>
-         </description>
-         <status state="operational"/>
-         <remarks>
-            <p>A FedRAMP SSP must always have exactly one "this-system" component
-               that represents the whole system.</p>
-            <p>It does not need system details, as those exist elsewhere in this SSP.</p>
-         </remarks>
-      </component>
-
-      <!-- ============= EXTERNAL COMPONENTS ============= -->
-      <!-- ============= EXTERNAL COMPONENTS ============= -->
-      <!-- ============= EXTERNAL COMPONENTS ============= -->
-
-      <!-- ==== Table 6.1 Leveraged Authorizations ====- -->
-      <!-- ==== Table 6.1 Leveraged Authorizations ====- -->
-
-      <!-- Leveraged FedRAMP-Authorized Systems -->
-      <component uuid="11111111-2222-4000-8000-009000100001" type="system">
-         <title>Awesome Cloud IaaS (Leveraged Authorized System)</title>
-         <description>
-            <p>Briefly describe the leveraged system.</p>
-         </description>
-         <prop name="leveraged-authorization-uuid" value="11111111-2222-4000-8000-019000000001"/>
-         <prop name="implementation-point" value="external"/>
-         <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001" />
-         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
-            <remarks>
-               <p>If 'yes', describe the authentication method.</p>
-               <p>If 'no', explain why no authentication is used.</p>
-               <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
-         <status state="operational"/>
-
-         <responsible-role role-id="provider">
-            <party-uuid>11111111-2222-4000-8000-c0040000000a</party-uuid>
-            <remarks>
-               <p>The "provider" role is required for the component representing
-               a leveraged system. It must reference exactly one party 
-               (via party-uuid), which points to a party of type "organization"
-               representing the organization that owns the leveraged system.</p>
-            </remarks>
-         </responsible-role>
-         <responsible-role role-id="administrator">
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="https://fedramp.gov/ns/oscal" />
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000005" ns="https://fedramp.gov/ns/oscal" />
-         </responsible-role>
-         <remarks>
-            <p>This is a leveraged system within which this system operates.
-               It is explicitly listed on the FedRAMP marketplace with a status of 
-               "FedRAMP Authorized".</p>
-            <h1>Requirements</h1>
-            <p>Each leveraged system must be expressed as a "system" component, and must have:</p>
-            <ul>
-               <li>the name of the system in the title - exactly as it appears in the FedRAMP
-                  Marketplace</li>
-               <li>a "leveraged authorization-uuid" core property that links this component to the
-                  leveraged-authorization entry</li>
-               <li>an "implementation-point" core property with a value of "external"</li>
-               <li>A "nature-of-agreement" property/extension with an appropriate allowed value. If the value is
-                  "other", use the proeprty's remarks to descibe the agreement.</li>
-               <li>an "authentication-method" property/extension with a value of "yes", "no" or 
-                  "not-applicable" with commentary in the remarks.</li>
-               <li>One or more "information-type" property/extensions, where the a
-                  llowed values are the 800-63
-                  information type identifiers.</li>
-               <li>A "provider" responsible-role with exactly one party-uuid entry
-                  that indicates which organization is the provider of this leveraged system.</li>
-               <li>a status with a state value of "operational"</li>
-               <li>At least one responsible-role (other than "provider") that indicates any authorized
-                  users. This must have one or more "privilege-uuid" property/extensions. Each references
-                  a user assembly entry.</li>
-            </ul>
-            <p/>
-            <p>Where relevant, this component should also have:</p>
-            <ul>
-               <li>An "inherited-uuid" property if the leveraged system's owner provides a UUID for
-                  their system (such as in an OSCAL-based CRM).</li>
-            </ul>
-            <p/>
-            <p>Links to the vendor website describing the system are encouraged, but not required.</p>
-
-            <h1>Services</h1>
-            <p>A service within the scope of the leveraged system's authorization boundary 
-               is considered an "authorized service". Any other service offered by the 
-               leveraged system is considered a "non-authorized service"</p>
-            <p>Represent each authorized or non-authorized leveraged services using a 
-               "service" component. Both authorized and non-authorized service components 
-               are represented the same in OSCAL with the following exceptions:</p>
-            <ul>
-               <li>The component for an authorized servcie includes a 
-                   "leveraged-authorization-uuid" property. This 
-                   property must be excluded from the component of a 
-                   non-authorized leveraged service.</li>
-               <li>The component for a non-authorized service must include 
-                  a "still-supported" property/extension.</li>
-               <li>The component for a non-authorized service must have
-               a "poam-item" link that references a corrisponding entry in this system's
-               POA&amp;M.</li>
-            </ul>
-
-            <p>Both authorized and non-authorized leveraged services include:</p>
-            <ul>
-               <li>a "provided-by" link with a URI fragment that points
-               to the "system" component representing the leveraged system. 
-               (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)
-               </li>
-               <li>the name of the service in the title (for authorized services this should be 
-                  exactly as it appears in the FedRAMP Marketplace</li>
-               <li>an "implementation-point" core property with a value of "external"</li>
-               <li>an "authentication-method" property/extension with a value of "yes", "no" or 
-                  "not-applicable" with commentary in the remarks.</li>
-               <li>One or more "information-type" property/extensions, where the a
-                  llowed values are the 800-63
-                  information type identifiers.</li>
-               <li>a status with a state value of "operational"</li>
-               <li>At least one responsible-role (other than "provider") that indicates any authorized
-                  users. This must have one or more "privilege-uuid" property/extensions. Each references
-                  a user assembly entry.</li>
-            </ul>
-
-            <p>Although SSP Table 7.1 also requires data categoriation and hosting
-               environment information about non-authorized leveraged services,
-               these datails are derived from other content in this SSP.</p>
-         </remarks>
-      </component>
-
-      <!-- Authorized Service from a Leveraged FedRAMP-Authorized System -->
-      <component uuid="11111111-2222-4000-8000-009000500001" type="service">
-         <title>Service A</title>
-         <description>
-            <p>An authorized service provided by the Awesome Cloud leveraged authorization.</p>
-            <p>Describe the service and what it is used for.</p>
-         </description>
-         <prop name="leveraged-authorization-uuid" value="11111111-2222-4000-8000-019000000001"/>
-         <prop name="implementation-point" value="external"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
-         <link rel="provided-by" href="#11111111-2222-4000-8000-009000100001"/>
-         <status state="operational"/>
-         <responsible-role role-id="administrator">
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000004" ns="https://fedramp.gov/ns/oscal" />
-            <prop name="privilege-uuid" value="11111111-2222-4000-8000-008000000005" ns="https://fedramp.gov/ns/oscal" />
-         </responsible-role>
-         <remarks>
-            <p>This is a service offered by a leveraged system and used by this system.
-               It is explicitly listed on the FedRAMP marketplace as being included in the
-               scope of this leveraged system's ATO, thus is considered an "Authorized Service.</p>
-            <p/>
-            <p>Each leveraged service must be expressed as a "service" component, and must have:</p>
-            <ul>
-               <li>the name of the service in the title - exactly as it appears in the FedRAMP
-               Marketplace</li>
-               <li>a "leveraged authorization-uuid" property that links this component to the
-               leveraged-authorization entry</li>
-               <li>an "implementation-point" property with a value of "external"; and</li>
-               <li>a "provided-by" link with a URI fragment that points  to the 
-                  "system" component representing the leveraged system. (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)
-               </li>
-            </ul>
-            <p/>
-            <p>Where relevant, this component should also have:</p>
-            <ul>
-               <li>One or more "information-type" properties, where the allowed values are the 800-63
-               information type identifiers.</li>
-               <li>At least one responsible-role that indicates the authorized userswith a role-id of "leveraged-authorization-users" and exactly
-               one or more party-uuid entries that indicates which users within this system may
-               interact with the leveraged systeme.</li>
-               <li>An "inherited-uuid" property if the leveraged system's owner provides a UUID for
-                  their system (such as in an OSCAL-based CRM).</li>
-            </ul>
-            <p>Link(s) to the vendor's web site describing the service are encouraged, but not
-               required.</p>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               leveraged-authorization assembly:</p>
-            <ul>
-               <li>Package ID, Authorization Type, Impact Level</li>
-            </ul>
-            <p/>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               "system" component representing the leveraged system as a whole:</p>
-            <p>- Nature of Agreement, CSP Name</p>
-         </remarks>
-      </component>
-
-      <!-- ==== Table 7.1 Leveraged Authorizations ====- -->
-      <!-- ==== Table 7.1 Leveraged Authorizations ====- -->
-
-      <!-- Scenario 1: A non-authorized service from a FedRAMP leveraged authorization -->
-      <component uuid="11111111-2222-4000-8000-009000500002" type="service">
-         <title>Service B</title>
-         <description>
-            <p>An non-authorized service provided by the Awesome Cloud leveraged authorization.</p>
-            <p>Describe the service and what it is used for.</p>
-         </description>
-         <prop name="implementation-point" value="external" />
-         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="provider" value="self"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="still-supported" value="yes"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
-            <remarks>
-               <p>If 'yes', describe the authentication method.</p>
-               <p>If 'no', explain why no authentication is used.</p>
-               <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1" />
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8" />
-         <prop name="poam-item-uuid" ns="https://fedramp.gov/ns/oscal" value="11111111-3333-4000-8000-000000000001" />
-         <prop name="poam-id" ns="https://fedramp.gov/ns/oscal" value="ID-0001" />
-         <link rel="provided-by" href="#11111111-2222-4000-8000-009000100001" />
-         <status state="operational" />
-         <responsible-role role-id="admin">
-
-         </responsible-role>
-         <responsible-role role-id="provider">
-            <party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
-         </responsible-role>
-         <remarks>
-            <p>This is a service offered by a leveraged system and used by this system.
-               It is NOT explicitly listed on the FedRAMP marketplace as being included 
-               in the scope of the leveraged system's ATO, thus is treated as a 
-               non-authorized, leveraged service.</p>
-            <p/>
-            <p>Each non-authorized leveraged service must be expressed as a "service" component, and must have:</p>
-            <ul>
-               <li>the name of the service in the title - exactly as it appears in the FedRAMP
-                  Marketplace</li>
-               <li>an "implementation-point" property with a value of "external"; and</li>
-               <li>one or two "direction" prperty/extensions</li>
-               <li>One or more "information-type" property/extensions, where the allowed values are the 800-63
-                  information type identifiers, and the cited types are included full list of system information types.</li>
-               <li>exactly one "poam-item" link, with an href value that references the 
-                  POA&amp;M and a resource-fragment that represents the 
-                  POAM&amp;M ID (legacy) in a Excel workbook or poam-item-uuid (preferred)
-                  in an OSCAL-based POA&amp;M.</li>
-               <li>a "provided-by" link with a URI fragment that points to the 
-                  "system" component representing the leveraged system. (Example: <code>"#11111111-2222-4000-8000-009000100001"</code>)
-               </li>
-               <li></li>
-               <li></li>
-
-            </ul>
-            <p>The "leveraged-authorization-uuid" property must NOT be present, as this is how
-               tools are able to distinguish between authorized and non-authorized services
-               from the same leveraged provider.</p>
-            <p/>
-
-            <p>Where relevant, this component should also have:</p>
-            <ul>
-               <li>At least one responsible-role that indicates the authorized userswith a role-id of "leveraged-authorization-users" and exactly
-                  one or more party-uuid entries that indicates which users within this system may
-                  interact with the leveraged systeme.</li>
-               <li>An "inherited-uuid" property if the leveraged system's owner provides a UUID for
-                  their system (such as in an OSCAL-based CRM).</li>
-            </ul>
-            <p>Link(s) to the vendor's web site describing the service are encouraged, but not
-               required.</p>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               leveraged-authorization assembly:</p>
-            <ul>
-               <li>Package ID, Authorization Type, Impact Level</li>
-            </ul>
-            <p/>
-
-            <p>- An "inherited-uuid" property if the leveraged system's owner provides a UUID for
-               their system (such as in an OSCAL-based CRM).</p>
-            <p>Link(s) to the vendor's web site describing the service are encouraged, but not
-               required.</p>
-            <p/>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               leveraged-authorization assembly:</p>
-            <p>- Package ID, Authorization Type, Impact Level</p>
-            <p/>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               "system" component assembly:</p>
-            <p>- Nature of Agreement, CSP Name</p>
-            <p/>
-            <p>An unauthorized service from an underlying leveraged authorization must NOT have the "leveraged-authorization-uuid" property. The presence or absence of this property is how the authorization status of a service is indicated.</p>
-         </remarks>
-      </component>
-
-      <!-- Scenario 2: An interconnection between this system and an external system -->
-      <!-- Scenario 2 - Part 1: An external system with which this system has an interconnection -->
-      <component uuid="11111111-2222-4000-8000-009000100002" type="service">
-         <title>Other Cloud SaaS</title>
-         <description>
-            <p>An external system to which this system shares an interconnection.</p>
-         </description>
-         <prop name="asset-type" value="saas"/>
-
-         <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001" />
-
-         <status state="operational"/>
-
-         <responsible-role role-id="provider">
-            <party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="authorizing-official">
-            <party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="system-owner">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="system-poc-management">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="system-poc-technical">
-            <party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
-         </responsible-role>
-         <protocol name="ldap" uuid="11111111-2222-4000-8000-010000000002">
-            <title>services</title>
-            <port-range start="389" end="389" transport="TCP" />
-         </protocol>
-         <remarks>
-            <p>Each interconnection to one or more remote systems must have:</p>
-            <ul>
-               <li>a "system" component (this component)</li>
-               <li>an "interconnection" component</li>
-            </ul>
-            <p>Each "system" component must have:</p>
-            <ul>
-               <li>an "asset-type" property with a value of "saas", "paas", "iaas" or "other"</li>
-               <li>an "implementation-point" property with a value of "external"</li>
-               <li>a "status" field with a state value of "operational"</li>
-               <li>if an interconnection exists with this system and there are 
-                  remote listening ports, one or more "protocol" assemblies must
-                  be provided.</li>
-            </ul>
-
-            <p>While not required, each "system" component should have:</p>
-            <ul>
-               <li>an "inherited-uuid" property if the value was provided by the system owner</li>
-               <li>a "compliance" property/extension if appropriate</li>
-               <li>an "authorizing-official" responsible-role</li>
-               <li>an "system-owner" responsible-role</li>
-               <li>an "system-poc-management" responsible-role</li>
-               <li>an "system-poc-technical" responsible-role</li>
-            </ul>
-            <p>Unlike prior FedRAMP OSCAL publications, avoid the use of FedRAMP 
-               properties/extensions for these roles, instead favor the core OSCAL
-               responsible-roles constructs, and the NIST-standard roles of 
-               "authorizing-official", "system-owner", "system-poc-management
-               and "system-poc-technical"</p>
-         </remarks>
-      </component>
-
-      <!-- Scenario 2 - Part 2: Interconnection to external system -->
-      <component uuid="11111111-2222-4000-8000-009000200001" type="service">
-         <!-- Use title element to provid System/ Service/ API/CLI Name -->
-         <title>[EXAMPLE]Authorized Connection Information System Name</title>
-         <description>
-            <p>Describe the purpose of the external system/service; specifically, provide reasons
-               for connectivity (e.g., system monitoring, system alerting, download updates, etc.)</p>
-         </description>
-         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="incoming"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="contract"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
-            <remarks>
-               <p>If 'yes', describe the authentication method in the remarks.</p>
-               <p>If 'no', explain why no authentication is used in the remarks.</p>
-               <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="compliance" value="soc-2-type-1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="compliance" value="pci-dss"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="compliance" value="iso-27001"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="hosting-environment" value="see-remarks">
-            <remarks>
-               <p>Describe the hosting of the interconnection itself (NOT the hosting of the remote system).</p>
-            </remarks>
-         </prop>
-
-
-         <prop ns="https://fedramp.gov/ns/oscal" name="ipv4-address" class="local" value="10.1.1.1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="ipv6-address" class="local" value="::ffff:10.1.1.1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="ipv4-address" class="remote" value="10.2.2.2"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="ipv6-address" class="remote" value="::ffff:10.2.2.2"/>
-
-         <prop ns="https://fedramp.gov/ns/oscal" name="connection-security" value="ipsec" />
-
-         <link rel="agreement" href="#11111111-2222-4000-8000-001000000058"/>
-         <link rel="used-by" href="#11111111-2222-4000-8000-009000000000" />
-         <link rel="used-by" href="#11111111-2222-4000-8000-009000100002" />
-
-
-
-         <status state="operational"/>
-
-         <responsible-role role-id="provider">
-            <party-uuid>44444444-2222-4000-8000-004000000001</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="isa-poc-remote">
-            <party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="isa-poc-local">
-            <party-uuid>11111111-2222-4000-8000-004000000008</party-uuid>
-         </responsible-role>
-
-         <protocol name="ftp" uuid="11111111-2222-4000-8000-010000000001">
-            <title>Incoming FTP Service</title>
-            <port-range start="80" end="80" transport="TCP" />
-         </protocol>
-         <remarks>
-            <p>Each interconnection to one or more remote systems must have:</p>
-            <ul>
-               <li>one "system" component for each remote system sharing the connection</li>
-               <li>an "interconnection" component (this component)</li>
-            </ul>
-            <p>Each "interconnection" component must have:</p>
-            <ul>
-               <li>an "implementation-point" property with a value of "external"</li>
-               <li>a "status" field with a state value of "operational"</li>
-               <li>one or two "direction" properties</li>
-               <li>a "nature-of-agreement" property/extension</li>
-               <li>one or more "authentication-method" properties/extensions.</li>
-               <li>a "hosting-environment" proptery/extension</li>
-               <li>at least one local ipv4 address, ipv6 address or URI via the appropriate property, with the class set to "local" </li>
-               <li>at least one remote ipv4 address, ipv6 address or URI via the appropriate property, with the class set to "remote" </li>
-               <li>at least one "protocol" field with the name set to "local" or "remote" depending on which side is "listening" on the identified ports.</li>
-               <li>at least one "agreement" link with an href vlue that refers to a back-matter resource containing the interconnection security agreemnet (ISA)</li>
-               <li>exactly one "used-by" link with an href value that refers to the "this-system" component.</li>
-               <li>one or more "used-by" links with href values that refer to each "system" component representing a remote system sharing the connection.</li>
-               <li>exactly one "provider" responsible role that references the party information for the organization the provides the connection.</li>
-            </ul>
-            <p>Authentication methods must address both system-authentication as well as 
-               user authentication mechanisms.</p>
-            <p>Describe the hosting of the interconnection itself (NOT the hosting of the remote system).</p>
-            <p>If the interconnection travels across the public Internet, the provider may be the cloud hosting provider or the Internet provider</p>
-            <p />
-            <p>While not required, each "interconnection" component should have:</p>
-            <ul>
-               <li>an "inherited-uuid" property if the value was provided by the system owner</li>
-               <li>a "compliance" property/extension if appropriate</li>
-               <li>an "system-poc-management" responsible-role</li>
-               <li>an "system-poc-technical" responsible-role</li>
-            </ul>
-            <p>Unlike prior FedRAMP OSCAL publications, avoid the use of FedRAMP 
-               properties/extensions for these roles, instead favor the core OSCAL
-               responsible-roles constructs, and the NIST-standard roles of 
-               "system-poc-management" and "system-poc-technical". With an interconnection, 
-               the system POC roles reference parties that represent the connection provider.</p>
-         </remarks>
-      </component>
-
-      <!-- Scenario 3: A service from an external system other than the leveraged system -->
-      <!-- Scenario 3 - Part 1: An external system that offers a service used by this system -->
-      <component uuid="11111111-2222-4000-8000-009000100003" type="system">
-         <title>Other Cloud SaaS</title>
-         <description>
-            <p/>
-         </description>
-         <prop ns="https://fedramp.gov/ns/oscal" name="asset-type" value="saas"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="isa" />
-         <prop name="implementation-point" value="external" />
-         <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001" />
-
-         <status state="operational"/>
-
-         <responsible-role role-id="system-owner">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="system-poc-management">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="system-poc-technical">
-            <party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
-         </responsible-role>
-         <remarks>
-            <p>For each external system with which this system connects:</p>
-            <p>Must have a "system" component (this component).</p>
-            <p>Must have an "interconnection" component that connects this component with the
-               "this-system" component.</p>
-            <p>If the leveraged system owner provides a UUID for their system (such as in an
-               OSCAL-based CRM), it should be reflected in the <code>inherited-uuid</code>
-               property.</p>
-            <p>Must include all leveraged services and features from the leveraged authorization
-               here.</p>
-            <p>For an external system, the "implementation-point" property must always be present
-               with a value of "external".</p>
-
-
-            <p>Each interconnection must be defined with both an "system" component and an
-               "interconnection" component.</p>
-            <p>Must include all leveraged services and features from the leveraged authorization
-               here.</p>
-         </remarks>
-      </component>
-
-      <!-- Scenario 3 - Part 2: An external service  -->
-      <component uuid="11111111-2222-4000-8000-009000500003" type="service">
-         <title>Service C</title>
-         <description>
-            <p>A service provided by an external system other than the leveraged system.</p>
-            <p>Describe the service and what it is used for.</p>
-         </description>
-         <prop name="implementation-point" value="external"/>
-         <!--         <prop name="direction" value="outgoing"/>-->
-         <prop name="leveraged-authorization-uuid" value="11111111-2222-4000-8000-019000000001"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
-            <remarks>
-               <p>If 'yes', describe the authentication method in the remarks.</p>
-               <p>If 'no', explain why no authentication is used in the remarks.</p>
-               <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.8"/>
-         <prop name="inherited-uuid" value="22222222-0000-4000-9001-009000000001">
-            <remarks>
-               <p>This can only be known if provided by the leveraged system.
-                  such as via an OSCAL-based CRM, component definition,
-                  or as a result to the leveraged system's OSCAL-based SSP.</p>
-            </remarks>
-         </prop>
-         <link rel="provided-by" href="#11111111-2222-4000-8000-009000100003" />
-         <status state="operational"/>
-
-         <responsible-role role-id="leveraged-authorization-users">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-            <party-uuid>11111111-2222-4000-8000-004000000012</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="provider">
-            <party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
-         </responsible-role>
-
-         <protocol name="abc" uuid="11111111-2222-4000-8000-010000000003">
-            <title></title>
-            <port-range start="5432" end="5432" transport="TCP" />
-         </protocol>
-
-         <remarks>
-            <p>This is a service provided by an external system other than the leveraged system.</p>
-            <p>As a result, the "leveraged-authorization-uuid" property is not applicable and must
-               NOT be used.</p>
-            <p/>
-            <p>Each external service used from a leveraged authorization must have:</p>
-            <p>- a "system" component (CURRENTLY DEFERRED DUE TO A KNOWN ISSUE WITH THE "provided-by" link relationship).</p>
-            <p>- a "service" component (this component).</p>
-            <p/>
-            <p>This component must always have:</p>
-            <p>- The name of the service in the title - preferably exactly as it appears on the
-               vendor's web site</p>
-            <p>- A "risk" property/extension - using the remarks, either describe any risk or state there is no risk and provide a basis for that assertion.</p>
-            <p>- An "implementation-point" property with a value of "external".</p>
-            <p>- A "provided-by" link with a URI fragment that points to the UUID of the above
-               "system" component.</p>
-            <p> - Example: <code>"#11111111-2222-4000-8000-009000100001"</code>
-            </p>
-            <p> - IMPORTANT: Due to a known error in core OSCAL (versions &lt;=1.1.2) constraints,
-               this property is blocked from proper use.</p>
-            <p>- a status with a state value of "operational"</p>
-            <p/>
-            <p>Where relevant, this component should also have:</p>
-            <p>- One or more "information-type" properties, where the allowed values are the 800-63
-               information type identifiers.</p>
-            <p>- A responsible-role with a role-id of "leveraged-authorization-users" and exactly
-               one or more party-uuid entries that indicates which users within this system may
-               interact with the leveraged systeme.</p>
-            <p>- An "inherited-uuid" property if the leveraged system's owner provides a UUID for
-               their system (such as in an OSCAL-based CRM).</p>
-            <p>Link(s) to the vendor's web site describing the service are encouraged, but not
-               required.</p>
-            <p/>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               leveraged-authorization assembly:</p>
-            <p>- Package ID, Authorization Type, Impact Level</p>
-            <p/>
-            <p>The following fields from the Leveraged Authorization Table are handled in the
-               "system" component assembly:</p>
-            <p>- Nature of Agreement, CSP Name</p>
-            <p/>
-            <p>An unauthorized service from an underlying leveraged authorization must NOT have the "leveraged-authorization-uuid" property. The presence or absence of this property is how the authorization status of a service is indicated.</p>
-         </remarks>
-      </component>
-
-      <!-- Scenario 4: A service from this system offered to external systems -->
-      <component uuid="11111111-2222-4000-8000-009000500004" type="service">
-         <title>Service C</title>
-
-         <description>
-            <p>A service provided by an external system other than the leveraged system.</p>
-            <p>Describe the service and what it is used for.</p>
-         </description>
-
-         <prop name="implementation-point" value="internal"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="provider" value="self"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
-            <remarks>
-               <p>If 'yes', describe the authentication method in the remarks.</p>
-               <p>If 'no', explain why no authentication is used in the remarks.</p>
-               <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="risk" value="see-remarks">
-            <remarks>
-               <p>Either describe a risk associated with this service, or indicate there is no identified risk.</p>
-               <p>If there is no risk, please explain your basis for that conclusion.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="impact" value="see-remarks">
-            <remarks>
-               <p>If there are one or more identified risks, describe any resulting impact.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="mitigation" value="see-remarks">
-            <remarks>
-               <p>If there are one or more identified risks, describe any mitigating factors.</p>
-            </remarks>
-         </prop>
-
-         <!-- <link href="11111111-2222-4000-8000-009000000000" rel="used-by"/> -->
-         <link rel="api" href="https://api.example.com/v1" />
-         <status state="operational"/>
-         <responsible-role role-id="provider">
-            <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
-         </responsible-role>
-
-         <protocol name="remote" uuid="11111111-2222-4000-8000-010000000002">
-            <title>Remote API Service</title>
-            <port-range start="443" end="443" transport="TCP"/>
-         </protocol>
-
-         <remarks>
-            <p>This is a service provided by an external system other than the leveraged system.</p>
-
-
-
-            <p>- A "risk" property/extension - using the remarks, either describe any risk or state there is no risk and provide a basis for that assertion.</p>
-
-
-
-            <p>As a result, the "leveraged-authorization-uuid" property is not applicable and must
-               NOT be used.</p>
-            <p>All services require the "implementation-point" property. In this case, the property
-               value is set to "external.</p>
-            <p>All external services would normally require a "provided-by" link; however, a known
-               bug in core OSCAL syntax prevents the use of this property at this time.</p>
-            <p>If the leveraged system owner provides a UUID for their service (such as in an
-               OSCAL-based CRM), it should be reflected in the <code>inherited-uuid</code>
-               property.</p>
-
-
-
-
-         </remarks>
-      </component>
-
-      <!-- Scenario 5: A CLI that connects to leveraged or external systems -->
-      <component uuid="11111111-2222-4000-8000-009000300001" type="software">
-         <title>Management CLI</title>
-         <description>
-            <p>None</p>
-         </description>
-         <prop name="asset-type" value="cli"/>
-         <prop name="implementation-point" value="internal"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="provider" value="self"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="direction" value="outgoing"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
-            <remarks>
-               <p>If 'yes', describe the authentication method in the remarks.</p>
-               <p>If 'no', explain why no authentication is used in the remarks.</p>
-               <p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="web"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="login-url" value="https://admin.offering.com/login"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="risk" value="see-remarks">
-            <remarks>
-               <p>Either describe a risk associated with this CLI, or indicate there is no identified risk.</p>
-               <p>If there is no risk, please explain your basis for that conclusion.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="impact" value="see-remarks">
-            <remarks>
-               <p>If there are one or more identified risks, describe any resulting impact.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="mitigation" value="see-remarks">
-            <remarks>
-               <p>If there are one or more identified risks, describe any mitigating factors.</p>
-            </remarks>
-         </prop>
-         <prop name="allows-authenticated-scan" value="no">
-            <remarks>
-               <p/>
-            </remarks>
-         </prop>
-         <link rel='provided-by' href="#11111111-2222-4000-8000-009000100001" />
-         <status state="operational"/>
-         <responsible-role role-id="provider">
-            <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
-         </responsible-role>
-      </component>
-
-
-
-      <!-- ============= INTERNAL COMPONENTS ============= -->
-      <!-- ============= INTERNAL COMPONENTS ============= -->
-      <!-- ============= INTERNAL COMPONENTS ============= -->
-      <component uuid="11111111-2222-4000-8000-009000500005" type="service">
-         <title>Service D</title>
-         <description>
-            <p>A service that exists within the authorization boundary.</p>
-            <p>Describe the service and what it is used for.</p>
-         </description>
-         <prop name="implementation-point" value="internal"/>
-         <status state="operational"/>
-      </component>
-
-
-
-      <!-- Section 10 / Appendix Q - Cryptographic Modules -->
-      <!-- NOTE: Must set type="cryptographic-module" -->
-      <!-- List all cryptographic modules for Data-at-Rest (DAT) - must referenced by using component(s), provide CMVP #, FIPS validation status, Vendor Name, Module Name, and brief usage description -->
-      <component uuid="11111111-2222-4000-8000-009001200001" type="validation">
-         <title>[SAMPLE]Cryptographic Module Name</title>
-         <description>
-            <p>Provide a description and any pertinent note regarding the use of this CM.</p>
-            <p>For data-at-rest modules, describe type of encryption implemented (e.g., full disk,
-               file, record-level, etc.)</p>
-            <p>Lastly, provide any supporting notes on FIPS status (e.g. historical) or lack of FIPS
-               compliance (e.g., Module in Process).</p>
-         </description>
-         <!-- Rev 5 new props for CMs -->
-         <prop ns="https://fedramp.gov/ns/oscal" name="asset-type" value="cryptographic-module"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="vendor-name" value="CM Vendor"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="cryptographic-module-usage" value="data-at-rest"/>
-         <!-- Provide the validation type for this CM -->
-         <prop name="validation-type" value="fips-140-2"/>
-         <!-- Provide the certificate number (CMVP #) -->
-         <prop name="validation-reference" value="3928"/>
-         <link rel="validation-details" href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3928"/>
-         <status state="operational"/>
-      </component>
-      <!-- List all cryptographic modules for Data-in-Transit (DIT) - must referenced by using component(s), provide CMVP #, FIPS validation status, Vendor Name, Module Name, and brief usage description -->
-      <component uuid="11111111-2222-4000-8000-009001200002" type="validation">
-         <title>[SAMPLE]Cryptographic Module Name</title>
-         <description>
-            <p>Provide a description and any pertinent note regarding the use of this CM.</p>
-            <p>For example, any supporting notes on FIPS status (e.g. historical) or lack of FIPS
-               compliance (e.g., Module in Process).</p>
-         </description>
-         <!-- Rev5 new props for CMs -->
-         <prop ns="https://fedramp.gov/ns/oscal" name="asset-type" value="cryptographic-module"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="vendor-name" value="CM Vendor"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="cryptographic-module-usage" value="data-in-transit"/>
-         <!-- Provide the validation type for this CM -->
-         <prop name="validation-type" value="fips-140-3"/>
-         <!-- Provide the certificate number (CMVP #) -->
-         <prop name="validation-reference" value="3920"/>
-         <link rel="validation-details" href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3920"/>
-         <status state="operational"/>
-      </component>
-
-
-
-
-      <!-- Use Components to identify Security and Management Technologies (Table 8.1), -->
-      <!-- including Operating Systems, IAM/Access Management, Endpoint/Antivirus (AV), -->
-      <!-- File Integrity Monitoring (FIM), Code Repository, Service Desk / Ticketing,  -->
-      <!-- Configuration Management, Firewall, VPN, Multifactor Authentication (MFA),   -->
-      <!-- SIEM, Secrets Management, Vulnerability Scanning -->
-      <component uuid="11111111-2222-4000-8000-009000300002" type="software">
-         <title>[SAMPLE]Product Name</title>
-         <description>
-            <p>FUNCTION: Describe typical component function.</p>
-         </description>
-         <prop name="asset-type" value="operating-system"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <prop name="vendor-name" value="Vendor Name"/>
-         <prop name="model" value="Model Number"/>
-         <prop name="version" value="Version Number"/>
-         <prop name="patch-level" value="Patch Level"/>
-         <link rel="validation" href="#11111111-2222-4000-8000-009000000002"/>
-         <status state="operational"/>
-         <responsible-role role-id="admin-unix">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         </responsible-role>
-         <remarks>
-            <p>COMMENTS: Provide other comments as needed.</p>
-         </remarks>
-      </component>
-
-      <component uuid="11111111-2222-4000-8000-009000300003" type="software">
-         <title>[SAMPLE]Product Name</title>
-         <description>
-            <p>FUNCTION: Describe typical component function.</p>
-         </description>
-         <prop name="asset-type" value="operating-system"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <prop name="vendor-name" value="Vendor Name"/>
-         <prop name="model" value="Model Number"/>
-         <prop name="version" value="Version Number"/>
-         <prop name="patch-level" value="Patch Level"/>
-         <link rel="validation" href="#11111111-2222-4000-8000-009000000002"/>
-         <status state="operational"/>
-         <responsible-role role-id="admin-unix">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         </responsible-role>
-         <remarks>
-            <p>COMMENTS: Provide other comments as needed.</p>
-         </remarks>
-      </component>
-
-
-      <component uuid="11111111-2222-4000-8000-009000400001" type="hardware">
-         <title>[SAMPLE]Product</title>
-         <description>
-            <p>FUNCTION: Describe typical component function.</p>
-         </description>
-         <prop name="asset-type" value="database"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="database"/>
-         <prop name="vendor-name" value="Vendor Name"/>
-         <prop name="model" value="Model Number"/>
-         <prop name="version" value="Version Number"/>
-         <status state="operational"/>
-         <responsible-role role-id="asset-administrator">
-            <party-uuid>11111111-2222-4000-8000-004000000017</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="asset-owner">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <remarks>
-            <p>COMMENTS: Provide other comments as needed.</p>
-         </remarks>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000300004" type="software">
-         <title>OS Sample</title>
-         <description>
-            <p>None</p>
-         </description>
-         <prop name="asset-type" value="operating-system"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
-         <prop name="allows-authenticated-scan" value="yes"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000300005" type="service">
-         <title>Database Sample</title>
-         <description>
-            <p>None</p>
-         </description>
-         <prop name="asset-type" value="database"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="database"/>
-         <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
-         <prop name="allows-authenticated-scan" value="yes"/>
-         <link href="#11111111-2222-4000-8000-009000500006" rel="used-by" />
-         <status state="operational"/>
-         <protocol name="postgresql">
-            <port-range start="5432" end="5432" transport="TCP" />
-            <port-range start="5432" end="5432" transport="UDP" />
-         </protocol>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000300006" type="software">
-         <title>Appliance Sample</title>
-         <description>
-            <p>None</p>
-         </description>
-         <prop name="asset-type" value="appliance"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="web"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="login-url" value="https://admin.offering.com/login"/>
-         <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
-         <prop name="allows-authenticated-scan" value="no">
-            <remarks>
-               <p>Vendor appliance. No admin-level access.</p>
-            </remarks>
-         </prop>
-         <status state="operational"/>
-      </component>
-
-      <!-- SSP Attachments - Policies -->
-      <component uuid="11111111-2222-4000-8000-009000600001" type="policy">
-         <title>AC Policy</title>
-         <description>
-            <p>The Access Control Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000005" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600002" type="policy">
-         <title>AT Policy</title>
-         <description>
-            <p>The Awareness and Training Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000006" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600003" type="policy">
-         <title>AU Policy</title>
-         <description>
-            <p>The Audit and Accountability governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600004" type="policy">
-         <title>CA Policy</title>
-         <description>
-            <p>The Assessment, Authorization, and Monitoring Policy governs how access is managed
-               and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000008" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600005" type="policy">
-         <title>CM Policy</title>
-         <description>
-            <p>The Configuration Management Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000009" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600006" type="policy">
-         <title>CP Policy</title>
-         <description>
-            <p>The Contingency Planning Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000010" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600007" type="policy">
-         <title>IA Policy</title>
-         <description>
-            <p>The Identificaiton and Authentication Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000011" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600008" type="policy">
-         <title>IR Policy</title>
-         <description>
-            <p>The Incident Response Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000012" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600009" type="policy">
-         <title>MA Policy</title>
-         <description>
-            <p>The Maintenance Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-0010000000013" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600010" type="policy">
-         <title>MP Policy</title>
-         <description>
-            <p>The Media Protection Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-0010000000014" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600011" type="policy">
-         <title>PE Policy</title>
-         <description>
-            <p>The Physical and Enviornmental Protection Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000015" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600012" type="policy">
-         <title>PL Policy</title>
-         <description>
-            <p>The Planning Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000016" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600013" type="policy">
-         <title>PM Policy</title>
-         <description>
-            <p>The Program Management Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000017" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600014" type="policy">
-         <title>PS Policy</title>
-         <description>
-            <p>The Personnel Security Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000018" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600015" type="policy">
-         <title>PT Policy</title>
-         <description>
-            <p>The PII Processing and Transparency Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000019" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600016" type="policy">
-         <title>RA Policy</title>
-         <description>
-            <p>The Risk Assessment Policy governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000020" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600017" type="policy">
-         <title>SA Policy</title>
-         <description>
-            <p>The System and Services Acquisition Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000021" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600018" type="policy">
-         <title>S3 Policy</title>
-         <description>
-            <p>The System and Communication Protection Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000022" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600019" type="policy">
-         <title>SI Policy</title>
-         <description>
-            <p>The System and Information Integrity Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000023" rel="policy"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000600020" type="policy">
-         <title>SR Policy</title>
-         <description>
-            <p>The Supply Chain Risk Management Policy governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000024" rel="policy"/>
-         <status state="operational"/>
-      </component>
-
-      <!-- SSP Attachments - Procedures -->
-      <component uuid="11111111-2222-4000-8000-009000800001" type="process-procedure">
-         <title>AC Policy</title>
-         <description>
-            <p>The Access Control Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000023" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800002" type="process-procedure">
-         <title>AT Policy</title>
-         <description>
-            <p>The Awareness and Training Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000024" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800003" type="process-procedure">
-         <title>AU Policy</title>
-         <description>
-            <p>The Audit and Accountability Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000025" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800004" type="process-procedure">
-         <title>CA Policy</title>
-         <description>
-            <p>The Assessment, Authorization, and Monitoring Procedure governs how access is managed
-               and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000026" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800005" type="process-procedure">
-         <title>CM Policy</title>
-         <description>
-            <p>The Configuration Management Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000027" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800006" type="process-procedure">
-         <title>CP Policy</title>
-         <description>
-            <p>The Contingency Planning Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000028" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800007" type="process-procedure">
-         <title>IA Policy</title>
-         <description>
-            <p>The Identificaiton and Authentication Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000029" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800008" type="process-procedure">
-         <title>IR Policy</title>
-         <description>
-            <p>The Incident Response Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000030" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800009" type="process-procedure">
-         <title>MA Policy</title>
-         <description>
-            <p>The Maintenance Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000031" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800010" type="process-procedure">
-         <title>MP Policy</title>
-         <description>
-            <p>The Media Protection Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-0010000000032" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800011" type="process-procedure">
-         <title>PE Policy</title>
-         <description>
-            <p>The Physical and Enviornmental Protection Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000033" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800012" type="process-procedure">
-         <title>PL Policy</title>
-         <description>
-            <p>The Planning Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000034" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800013" type="process-procedure">
-         <title>PM Policy</title>
-         <description>
-            <p>The Program Management Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000035" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800014" type="process-procedure">
-         <title>PS Policy</title>
-         <description>
-            <p>The Personnel Security Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000036" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800015" type="process-procedure">
-         <title>PT Policy</title>
-         <description>
-            <p>The PII Processing and Transparency Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000037" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800016" type="process-procedure">
-         <title>RA Policy</title>
-         <description>
-            <p>The Risk Assessment Procedure governs how access is managed and approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000038" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800017" type="process-procedure">
-         <title>SA Policy</title>
-         <description>
-            <p>The System and Services Acquisition Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000039" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800018" type="process-procedure">
-         <title>S3 Policy</title>
-         <description>
-            <p>The System and Communication Protection Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000040" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800019" type="process-procedure">
-         <title>SI Policy</title>
-         <description>
-            <p>The System and Information Integrity Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000041" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-      <component uuid="11111111-2222-4000-8000-009000800020" type="process-procedure">
-         <title>SR Policy</title>
-         <description>
-            <p>The Supply Chain Risk Management Procedure governs how access is managed and
-               approved.</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-001000000042" rel="procedure"/>
-         <status state="operational"/>
-      </component>
-
-
-      <!-- Other components -->
-      <component type="network" uuid="11111111-2222-4000-8000-009000000016">
-         <title>IPv4 Production Subnet</title>
-         <description>
-            <p>IPv4 Production Subnet.</p>
-         </description>
-         <!-- ip-address & is-scanned props apply to inventory-item (not component) -->
-         <!-- <prop name="ipv4-address" value="10.10.10.0/24"/> -->
-         <!-- <prop name="is-scanned" value="yes"/> -->
-         <status state="operational"/>
-      </component>
-      <component type="network" uuid="11111111-2222-4000-8000-009000000017">
-         <title>IPv4 Management Subnet</title>
-         <description>
-            <p>IPv4 Management Subnet.</p>
-         </description>
-         <!-- ip-address & is-scanned props apply to inventory-item (not component) -->
-         <!-- <prop name="ipv4-address" value="10.10.20.0/24"/> -->
-         <!-- is-scanned prop applies to inventory-item (not component) -->
-         <!-- <prop name="is-scanned" value="yes"/> -->
-         <status state="operational"/>
-      </component>
-      <component type="service" uuid="11111111-2222-4000-8000-009000500006">
-         <title>Email Service</title>
-         <description>
-            <p>Email Service</p>
-         </description>
-         <link href="#11111111-2222-4000-8000-009000500005" rel="used-by" />
-         <!-- is-scanned prop applies to inventory-item (not component) -->
-         <!-- <prop name="is-scanned" value="yes"/> -->
-         <status state="operational"/>
-         <protocol name="smtp">
-            <port-range start="23" end="23" transport="TCP" />
-            <port-range start="23" end="23" transport="UDP" />
-         </protocol>
-      </component>
-
-      <!-- Appendix M - Inventory -->
-      <inventory-item uuid="11111111-2222-4000-8000-011000000001">
-         <description>
-            <p>Legacy Example (No implemented-component).</p>
-         </description>
-         <!--<prop name="asset-id" value="unique-asset-ID-01"/>-->
-         <prop name="ipv4-address" value="10.1.1.1"/>
-         <prop name="ipv6-address" value="2001:db8:3333:4444:5555:6666:7777:8888"/>
-         <prop name="virtual" value="no"/>
-         <prop name="public" value="no"/>
-         <prop name="fqdn" value="dns.name"/>
-         <prop name="uri" value="uniform.resource.identifier"/>
-         <prop name="netbios-name" value="netbios-name"/>
-         <prop name="mac-address" value="00:00:00:00:00:00"/>
-         <prop name="software-name" value="software-name"/>
-         <prop name="asset-type" value="operating-system"/>
-         <!-- vendor-name, model, and patch-level are component level props -->
-         <!-- <prop name="vendor-name" value="Vendor Name"/> -->
-         <!-- <prop name="model" value="Model Number"/> -->
-         <!-- <prop name="patch-level" value="Patch-Level"/> -->
-         <prop name="serial-number" value="Serial #"/>
-         <prop name="asset-tag" value="Asset Tag"/>
-         <prop name="vlan-id" value="VLAN Identifier"/>
-         <prop name="network-id" value="Network Identifier"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <!-- <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="database"/>-->
-         <prop name="allows-authenticated-scan" value="no">
-            <remarks>
-               <p>If no, explain why. If yes, omit remarks field.</p>
-            </remarks>
-         </prop>
-         <prop name="baseline-configuration-name" value="Baseline Config. Name"/>
-         <prop name="physical-location" value="Physical location of Asset"/>
-         <prop name="is-scanned" value="yes">
-            <remarks>
-               <p>If no, explain why. If yes, omit remarks field.</p>
-            </remarks>
-         </prop>
-         <prop name="function" value="Required brief, text-based description.">
-            <remarks>
-               <p>Optional, longer, formatted description.</p>
-            </remarks>
-         </prop>
-         <link rel="validation" href="#11111111-2222-4000-8000-009000000002"/>
-         <responsible-party role-id="asset-owner">
-            <party-uuid>11111111-2222-4000-8000-004000000016</party-uuid>
-         </responsible-party>
-         <responsible-party role-id="asset-administrator">
-            <party-uuid>11111111-2222-4000-8000-004000000017</party-uuid>
-         </responsible-party>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007">
-            <remarks>
-               <p>This links to a FIPS 140-2 validated software component that is used by this
-                  inventory item. This type of linkage to a validation through the component is
-                  preferable to the link[rel='validation'] example above.</p>
-            </remarks>
-         </implemented-component>
-         <remarks>
-            <p>COMMENTS: Additional information about this item.</p>
-         </remarks>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000002">
-         <description>
-            <p>Component Inventory Example</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-02"/>
-         <prop name="ipv4-address" value="10.2.2.2"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a02:0202"/>
-         <prop name="mac-address" value="00:00:00:00:00:00"/>
-         <prop name="asset-type" value="appliance"/>
-         <!-- Need to update schematron validation. appliance is a valid core OSCAL asset type -->
-         <prop name="virtual" value="no"/>
-         <prop name="public" value="no"/>
-         <prop name="fqdn" value="dns.name"/>
-         <prop name="uri" value="uniform.resource.locator"/>
-         <prop name="netbios-name" value="netbios-name"/>
-         <!-- patch-level applies to component, not inventory-item -->
-         <!-- <prop name="patch-level" value="Patch-Level"/> -->
-         <prop name="baseline-configuration-name" value="Baseline Configuration Name"/>
-         <prop name="physical-location" value="Physical location of Asset"/>
-         <prop name="allows-authenticated-scan" value="no">
-            <remarks>
-               <p>If no, explain why. If yes, omit remark.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <responsible-party role-id="asset-owner">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         </responsible-party>
-         <responsible-party role-id="asset-administrator">
-            <party-uuid>11111111-2222-4000-8000-004000000017</party-uuid>
-         </responsible-party>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007">
-            <prop name="asset-id" value="unique-asset-ID-3"/>
-         </implemented-component>
-         <remarks>
-            <p>COMMENTS: If needed, provide additional information about this inventory item.</p>
-         </remarks>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000003">
-         <description>
-            <p>None.</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-03"/>
-         <prop name="asset-type" value="web-server"/>
-         <prop name="virtual" value="yes"/>
-         <prop name="public" value="no"/>
-         <prop name="ipv4-address" value="10.3.3.3"/>
-         <!-- Todo: check why schematron validation is indicating that this is not a valid ipv4 value -->
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a03:0303"/>
-         <prop name="is-scanned" value="yes"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000008"></implemented-component>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000004">
-         <description>
-            <p>None.</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-04"/>
-         <prop name="asset-type" value="appliance"/>
-         <prop name="virtual" value="yes"/>
-         <prop name="public" value="no"/>
-         <prop name="ipv4-address" value="10.4.4.4"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a04:0404"/>
-         <prop name="is-scanned" value="yes"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"></implemented-component>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000005">
-         <description>
-            <p>None.</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-05"/>
-         <prop name="asset-type" value="firewall"/>
-         <prop name="ipv4-address" value="10.5.5.5"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a05:0505"/>
-         <prop name="virtual" value="no"/>
-         <prop name="public" value="yes"/>
-         <prop name="is-scanned" value="yes"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000011"></implemented-component>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000006">
-         <description>
-            <p>None.</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-06"/>
-         <prop name="ipv4-address" value="10.6.6.6"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a06:0606"/>
-         <prop name="asset-type" value="router"/>
-         <prop name="virtual" value="no"/>
-         <prop name="public" value="no"/>
-         <prop name="is-scanned" value="no">
-            <remarks>
-               <p>Asset wasn't running at time of scan.</p>
-            </remarks>
-         </prop>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"></implemented-component>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000007">
-         <description>
-            <p>None.</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-07"/>
-         <prop name="asset-type" value="switch"/>
-         <prop name="ipv4-address" value="10.7.7.7"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a07:0707"/>
-         <prop name="virtual" value="no"/>
-         <prop name="public" value="no"/>
-         <prop name="is-scanned" value="yes"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000008"></implemented-component>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000008">
-         <description>
-            <p>None.</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-08"/>
-         <prop name="asset-type" value="web-server"/>
-         <prop name="ipv4-address" value="10.8.8.8"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a08:0808"/>
-         <prop name="virtual" value="yes"/>
-         <prop name="public" value="no"/>
-         <prop name="is-scanned" value="no">
-            <remarks>
-               <p>Asset wasn't running at time of scan.</p>
-            </remarks>
-         </prop>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000007"></implemented-component>
-      </inventory-item>
-      <inventory-item uuid="11111111-2222-4000-8000-011000000009">
-         <description>
-            <p>Email-Service</p>
-         </description>
-         <prop name="asset-id" value="unique-asset-ID-09"/>
-         <prop name="asset-type" value="email-server"/>
-         <prop name="ipv4-address" value="10.10.10.100"/>
-         <prop name="ipv6-address" value="0000:0000:0000:0000:0000:ffff:0a08:0808"/>
-         <prop name="virtual" value="yes"/>
-         <prop name="public" value="no"/>
-         <prop name="is-scanned" value="yes"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="scan-type" value="infrastructure"/>
-         <implemented-component component-uuid="11111111-2222-4000-8000-009000000018"></implemented-component>
-      </inventory-item>
-   </system-implementation>
-   <!-- Appendix A - FedRAMP Security Controls (in the rev 5 SSP template, control implementations go in appendix A) -->
-   <!-- 
-      NOTE: A FedRAMP SSP must implement all controls from the corresponding baseline.  This template is only 
-      a nominal example and does not pass FedRAMP schematron validations due to many controls being omitted.  
-      SSP authors must add implmentations for all required controls.
-   -->
-   <control-implementation>
-      <description>
-         <p>Appendix A - FedRAMP SSP Rev5 Template</p>
-         <p>This description field is required by OSCAL.</p>
-         <p>FedRAMP does not require any specific information here.</p>
-      </description>
-      <implemented-requirement control-id="ac-1" uuid="11111111-2222-4000-8000-012000000001">
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000005" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000023" rel="procedure"/>
-
-         <set-parameter param-id="ac-1_prm_1">
-            <value>organization-defined personnel or roles</value>
-         </set-parameter>
-         <set-parameter param-id="ac-01_odp.05">
-            <value>at least every 3 years</value>
-         </set-parameter>
-         <set-parameter param-id="ac-01_odp.07">
-            <value>at least annually</value>
-         </set-parameter>
-
-         <statement statement-id="ac-1_smt.a.1" uuid="11111111-2222-4000-8000-013000000001">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000001">
-               <description>
-                  <p>Describe how Part a is satisfied within the system.</p>
-                  <p>Legacy approach. If no policy component is defined, describe here how the
-                     policy satisfies part a.</p>
-                  <p>In this case, a link must be provided to the policy.</p>
-                  <p>FedRAMP prefers all policies and procedures be attached as a resource in the
-                     back-matter. The link points to a resource.</p>
-               </description>
-               <link href="#11111111-2222-4000-8000-001000000005" rel="policy"/>
-               <link href="#11111111-2222-4000-8000-001000000023" rel="procedure"/>
-               <implementation-status state="operational"/>
-               <remarks>
-                  <p>The specified component is the system itself.</p>
-                  <p>Any control implementation response that can not be associated with another
-                     component is associated with the component representing the system.</p>
-               </remarks>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000002">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Identity
-                     Management and Access Control Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-               <implementation-status state="operational"/>
-            </by-component>
-         </statement>
-         <statement statement-id="ac-1_smt.a.2" uuid="11111111-2222-4000-8000-013000000002">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000003">
-               <description>
-                  <p>There </p>
-               </description>
-               <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-               <implementation-status state="partial">
-                  <remarks>
-                     <p>Describe the plan to complete the implementation.</p>
-                  </remarks>
-               </implementation-status>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000004">
-               <description>
-                  <p>Describe how this policy currently satisfies part a.</p>
-               </description>
-               <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z">
-                  <remarks>
-                     <p>Describe the plan for addressing the missing policy elements.</p>
-                  </remarks>
-               </prop>
-               <implementation-status state="partial">
-                  <remarks>
-                     <p>Identify what is currently missing from this policy.</p>
-                  </remarks>
-               </implementation-status>
-            </by-component>
-         </statement>
-         <statement statement-id="ac-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000003">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000005">
-               <description>
-                  <p>Describe how Part b-1 is satisfied.</p>
-               </description>
-               <implementation-status state="operational"/>
-            </by-component>
-         </statement>
-         <statement statement-id="ac-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000004">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000006">
-               <description>
-                  <p>Describe how Part b-2 is satisfied.</p>
-               </description>
-               <implementation-status state="operational"/>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ac-2" uuid="11111111-2222-4000-8000-012000000002">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <!-- sample implementation-status below -->
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="customer-configured">
-            <remarks>
-               <p>Describe any customer-configured requirements for satisfying this control.</p>
-            </remarks>
-         </prop>
-         <responsible-role role-id="admin-unix">
-            <party-uuid>11111111-2222-4000-8000-004000000010</party-uuid>
-         </responsible-role>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ac-2_smt" uuid="11111111-2222-4000-8000-013000000005">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000007">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ac-2_prm_1">
-                  <value>[SAMPLE]privileged, non-privileged</value>
-               </set-parameter>
-               <set-parameter param-id="ac-2_prm_2">
-                  <value>[SAMPLE]all</value>
-               </set-parameter>
-               <set-parameter param-id="ac-2_prm_3">
-                  <value>[SAMPLE]The Access Control Procedure</value>
-               </set-parameter>
-               <set-parameter param-id="ac-2_prm_4">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ac-2_smt.a" uuid="11111111-2222-4000-8000-013000000006">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000008">
-               <description>
-                  <p>Describe how AC-2, part a is satisfied within this system.</p>
-                  <p>This points to the "This System" component, and is used any time a more
-                     specific component reference is not available.</p>
-               </description>
-               <export>
-                  <provided uuid="11111111-2222-4000-8000-015000000001">
-                     <description>
-                        <p>Leveraged system's statement of capabilities which may be inherited by a
-                           leveraging systems to satisfy AC-2, part a.</p>
-                     </description>
-                  </provided>
-                  <responsibility uuid="11111111-2222-4000-8000-016000000001" provided-uuid="11111111-2222-4000-8000-015000000001">
-                     <description>
-                        <p>Leveraged system's statement of a leveraging system's responsibilities in
-                           satisfaction of AC-2, part a.</p>
-                        <p>Not associated with inheritance, thus associated this with the
-                           by-component for "this system".</p>
-                     </description>
-                     <responsible-role role-id="cloud-service-provider">
-                        <party-uuid>11111111-2222-4000-8000-004000000001</party-uuid>
-                     </responsible-role>
-                  </responsibility>
-               </export>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000014" uuid="11111111-2222-4000-8000-014000000009">
-               <description>
-                  <p>For the portion of the control satisfied by the application component of this
-                     system, describe <strong>how</strong> the control is met.</p>
-               </description>
-               <export>
-                  <provided uuid="11111111-2222-4000-8000-015000000002">
-                     <description>
-                        <p>Consumer-appropriate description of what may be inherited from this
-                           application component by a leveraging system.</p>
-                        <p>In the context of the application component in satisfaction of AC-2, part
-                           a.</p>
-                     </description>
-                     <responsible-role role-id="customer">
-                        <party-uuid>11111111-2222-4000-8000-004000000005</party-uuid>
-                     </responsible-role>
-                  </provided>
-                  <responsibility uuid="11111111-0000-4000-9009-002001002002" provided-uuid="11111111-2222-4000-8000-015000000002">
-                     <description>
-                        <p>Leveraging system's responsibilities with respect to inheriting this
-                           capability from this application.</p>
-                        <p>In the context of the application component in satisfaction of AC-2, part
-                           a.</p>
-                     </description>
-                     <responsible-role role-id="customer">
-                        <party-uuid>11111111-2222-4000-8000-004000000005</party-uuid>
-                     </responsible-role>
-                  </responsibility>
-               </export>
-               <remarks>
-                  <p>The component-uuid above points to the "this system" component.</p>
-                  <p>Any control response content that does not cleanly fit another system component
-                     is placed here. This includes customer responsibility content.</p>
-                  <p>This can also be used to provide a summary, such as a holistic overview of how
-                     multiple components work together.</p>
-                  <p>While the "this system" component is not explicitly required within every
-                     <code>statement</code>, it will typically be present.</p>
-               </remarks>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000004" uuid="11111111-2222-4000-8000-014000000010">
-               <description>
-                  <p>For the portion inherited from an underlying FedRAMP-authorized provider,
-                     describe <strong>what</strong> is inherited.</p>
-               </description>
-               <inherited provided-uuid="11111111-0000-4000-9009-002001002001" uuid="11111111-2222-4000-8000-017000000001">
-                  <description>
-                     <p>Optional description.</p>
-                     <p>Consumer-appropriate description of what may be inherited as provided by the
-                        leveraged system.</p>
-                     <p>In the context of this component in satisfaction of AC-2, part a.</p>
-                     <p>The <code>provided-uuid</code> links this to the same statement in the
-                        leveraged system's SSP.</p>
-                     <p>It may be linked directly, but is more commonly provided via an OSCAL-based
-                        CRM (Inheritance and Responsibility Model).</p>
-                  </description>
-               </inherited>
-               <satisfied responsibility-uuid="11111111-0000-4000-9009-002001002002" uuid="11111111-2222-4000-8000-018000000001">
-                  <description>
-                     <p>Description of how the responsibility was satisfied.</p>
-                     <p>The <code>responsibility-uuid</code> links this to the same statement in the
-                        leveraged system's SSP.</p>
-                     <p>It may be linked directly, but is more commonly provided via an OSCAL-based
-                        CRM (Inheritance and Responsibility Model).</p>
-                     <p>Tools should use this to ensure all identified customer
-                        <code>responsibility</code> statements have a corresponding
-                        <code>satisfied</code> statement in the leveraging system's SSP.</p>
-                     <p>Tool developers should be mindful that </p>
-                  </description>
-               </satisfied>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="at-1" uuid="11111111-2222-4000-8000-012000000003">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000006" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000024" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="at-1_smt" uuid="11111111-2222-4000-8000-013000000007">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000011">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="at-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="at-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="at-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="at-1_smt.a" uuid="11111111-2222-4000-8000-013000000008">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000012">
-               <description>
-                  <p>Describe how Part a is satisfied.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000013">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000014">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="at-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000009">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000015">
-               <description>
-                  <p>Describe how Part b-1 is satisfied.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="at-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000010">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000016">
-               <description>
-                  <p>Describe how Part b-2 is satisfied.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="au-1" uuid="11111111-2222-4000-8000-012000000004">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000025" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="au-1_smt" uuid="11111111-2222-4000-8000-013000000011">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000017">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="au-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="au-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="au-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="au-1_smt.a" uuid="11111111-2222-4000-8000-013000000012">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000018">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-               <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000019">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000020">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="au-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000013">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000021">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-               <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
-            </by-component>
-         </statement>
-         <statement statement-id="au-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000014">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000022">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-               <link href="#11111111-2222-4000-8000-001000000007" rel="policy"/>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ca-1" uuid="11111111-2222-4000-8000-012000000005">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000008" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000026" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ca-1_smt" uuid="11111111-2222-4000-8000-013000000015">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000023">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ca-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="ca-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="ca-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ca-1_smt.a" uuid="11111111-2222-4000-8000-013000000016">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000024">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000025">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000026">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ca-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000017">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000027">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ca-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000018">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000028">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="cm-1" uuid="11111111-2222-4000-8000-012000000006">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000009" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000027" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="cm-1_smt" uuid="11111111-2222-4000-8000-013000000019">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000029">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="cm-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="cm-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="cm-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="cm-1_smt.a" uuid="11111111-2222-4000-8000-013000000020">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000030">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000031">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000032">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="cm-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000021">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000033">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="cm-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000022">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000034">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="cp-1" uuid="11111111-2222-4000-8000-012000000007">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="cp-1_smt" uuid="11111111-2222-4000-8000-013000000023">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000035">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="cp-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="cp-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="cp-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="cp-1_smt.a" uuid="11111111-2222-4000-8000-013000000024">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000036">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000037">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000038">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="cp-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000025">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000039">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="cp-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000026">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000040">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ia-1" uuid="11111111-2222-4000-8000-012000000008">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000011" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000029" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ia-1_smt" uuid="11111111-2222-4000-8000-013000000027">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000041">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ia-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="ia-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="ia-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ia-1_smt.a" uuid="11111111-2222-4000-8000-013000000028">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000042">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000043">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000044">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ia-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000029">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000045">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ia-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000030">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000046">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ir-1" uuid="11111111-2222-4000-8000-012000000009">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000011" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000030" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ir-1_smt" uuid="11111111-2222-4000-8000-013000000031">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000047">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ir-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="ir-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="ir-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ir-1_smt.a" uuid="11111111-2222-4000-8000-013000000032">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000048">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000049">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000050">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ir-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000033">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000051">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ir-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000034">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000052">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ma-1" uuid="11111111-2222-4000-8000-012000000010">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000013" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000031" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ma-1_smt" uuid="11111111-2222-4000-8000-013000000035">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000053">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ma-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="ma-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="ma-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ma-1_smt.a" uuid="11111111-2222-4000-8000-013000000036">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000054">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000055">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000056">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ma-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000037">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000057">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ma-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000038">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000058">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="mp-1" uuid="11111111-2222-4000-8000-012000000011">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000014" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000032" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="_smt" uuid="11111111-2222-4000-8000-013000000039">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000059">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="mp-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="mp-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="mp-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="mp-1_smt.a" uuid="11111111-2222-4000-8000-013000000040">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000060">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000061">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000062">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="mp-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000041">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000063">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="mp-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000042">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000064">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="pe-1" uuid="11111111-2222-4000-8000-012000000012">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000015" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000033" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="_smt" uuid="11111111-2222-4000-8000-013000000043">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000065">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="pe-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="pe-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="pe-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="pe-1_smt.a" uuid="11111111-2222-4000-8000-013000000044">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000066">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000067">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000068">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="pe-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000045">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000069">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="pe-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000046">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000070">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="pl-1" uuid="11111111-2222-4000-8000-012000000013">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#de28452-4b02-4b49-b316-59142a7633c1" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000034" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="pl-1_smt" uuid="11111111-2222-4000-8000-013000000047">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000071">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="pl-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="pl-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="pl-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="pl-1_smt.a" uuid="11111111-2222-4000-8000-013000000048">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000072">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000073">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000074">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="pl-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000049">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000075">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="pl-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000050">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000076">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ps-1" uuid="11111111-2222-4000-8000-012000000014">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000017" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000035" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ps-1_smt" uuid="11111111-2222-4000-8000-013000000051">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000077">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ps-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="ps-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="ps-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ps-1_smt.a" uuid="11111111-2222-4000-8000-013000000052">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000078">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000079">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000080">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ps-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000053">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000081">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ps-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000054">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000082">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="ra-1" uuid="11111111-2222-4000-8000-012000000015">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000018" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000036" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="ra-1_smt" uuid="11111111-2222-4000-8000-013000000055">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000083">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="ra-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="ra-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="ra-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="ra-1_smt.a" uuid="11111111-2222-4000-8000-013000000056">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000084">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000085">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000086">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ra-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000057">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000087">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="ra-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000058">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000088">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="sa-1" uuid="11111111-2222-4000-8000-012000000016">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000019" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000037" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="sa-1_smt" uuid="11111111-2222-4000-8000-013000000059">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000089">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="sa-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="sa-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="sa-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="sa-1_smt.a" uuid="11111111-2222-4000-8000-013000000060">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000090">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000091">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000092">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="sa-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000061">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000093">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="sa-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000062">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000094">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="sc-1" uuid="11111111-2222-4000-8000-012000000017">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000020" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000038" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="sc-1_smt" uuid="11111111-2222-4000-8000-013000000063">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000095">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="sc-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="sc-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="sc-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="sc-1_smt.a" uuid="11111111-2222-4000-8000-013000000064">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000096">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000097">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000098">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="sc-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000065">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000099">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="sc-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000066">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000100">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="si-1" uuid="11111111-2222-4000-8000-012000000018">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000021" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000039" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="si-1_smt" uuid="11111111-2222-4000-8000-013000000067">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000101">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="si-1_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="si-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="si-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="si-1_smt.a" uuid="11111111-2222-4000-8000-013000000068">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000102">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000103">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000104">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="si-1_smt.b.1" uuid="11111111-2222-4000-8000-013000000069">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000105">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-         <statement statement-id="si-1_smt.b.2" uuid="11111111-2222-4000-8000-013000000070">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000106">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="si-8" uuid="11111111-2222-4000-8000-012000000019">
-         <!--Spam Protection-->
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="implemented"/>
-         <!--There are no control parameters-->
-         <responsible-role role-id="asset-administrator">
-            <party-uuid>11111111-2222-4000-8000-004000000018</party-uuid>
-         </responsible-role>
-         <statement statement-id="si-8_smt" uuid="11111111-2222-4000-8000-013000000071">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000018" uuid="11111111-2222-4000-8000-014000000107">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-                  <p>DMARC is employed.</p>
-                  <p>SPF is employed.</p>
-                  <p>DKIM is employed.</p>
-               </description>
-               <set-parameter param-id="si-8_prm_1">
-                  <value>organization-defined personnel or roles</value>
-               </set-parameter>
-               <set-parameter param-id="si-8_prm_2">
-                  <value>[specify frequency]</value>
-               </set-parameter>
-               <set-parameter param-id="si-8_prm_3">
-                  <value>[specify frequency]</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-      <implemented-requirement control-id="sr-1" uuid="11111111-2222-4000-8000-012000000020">
-         <prop ns="https://fedramp.gov/ns/oscal" name="planned-completion-date" value="2024-01-31Z"/>
-         <prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="planned">
-            <remarks>
-               <p>Describe the plan to complete the implementation.</p>
-            </remarks>
-         </prop>
-         <prop ns="https://fedramp.gov/ns/oscal" name="control-origination" value="sp-system"/>
-         <link href="#11111111-2222-4000-8000-001000000022" rel="policy"/>
-         <link href="#11111111-2222-4000-8000-001000000040" rel="procedure"/>
-         <responsible-role role-id="information-system-security-officer">
-            <party-uuid>11111111-2222-4000-8000-004000000011</party-uuid>
-         </responsible-role>
-         <statement statement-id="sr-1_smt" uuid="11111111-2222-4000-8000-013000000072">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000108">
-               <description>
-                  <p>Describe how the control is satisfied within the system.</p>
-               </description>
-               <set-parameter param-id="sr-1_prm_1">
-                  <value>to include chief privacy and ISSO and/or similar role or designees</value>
-               </set-parameter>
-               <set-parameter param-id="sr-1_prm_2">
-                  <value>at least every 3 years</value>
-               </set-parameter>
-               <set-parameter param-id="sr-1_prm_3">
-                  <value>at least annually</value>
-               </set-parameter>
-            </by-component>
-         </statement>
-         <statement statement-id="sr-1_smt.a" uuid="11111111-2222-4000-8000-013000000073">
-            <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000109">
-               <description>
-                  <p>For the portion of the control satisfied by the service provider, describe
-                     <strong>how</strong> the control is met.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000012" uuid="11111111-2222-4000-8000-014000000110">
-               <description>
-                  <p>Describe how this policy component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the Policy.</p>
-                  <p>That component contains a link to the policy, so it does not have to be linked
-                     here too.</p>
-               </description>
-            </by-component>
-            <by-component component-uuid="11111111-2222-4000-8000-009000000013" uuid="11111111-2222-4000-8000-014000000111">
-               <description>
-                  <p>Describe how this procedure component satisfies part a.</p>
-                  <p>Component approach. This links to a component representing the procedure.</p>
-                  <p>That component contains a link to the procedure, so it does not have to be
-                     linked here too.</p>
-               </description>
-            </by-component>
-         </statement>
-      </implemented-requirement>
-   </control-implementation>
-   <!-- SSP Attachments -->
-   <back-matter>
-      <!-- Cloud Service Provider (CSP) Signatures -->
-      <resource uuid="11111111-2222-4000-8000-001000000002">
-         <title>Signed System Security Plan</title>
-         <description>
-            <p>SSP Signature</p>
-         </description>
-         <prop name="type" class="signed-ssp" value="artifact"/>
-         <!-- Use rlink and/or base64 -->
-         <rlink href="./attachments/signed-ssp.pdf" media-type="application/pdf"/>
-         <base64 filename="ssp.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>The FedRAMP PMO is formulating guidelines for handling digital/electronic signatures in
-               OSCAL, and welcome feedback on solutions.</p>
-            <p>For now, the PMO recommends one of the following:</p>
-            <ul>
-               <li>Render the OSCAL SSP content as a PDF that is digitally signed and attached.</li>
-               <li>Render the OSCAL SSP content as a printed page that is physically signed,
-                  scanned, and attached.</li>
-            </ul>
-            <p>If your organization prefers another approach, please seek prior approval from the
-               FedRAMP PMO.</p>
-         </remarks>
-      </resource>
-      <!-- FedRAMP Laws -->
-      <resource uuid="11111111-2222-4000-8000-001000000003">
-         <title>FedRAMP Applicable Laws and Regulations</title>
-         <prop name="type" class="fedramp-citations" value="citation"/>
-         <rlink href="https://www.fedramp.gov/assets/resources/templates/FedRAMP-Laws-Regulations-Standards-and-Guidance-Reference.xlsx"/>
-         <remarks>
-            <p>Must be present in a FedRAMP SSP.</p>
-         </remarks>
-      </resource>
-
-      <!-- Appendix C - Security Policy documents -->
-      <resource uuid="11111111-2222-4000-8000-001000000005">
-         <title>Access Control Policy Title</title>
-         <description>
-            <p>AC Policy document</p>
-         </description>
-         <prop name="type" value="policy"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_AC_policy.pdf"/>
-         <!-- Todo: Make base64 optional -->
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000006">
-         <title>Awareness and Training Policy Title</title>
-         <description>
-            <p>AT Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_AT_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000007">
-         <title>Audit and Accountability Policy Title</title>
-         <description>
-            <p>AU Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_AU_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000008">
-         <title>Security Assessment and Authorization Policy Title</title>
-         <description>
-            <p>CA Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_CA_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000009">
-         <title>Configuration Management Policy Title</title>
-         <description>
-            <p>CM Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_CM_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000010">
-         <title>Contingency Planning Policy Title</title>
-         <description>
-            <p>CP Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_CP_policy.pdf"/>
-         <!-- Todo: Make base64 optional -->
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000011">
-         <title>Identification and Authentication Policy Title</title>
-         <description>
-            <p>IA Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_IA_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000012">
-         <title>Incident Response Policy Title</title>
-         <description>
-            <p>IR Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_IR_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000013">
-         <title>Maintenance Policy Title</title>
-         <description>
-            <p>MA Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_MA_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000014">
-         <title>Media Protection Policy Title</title>
-         <description>
-            <p>MP Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_MP_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000015">
-         <title>Physical and Environmental Protection Policy Title</title>
-         <description>
-            <p>PE Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_PE_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000016">
-         <title>Planning Policy Title</title>
-         <description>
-            <p>PL Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_PL_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000017">
-         <title>Personnel Security Policy Title</title>
-         <description>
-            <p>PS Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_PS_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000018">
-         <title>Risk Adjustment Policy Title</title>
-         <description>
-            <p>RA Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_RA_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000019">
-         <title>System and Service Acquisition Policy Title</title>
-         <description>
-            <p>SA Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SA_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000020">
-         <title>System and Communications Protection Policy Title</title>
-         <description>
-            <p>SC Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SC_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000021">
-         <title>System and Information Integrity Policy Title</title>
-         <description>
-            <p>SI Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SI_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000022">
-         <title>Supply Chain Risk Policy Title</title>
-         <description>
-            <p>SR Policy document</p>
-         </description>
-         <prop name="type" value="policy" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SR_policy.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Policy Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix C - Security Prodedure documents -->
-      <resource uuid="11111111-2222-4000-8000-001000000023">
-         <title>Access Control Procedure Title</title>
-         <description>
-            <p>AC Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_AC_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000024">
-         <title>Awareness and Training Procedure Title</title>
-         <description>
-            <p>AT Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_AT_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000025">
-         <title>Audit and Accountability Procedure Title</title>
-         <description>
-            <p>AU Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_AU_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000026">
-         <title>Security Assessment and Authorization Procedure Title</title>
-         <description>
-            <p>CA Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_CA_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000027">
-         <title>Configuration Management Procedure Title</title>
-         <description>
-            <p>CM Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_CM_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000028">
-         <title>Contingency Planning Procedure Title</title>
-         <description>
-            <p>CP Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_CP_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000029">
-         <title>Identification and Authentication Procedure Title</title>
-         <description>
-            <p>IA Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_IA_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000030">
-         <title>Incident Response Procedure Title</title>
-         <description>
-            <p>IR Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_IR_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000031">
-         <title>Maintenance Procedure Title</title>
-         <description>
-            <p>MA Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_MA_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000032">
-         <title>Media Protection Procedure Title</title>
-         <description>
-            <p>MP Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_MP_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000033">
-         <title>Physical and Environmental Protection Procedure Title</title>
-         <description>
-            <p>PE Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_PE_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000034">
-         <title>Planning Procedure Title</title>
-         <description>
-            <p>PL Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink media-type="application/pdf" href="./attachments/policies/sample_PL_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000035">
-         <title>Personnel Security Procedure Title</title>
-         <description>
-            <p>PS Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_PS_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000036">
-         <title>Risk Adjustment Procedure Title</title>
-         <description>
-            <p>RA Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_RA_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000037">
-         <title>System and Service Acquisition Procedure Title</title>
-         <description>
-            <p>SA Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SA_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000038">
-         <title>System and Communications Protection Procedure Title</title>
-         <description>
-            <p>SC Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SC_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000039">
-         <title>System and Information Integrity Procedure Title</title>
-         <description>
-            <p>SI Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SI_procedure.pdf"/>
-         <base64 filename="sample_procedure.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000040">
-         <title>Supply Chain Risk Procedure Title</title>
-         <description>
-            <p>SR Procedure document</p>
-         </description>
-         <prop name="type" value="procedure" />
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/policies/sample_SR_procedure.pdf"/>
-         <base64 filename="sample_policy.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix D - User Guide -->
-      <resource uuid="11111111-2222-4000-8000-001000000041">
-         <title>User's Guide</title>
-         <description>
-            <p>User's Guide</p>
-         </description>
-         <prop name="type" value="users-guide"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <rlink href="./attachments/guides/sample_guide.pdf"/>
-         <!--<base64 media-type="application/pdf" filename="sample_guide.pdf">00000000</base64>-->
-         <remarks>
-            <p>Table 12-1 Attachments: User's Guide Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix E - Digital Identity Worksheet -->
-      <!-- Note - This is specifid by 3 properties (//system-security-plan/system-characteristics/prop[contains(@name,"-assurance-level")]) and does not be to attached separately -->
-      <!-- Appendix F - Rules of Behavior -->
-      <resource uuid="11111111-2222-4000-8000-001000000042">
-         <title>Document Title</title>
-         <description>
-            <p>Rules of Behavior</p>
-         </description>
-         <prop name="type" value="rules-of-behavior"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/rob.docx" media-type="application/msword"/>
-         <base64 filename="rob.docx" media-type="application/msword">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Rules of Behavior (ROB)</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix G - Information System Contingency Plan (ISCP) -->
-      <resource uuid="11111111-2222-4000-8000-001000000043">
-         <title>Document Title</title>
-         <description>
-            <p>Contingency Plan (CP)</p>
-         </description>
-         <prop name="type" value="plan" class="information-system-contingency-plan"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/cp.docx" media-type="application/msword"/>
-         <base64 filename="cp.docx" media-type="application/msword">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Contingency Plan (CP) Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix H - Configuration Management Plan -->
-      <resource uuid="11111111-2222-4000-8000-001000000044">
-         <title>Document Title</title>
-         <description>
-            <p>Configuration Management (CM) Plan</p>
-         </description>
-         <prop name="type" value="plan" class="configuration-management-plan"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/CM_Plan.docx" media-type="application/msword"/>
-         <base64 filename="CM_Plan.docx" media-type="application/msword">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Configuration Management (CM) Plan Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix I - Incident Response Plan (IRP) -->
-      <resource uuid="11111111-2222-4000-8000-001000000045">
-         <title>Document Title</title>
-         <description>
-            <p>Incident Response (IR) Plan</p>
-         </description>
-         <prop name="type" value="plan" class="incident-response-plan"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/IR_Plan.docx" media-type="application/msword"/>
-         <base64 filename="IR_Plan.docx" media-type="application/msword">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Incident Response (IR) Plan Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix J - CIS and CRM Workbook -->
-      <!-- Note - This can be generated from the content in the Security Controls section and no longer needs to be maintained separately or attached. -->
-      <!-- Appendix K - FIPS 199 Worksheet -->
-      <!-- Note - This is specified in the document (see //system-security-plan/system-characteristics[1]/system-information[1]/information-type) and no longer need to be maintained separately or attached -->
-      <!-- Appendix L - CSP-Specific Required Laws and Regulations -->
-      <resource uuid="11111111-2222-4000-8000-001000000046">
-         <title>CSP-specific Law Citation</title>
-         <prop name="type" value="law"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <document-id scheme="https://www.doi.org/">Identification Number</document-id>
-         <rlink href="https://example.com/path/to/document.pdf"/>
-         <base64 filename="document.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>A CSP-specific law citation</p>
-            <p>The "type" property must be present and contain the value "law".</p>
-         </remarks>
-         <!-- Todo: Fix Schematron. Make base64 optional -->
-      </resource>
-      <!-- Appendix M - Integrated Inventory Workbook -->
-      <!-- Note - This is specified in the document (see //system-security-plan/system-implementation[1]/inventory-item) and no longer need to be maintained separately or attached -->
-      <!-- Appendix N - Continuous Monitoring Plan -->
-      <resource uuid="11111111-2222-4000-8000-001000000047">
-         <title>Document Title</title>
-         <description>
-            <p>Continuous Monitoring Plan</p>
-         </description>
-         <prop name="type" value="plan" class="continuous-monitoring-plan"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/ConMon_Plan.docx" media-type="application/msword"/>
-         <base64 filename="ConMon_Plan.docx" media-type="application/msword">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Continuous Monitoring Plan Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix O - POA&M -->
-      <resource uuid="11111111-2222-4000-8000-001000000048">
-         <title>Plan of Actions and Milestones (POAM)</title>
-         <prop name="published" value="2023-05-31T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <prop name="type" value="plan" class="poam"/>
-         <rlink href="./attachments/POAMs/SAMPLE_POAM_20230531.xml" media-type="=application/xml"/>
-         <rlink href="./attachments/POAMs/SAMPLE_POAM_20230531.xlsx" media-type="application/vnd.ms-excel"/>
-         <base64 filename="SAMPLE_POAM_20230531.xml" media-type="application/xml">00000000</base64>
-         <!-- Todo: Fix Schematron. Make base64 optional -->
-      </resource>
-      <!-- Appendix P - Supply Chain Risk Management Plan (SCRMP) -->
-      <resource uuid="11111111-2222-4000-8000-001000000049">
-         <title>Supply Chain Risk Management Plan</title>
-         <description>
-            <p>Supply Chain Risk Management Plan</p>
-         </description>
-         <prop name="type" value="plan" class="supply-chain-risk-management-plan"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <rlink href="./attachments/plans/sample_SCRMP_procedure.pdf"/>
-         <base64 filename="sample_SCRMP.pdf" media-type="application/pdf">00000000</base64>
-         <remarks>
-            <p>Table 12-1 Attachments: Procedure Attachment</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-      <!-- Appendix Q - Cryptographic Modules Table -->
-      <!-- Note - This is specified in the document (see //*/component[@type="cryptographic-module"]) and doe not need to be maintained separately  or attached -->
-      <!-- Other SSP attachements / documents -->
-      <resource uuid="11111111-2222-4000-8000-001000000050">
-         <title>[SAMPLE]Interconnection Security Agreement Title</title>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <!-- document date -->
-         <prop name="version" value="Document Version"/>
-         <prop name="type" value="agreement" class="interconnection-security-agreement"/>
-         <rlink href="./attachments/ISAs/ISA-1.docx"/>
-         <!-- Todo: Make base64 optional -->
-         <base64 filename="ISA-1.docx" media-type="application/msword">00000000</base64>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000051">
-         <title>FedRAMP Logo</title>
-         <description>
-            <p>FedRAMP Logo</p>
-         </description>
-         <prop ns="https://fedramp.gov/ns/oscal" name="type" value="fedramp-logo"/>
-         <rlink href="https://www.fedramp.gov/assets/img/logo-main-fedramp.png"/>
-         <!-- Todo: Make base64 optional -->
-         <base64 filename="logo-main-fedramp.png" media-type="image/png">00000000</base64>
-         <remarks>
-            <p>Must be present in a FedRAMP SSP.</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000052">
-         <title>CSP Logo</title>
-         <description>
-            <p>CSP Logo</p>
-         </description>
-         <rlink href="./attachments/img/logo.png" media-type="image/png"/>
-         <base64 filename="logo.png" media-type="image/png">00000000</base64>
-         <remarks>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-            <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-            <p>Images must be in sufficient resolution to read all detail when rendered in a browser
-               via HTML5.</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000053">
-         <title>3PAO Logo</title>
-         <description>
-            <p>3PAO Logo</p>
-         </description>
-         <rlink href="./attachments/img/logo.png" media-type="image/png"/>
-         <base64 filename="logo.png" media-type="image/png">00000000</base64>
-         <remarks>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-            <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-            <p>Images must be in sufficient resolution to read all detail when rendered in a browser
-               via HTML5.</p>
-         </remarks>
-      </resource>
-      <!-- Section 8.1 - SSP Diagrams -->
-      <resource uuid="11111111-2222-4000-8000-001000000054">
-         <title>Boundary Diagram</title>
-         <description>
-            <p>The primary authorization boundary diagram.</p>
-         </description>
-         <prop name="type" value="image" class="authorization-boundary" />
-         <rlink href="./attachments/diagrams/boundary.png"/>
-         <base64 filename="logo.png" media-type="image/png">00000000</base64>
-         <remarks>
-            <p>Section 8.1, Figure 8-1 Authorization Boundary Diagram (graphic)</p>
-            <p>This should be referenced in the
-               system-characteristics/authorization-boundary/diagram/link/@href flag using a value
-               of "#11111111-2222-4000-8000-001000000054"</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-            <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-            <p>Images must be in sufficient resolution to read all detail when rendered in a browser
-               via HTML5.</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000055">
-         <title>Network Diagram</title>
-         <description>
-            <p>The primary network diagram.</p>
-         </description>
-         <prop name="type" value="image" class="network-architecture" />
-         <!-- Use rlink and/or base64 -->
-         <rlink href="./attachments/diagrams/network.png"/>
-         <base64 filename="network.png" media-type="image/png">00000000</base64>
-         <remarks>
-            <p>Section 8.1, Figure 8-2 Network Diagram (graphic)</p>
-            <p>This should be referenced in the
-               system-characteristics/network-architecture/diagram/link/@href flag using a value of
-               "#11111111-2222-4000-8000-001000000055"</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-            <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-            <p>Images must be in sufficient resolution to read all detail when rendered in a browser
-               via HTML5.</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000056">
-         <title>Data Flow Diagram</title>
-         <description>
-            <p>The primary data flow diagram.</p>
-         </description>
-         <prop name="type" value="image" class="data-flow" />
-         <rlink href="./attachments/diagrams/dataflow.png"/>
-         <base64 filename="dataflow.png" media-type="image/png">00000000</base64>
-         <remarks>
-            <p>Section 8.1, Figure 8-3 Data Flow Diagram (graphic)</p>
-            <p>This should be referenced in the system-characteristics/data-flow/diagram/link/@href
-               flag using a value of "#11111111-2222-4000-8000-001000000056"</p>
-            <p>May use <code>rlink</code> with a relative path, or embedded as
-               <code>base64</code>.
-            </p>
-            <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-            <p>Images must be in sufficient resolution to read all detail when rendered in a browser
-               via HTML5.</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000058">
-         <title>Interconneciton Security Agreement (ISA)</title>
-         <prop name="type" value="agreement" class="interconnection-security-agreement"/>
-         <prop name="published" value="2024-01-31T00:00:00Z" />
-         <prop name="version" value="2.1"/>
-         <rlink href="./attachments/isa.pdf" media-type="application/pdf" />
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000100001">
-         <title>41 CFR 201</title>
-         <prop name="type" class="law" value="citation"/>
-         <citation>
-            <text>
-               <q>Federal Acquisition Supply Chain Security Act; Rule,</q> 85 Federal Register 54263 (September 1, 2020), pp 54263-54271.</text>
-         </citation>
-         <rlink href="https://www.federalregister.gov/d/2020-18939"/>
-         <remarks>
-            <p>CSP-specific citation. Note the "type" property's class is "law"
-               and the value is "citation".</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000100002">
-         <title>CSP Acronyms</title>
-         <prop name="type" class="acronyms" value="citation"/>
-         <rlink href="./attachments/acronyms.pdf"/>
-         <remarks>
-            <p>CSP-specific citation. Note the "type" property's class is "acronyms"
-               and the value is "citation".</p>
-         </remarks>
-      </resource>
-      <resource uuid="11111111-2222-4000-8000-001000000004">
-         <title>CSP Reference</title>
-         <prop name="type" class="reference" value="citation"/>
-         <rlink href="./attachments/reference.pdf"/>
-         <remarks>
-            <p>CSP-specific reference. Note the "type" property's class is "reference"
-               and the value is "citation".</p>
-         </remarks>
-      </resource>
-      <resource uuid="49fb4631-1da2-41ca-b0b3-e1b1006d4025">
-         <title>Separation of Duties Matrix</title>
-         <description>
-            <p>Separation of Duties Matrix</p>
-         </description>
-         <prop ns="https://fedramp.gov/ns/oscal" name="type" value="separation-of-duties-matrix"/>
-         <prop name="published" value="2023-01-01T00:00:00Z"/>
-         <prop name="version" value="Document Version"/>
-         <rlink href="./documents/Sep_Matrix.docx" media-type="application/msword"/>
-         <base64 filename="Sep_Matrix.docx" media-type="application/msword">00000000</base64>
-         <remarks>
-            <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.
-            </p>
-         </remarks>
-      </resource>
-
-
-
-   </back-matter>
-</system-security-plan>
\ No newline at end of file
diff --git a/src/validations/constraints/unit-tests/missing-response-components-PASS.yaml b/src/validations/constraints/unit-tests/missing-response-components-PASS.yaml
index cd6831c3e..271327849 100644
--- a/src/validations/constraints/unit-tests/missing-response-components-PASS.yaml
+++ b/src/validations/constraints/unit-tests/missing-response-components-PASS.yaml
@@ -3,7 +3,7 @@ test-case:
   description: >-
     This test case validates the behavior of constraint
     missing-response-components
-  content: ../content/fedramp-ssp-example.xml
+  content: ../content/fedramp-ssp-example.oscal.xml
   expectations:
     - constraint-id: missing-response-components
       result: pass