Documents

(Since: coming in 0.5.0 release)

Complete documents are assembled from Pages, Reports and generators. Document contents are specified in the config file; for example:

datadir: ./opencontrols
docdir: ./pages
documents:
  SSP:
    title: "System Security Plan"
    contents:
      - page: ssp-intro.md
      - page: system-description.md
      - page: designated-contacts.md
      - title: Security Controls
        generate: controls
      - title: System Components
        generate: components
      - title: Conclusion and action items
        page: ssp-conclusion.md
      - title: Appendix - Compliance Report
        report: completion
          params:
            profile: FedRAMP-low

Then at the command-line, run

ssptool document SSP > SSP.html

Output is a single ginormous HTML file.

Multiple documents may be defined. For example you might want to generate tailored System Security Plans for different audiences, administrator or employee handbooks, etc.

Sections

Each section has title, an optional page containing introductory text, and a recursive list of contents.

Various generators are available, which can produce the list of subsections and/or page body.

Default (generate: section)

• Specify page: pageid.md in the config file
• title: is taken from page metadata if not specified

Reports (generate: report)

This is the default generator if report: is listed. Additional properties:

• report: reportid
• params: dictionary of report query parameters

Security Controls (generate: controls)

Generates a subsection for each satisfied control, grouped by control family.

System Components (generate: components)

• Generates a subsection for each component found.