OSCAL source · CSS
{
"artifactId": "CSS",
"iso": [
"A.5.23",
"A.5.19",
"A.5.22",
"A.8.9",
"A.8.15",
"A.8.16"
],
"catalog": [
{
"iso": "A.5.23",
"oscalId": "iso27001-a.5.23",
"title": "Information security for use of cloud services",
"className": "iso27001-annex-a",
"group": "Organizational controls (Annex A.5)"
},
{
"iso": "A.5.19",
"oscalId": "iso27001-a.5.19",
"title": "Information security in supplier relationships",
"className": "iso27001-annex-a",
"group": "Organizational controls (Annex A.5)"
},
{
"iso": "A.5.22",
"oscalId": "iso27001-a.5.22",
"title": "Monitoring, review and change management of supplier services",
"className": "iso27001-annex-a",
"group": "Organizational controls (Annex A.5)"
},
{
"iso": "A.8.9",
"oscalId": "iso27001-a.8.9",
"title": "Configuration management",
"className": "iso27001-annex-a",
"group": "Technological controls (Annex A.8)"
},
{
"iso": "A.8.15",
"oscalId": "iso27001-a.8.15",
"title": "Logging",
"className": "iso27001-annex-a",
"group": "Technological controls (Annex A.8)"
},
{
"iso": "A.8.16",
"oscalId": "iso27001-a.8.16",
"title": "Monitoring activities",
"className": "iso27001-annex-a",
"group": "Technological controls (Annex A.8)"
}
],
"profileAlters": [
{
"control-id": "iso27001-a.5.19",
"adds": [
{
"props": [
{
"name": "applicability",
"value": "applicable"
},
{
"name": "applicability-justification",
"value": "Required for cloud and SaaS supplier dependencies."
},
{
"name": "implementation-status",
"value": "In progress"
}
]
}
]
},
{
"control-id": "iso27001-a.5.22",
"adds": [
{
"props": [
{
"name": "applicability",
"value": "applicable"
},
{
"name": "applicability-justification",
"value": "Required for supplier performance and changes."
},
{
"name": "implementation-status",
"value": "In progress"
}
]
}
]
},
{
"control-id": "iso27001-a.5.23",
"adds": [
{
"props": [
{
"name": "applicability",
"value": "applicable"
},
{
"name": "applicability-justification",
"value": "Required because core services are cloud and SaaS based."
},
{
"name": "implementation-status",
"value": "In progress"
}
]
}
]
},
{
"control-id": "iso27001-a.8.9",
"adds": [
{
"props": [
{
"name": "applicability",
"value": "applicable"
},
{
"name": "applicability-justification",
"value": "Required for identity, cloud, endpoint and application configuration."
},
{
"name": "implementation-status",
"value": "In progress"
}
]
}
]
},
{
"control-id": "iso27001-a.8.15",
"adds": [
{
"props": [
{
"name": "applicability",
"value": "applicable"
},
{
"name": "applicability-justification",
"value": "Required for security monitoring and investigation."
},
{
"name": "implementation-status",
"value": "Implemented"
}
]
}
]
},
{
"control-id": "iso27001-a.8.16",
"adds": [
{
"props": [
{
"name": "applicability",
"value": "applicable"
},
{
"name": "applicability-justification",
"value": "Required for detecting security events."
},
{
"name": "implementation-status",
"value": "In progress"
}
]
}
]
}
],
"components": [
{
"uuid": "85dce7e0-2be5-5126-8f1e-4695ad5124e3",
"type": "policy",
"title": "Arcfield Cloud Security Statement (SIMULATION)",
"purpose": "Explain cloud security controls, responsibilities, evidence and assurance boundaries.",
"props": [
{
"name": "simulation",
"value": "true"
},
{
"name": "artifact-id",
"value": "CSS"
},
{
"name": "object-type",
"value": "policy"
},
{
"name": "comparison",
"value": "a"
},
{
"name": "pack-role",
"value": "in-pack"
},
{
"name": "implemented-requirement-count",
"value": "6"
},
{
"name": "volumes",
"value": "2"
},
{
"name": "unresolved-cites",
"value": "SINV"
}
]
}
],
"sspImplementedRequirements": [
{
"control-id": "iso27001-a.5.19",
"props": [
{
"name": "iso-id",
"value": "A.5.19"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "In progress"
},
{
"name": "control-owner",
"value": "Supplier Manager"
},
{
"name": "evidence-status",
"value": "Partial"
},
{
"name": "unresolved-evidence",
"value": "SINV"
}
],
"links": [
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
},
{
"rel": "cites",
"text": "CSS"
},
{
"rel": "cites",
"text": "MDR"
},
{
"rel": "cites",
"text": "DR"
},
{
"rel": "cites",
"text": "RRS"
},
{
"rel": "cites",
"text": "AI"
},
{
"rel": "cites",
"text": "UAI"
}
]
},
{
"control-id": "iso27001-a.5.20",
"props": [
{
"name": "iso-id",
"value": "A.5.20"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "In progress"
},
{
"name": "control-owner",
"value": "Supplier Manager"
},
{
"name": "evidence-status",
"value": "Partial"
}
],
"links": [
{
"rel": "field-ref",
"text": "CSS"
},
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
}
]
},
{
"control-id": "iso27001-a.5.22",
"props": [
{
"name": "iso-id",
"value": "A.5.22"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "In progress"
},
{
"name": "control-owner",
"value": "Supplier Manager"
},
{
"name": "evidence-status",
"value": "Partial"
},
{
"name": "unresolved-evidence",
"value": "SINV"
}
],
"links": [
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
},
{
"rel": "cites",
"text": "CSS"
},
{
"rel": "cites",
"text": "MDR"
},
{
"rel": "cites",
"text": "DR"
},
{
"rel": "cites",
"text": "RRS"
},
{
"rel": "cites",
"text": "AI"
},
{
"rel": "cites",
"text": "UAI"
}
]
},
{
"control-id": "iso27001-a.5.23",
"props": [
{
"name": "iso-id",
"value": "A.5.23"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "In progress"
},
{
"name": "control-owner",
"value": "Cloud Service Owner"
},
{
"name": "evidence-status",
"value": "Partial"
},
{
"name": "unresolved-evidence",
"value": "CLOUD-CTRL-2026-Q3"
}
],
"links": [
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
},
{
"rel": "cites",
"text": "CSS"
},
{
"rel": "cites",
"text": "MDR"
},
{
"rel": "cites",
"text": "DR"
},
{
"rel": "cites",
"text": "RRS"
},
{
"rel": "cites",
"text": "AI"
},
{
"rel": "cites",
"text": "UAI"
}
]
},
{
"control-id": "iso27001-a.8.9",
"props": [
{
"name": "iso-id",
"value": "A.8.9"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "In progress"
},
{
"name": "control-owner",
"value": "IT Operations"
},
{
"name": "evidence-status",
"value": "Partial"
},
{
"name": "unresolved-evidence",
"value": "CFG-BASE-2026"
}
],
"links": [
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
},
{
"rel": "cites",
"text": "CSS"
},
{
"rel": "cites",
"text": "MDR"
},
{
"rel": "cites",
"text": "DR"
},
{
"rel": "cites",
"text": "RRS"
},
{
"rel": "cites",
"text": "AI"
},
{
"rel": "cites",
"text": "UAI"
}
]
},
{
"control-id": "iso27001-a.8.15",
"props": [
{
"name": "iso-id",
"value": "A.8.15"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "Implemented"
},
{
"name": "control-owner",
"value": "Security Lead"
},
{
"name": "evidence-status",
"value": "Partial"
},
{
"name": "unresolved-evidence",
"value": "LOG-2026-Q3"
}
],
"links": [
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
},
{
"rel": "cites",
"text": "CSS"
},
{
"rel": "cites",
"text": "MDR"
},
{
"rel": "cites",
"text": "DR"
},
{
"rel": "cites",
"text": "RRS"
},
{
"rel": "cites",
"text": "AI"
},
{
"rel": "cites",
"text": "UAI"
}
]
},
{
"control-id": "iso27001-a.8.16",
"props": [
{
"name": "iso-id",
"value": "A.8.16"
},
{
"name": "applicability",
"value": "applicable"
},
{
"name": "evidence-layer",
"value": "linked"
},
{
"name": "implementation-status-raw",
"value": "In progress"
},
{
"name": "control-owner",
"value": "Security Lead"
},
{
"name": "evidence-status",
"value": "Partial"
},
{
"name": "unresolved-evidence",
"value": "MON-2026-Q3"
}
],
"links": [
{
"rel": "cites",
"text": "SOA"
},
{
"rel": "cites",
"text": "ISOCTRL"
},
{
"rel": "cites",
"text": "CSS"
},
{
"rel": "cites",
"text": "MDR"
},
{
"rel": "cites",
"text": "DR"
},
{
"rel": "cites",
"text": "RRS"
},
{
"rel": "cites",
"text": "AI"
},
{
"rel": "cites",
"text": "UAI"
}
]
}
]
}
Close
