Add POAM date-time status tracking constraints

[aj-stein-gsa]

Constraint Task

Add constraints with the following props for /plan-of-actions-and-milestones/poam-item to match usnistgov/OSCAL#2117, but prepare these to specifically use the FedRAMP namespace (@ns='http://fedramp.gov/ns/oscal').

1. A poam-item MUST have a prop[@ns='http://fedramp.gov/ns/oscal' and @name='status-date'] and it must have a date-time-timezone
2. A poam-item MUST have a prop[@ns='http://fedramp.gov/ns/oscal' and @name='scheduled-completion-date'] and it must have a date-time-timezone
3. A poam-item MUST have 1 prop[@ns='http://fedramp.gov/ns/oscal' and @name='has-vendor-dependency'] with a value of "yes" or "no", using an associated allowed-values enumeration.
4. A poam-item MUST have prop[@ns='http://fedramp.gov/ns/oscal' and @name='vendor-checkin-date'] IFF there exists a prop[@ns='http://fedramp.gov/ns/oscal' and @name='has-vendor-dependency']/@value='yes'

Intended Outcome

Itemize required and optional poam-item metadata required for each item as confirmed by analyzing current usage of pre-OSCAL POA&M spreadsheets maintained by CSPs, 3PAOs, and agencies today.

Syntax Type

This is a FedRAMP constraint in the FedRAMP-specific namespace.

Allowed Values

FedRAMP allowed values must be defined or verified.

Metapath(s) to Content

See the related upstream OSCAL pull request for these details.

Purpose of the OSCAL Content

No response

Dependencies

No response

Acceptance Criteria

• All OSCAL adoption content affected by the change in this issue have been updated in accordance with the Documentation Standards.
  • Explanation is present and accurate
  • sample content is present and accurate
  • Metapath is present, accurate, and does not throw a syntax exception using oscal-cli metaschema metapath eval -e "expression".
• All constraints associated with the review task have been created
• The appropriate example OSCAL file is updated with content that demonstrates the FedRAMP-compliant OSCAL presentation.
• The constraint conforms to the FedRAMP Constraint Style Guide.
  • All automated and manual review items that identify non-conformance are addressed; or technical leads (David Waltermire; AJ Stein) have approved the PR and “override” the style guide requirement.
• Known good test content is created for unit testing.
• Known bad test content is created for unit testing.
• Unit testing is configured to run both known good and known bad test content examples.
• Passing and failing unit tests, and corresponding test vectors in the form of known valid and invalid OSCAL test files, are created or updated for each constraint.
• A Pull Request (PR) is submitted that fully addresses the goals section of the User Story in the issue.
• This issue is referenced in the PR.

Other information

If you pick up this issue, you will notice it shadows upstream changes in the core namespace. The intent of this PR will be to hold in a feature branch with the potential outcome of that PR being NIST declines the change and will not want it in the core namespace, thereby forcing NIST to not make it shareable and reusable for the larger community.