Custom grouping of merged controls not implemented

[michaeldavie-amzn]

The profile model allows a custom control grouping to be specified as part of a merge directive:

https://pages.nist.gov/OSCAL-Reference/models/v1.1.3/profile/json-reference/#/profile/merge/custom

However, attempting to use this generates an error as the functionality has not been implemented:

liboscal-java/src/main/java/gov/nist/secauto/oscal/lib/profile/resolver/ProfileResolver.java

Line 518 in a7ee006

throw new UnsupportedOperationException("custom structuring");

[aj-stein]

Hi @michaeldavie-amzn thanks for reporting the issue. I will need to refamiliarize myself with the current OSCAL profile spec, but is such a merge support required functionality? I'll look into that.

[michaeldavie-amzn]

I'm not sure if it's required by the spec, but let me provide some more background on what I'm trying to do.

The Canadian Centre for Cyber Security (CCCS) publishes a control catalogue that is based on NIST 800-53. CCCS makes modifications to the 800-53 catalogue, including adding new controls and enhancements.

In my CCCS OSCAL project, I'm capturing the new controls in a standalone catalog. I'm then making more surgical modifications in a profile that imports from both the 800-53 and CCCS catalogs. It is in this profile that I believe I need to implement a custom ordering, as I need to interleave the new controls into groups and controls that are already present in 800-53.