U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Open Security Controls Assessment Language OSCAL

Overview

NIST, in collaboration with the industry, is developing the Open Security Controls Assessment Language (OSCAL), a set of hierarchical, formatted, XML- JSON- and YAML-based formats that provide a standardized representation for different categories of security information pertaining to the publication, implementation, and assessment of security controls.

The OSCAL website provides an overview of the OSCAL project, including tutorials, concepts, references, downloads, and much more.

OSCAL is organized in a series of layers that each provides a set of models

A model represents an information structure supporting a specific operational purpose or concept.

Each model is comprised of information structures that form an information model for each OSCAL model. This information model is then bound to multiple serialization formats (i.e., XML, JSON, YAML), which represent a concrete data model. Thus, a data model that defines how to represent an OSCAL information model in a serialized format. While the syntax of each format differs, all formats for a given model represent the same set of information or information model. In this way, OSCAL content expressed in one of the supported formats ( XML, JSON, or YAML) can be translated into any of the other supported formats without data loss.

The OSCAL layers and models are:

The release state of each model, along with download links for the latest versions of XML and JSON schema for each model are provided in the table, below. YAML is also supported through conversion between JSON and YAML. Since YAML is a superset of JSON, some YAML tooling allows JSON schema to be used for YAML validation. In this way, the provided JSON schema supports both JSON and YAML.

Layer Model Current State Reference Schemas
Control Catalog Released XML, JSON, YAML XMLJSON/YAML
Control Profile Released XML, JSON, YAML XMLJSON/YAML
Implementation Component Definition Released XML, JSON, YAML XMLJSON/YAML
Implementation System Security Plan Released XML, JSON, YAML XMLJSON/YAML
Assessment Assessment Plan Released XML, JSON, YAML XMLJSON/YAML
Assessment Assessment Results Released XML, JSON, YAML XMLJSON/YAML
Assessment Plan of Action and Milestones Released XML, JSON, YAML XMLJSON/YAML

The OSCAL GitHub repository holds the actual OSCAL schemas, examples, documentation source files, and other resources. The NIST team welcomes public contributions to this project. If you are interested in contributing, please review the contributor documentation for ideas and information on how to get started.

NIST also maintains several public GitHub repositories associated with the OSCAL project:

OSCAL content maintained by NIST:

https://github.com/usnistgov/oscal-content

OSCAL tools and libraries:

https://github.com/usnistgov/liboscal-java

https://github.com/usnistgov/oscal-deep-diff

OSCAL Metaschema:

https://github.com/usnistgov/metaschema

NIST team welcomes public contributions to this project. If you are interested in contributing, please review the contributor documentation for ideas and information on how to get started.


Additional News:

OSCAL Mini Workshop Series

The NIST OSCAL team is hosting a new series of monthly mini workshops that aims to address topics of interest for our community and to open this forum for its members to present their OSCAL-related work. Unless specifically stated, the workshops will not require a deep, technical understanding of OSCAL, and the dialog is informal, allowing the community to interact with the presenters and with the OSCAL team members.

Call for Proposals

NIST OSCAL Mini Workshop program committee is seeking timely, topical, and thought-provoking technical presentations or demonstrations highlighting OSCAL editorial tools, OSCAL-based security assessment automation processes, and Governance Risk and Compliance (GRC) tools supporting OSCAL formats for integration into such processes.

NIST does not endorse any of the OSCAL tools or services presented. Presentations or demos promoting such tools or services, as opposed to focusing on the OSCAL-related technical aspects, will not be permitted.

We encourage proposals from a diverse array of organizations and individuals with different perspectives, from the public and private sectors, international bodies, assessment and authorization (A&A), or certification and authorization (C&A) providers.

Please find below the calendar of proposed dates. Before submitting a proposal, please consult the calendar and indicate the preferred date with your submission and the duration of your presentation (30 min or 60 min, including Q&A). We will do our best to update the calendar as soon as a submission is approved.

Submit your proposal via email to oscal@nist.gov, with the subject line: “OSCAL Workshop - [Date: yyyy/mm/dd]”, where the “Date” is the selected date from the calendar below. Please include in your submission a pre-assessment of the OSCAL knowledge level the audience will need using a 4-levels scale with level one (L1/bronze) being equivalent to novice and level four (L4/platinum) being an OSCAL expert.

Join the events:

Meeting URL:

https://bluejeans.com/743906781/9254

Meeting ID: 743 906 781

Participant Passcode: 9254

Phone: +1.202.795.3352 (United States (Washington DC))

(see all numbers - https://www.bluejeans.com/numbers)

Presentations:

- 05/18/2022:

  • Compliance as Code for Big Bang Risk Management Framework (RMF) Control Mapping to Accelerate Department of Defense (DoD) Authorization to Operate (ATO)
    • Maj Camdon Cady, Chief Operating Officer, Platform One, US Airforce
    • Tom Runyon, Defense Unicorns
  • OSCAL Catalog Authoring Tool (CAT)
    • Dmitry Cousin, NIST

- 06/15/2022:

- 07/13/2022:

- 08/10/2022:

  • Extreme Automation with OSCAL - Exercising the Full OSCAL Stack in a Next Generation GRC
    • Travis Howerton, Co-Founder and CTO, RegScale

- 09/07/2022:

  • NIST Open Source OSCAL Tooling
    • Java lib: David Waltermire, OSCAL Technical Director, NIST
    • OSCAL CAT: Dmitry Cousin, OSCAL team member
    • OSCAL Deep Diff: Nikita Wootten, OSCAL team member

- 10/05/2022:

  • Compliance as Code - from upstream to ops 
    • Brandt Keller, Software Engineer, Defense Unicorns

- 11/02/2022:

  • Implementing a Security Assessment Framework (SAF) with OSCAL
    • Robert Ficcaglia, CNCF Kubernetes Policy Co-Chair, CNCF Security Technical Advisory Group Lead Assessor, Kubernetes SIG-Security Audit Team.
Created April 24, 2018, Updated August 08, 2022