Open Security Controls Assessment Language OSCAL

The Open Security Controls Assessment Language (OSCAL) is a standardized, flexible, open-source language that allows security controls and their associated implementations and assessment methods to be represented in machine-readable formats and easy transformation to human-friendly representations. OSCAL is important because it provides a standards-based foundation for the next generation of compliance processes and tools and allows for better security automation and interoperability for all types of systems. OSCAL benefits both organizations and security professionals, helping to improve risk management posture, consistency, interoperability, and reduces manual effort. We have a lot of exciting things in the works...so please visit our website at www.nist.gov/OSCAL for more information.

Traditional compliance documentation is often stored in spreadsheets, PDFs, or Word documents, making automation difficult.

OSCAL was created to:

• Reduce manual data entry
• Improve interoperability between security tools
• Enable automated validation
• Standardize continuous monitoring
• Improve consistency across organizations

OSCAl is useful for:

• Federal agencies
• Government contractors
• Security assessors
• Compliance professionals
• Developers
• Tool vendors
• Researchers
• Organizations implementing cybersecurity frameworks

If you're new to OSCAl, the best place to start is the official OSCAL project website. It providers an overview of the project, explains the purpose of OSCAL, and links to documentation, tutorials, source code, models, and examples.

Official resources:

• OSCAL homepage
• GitHub repository
• OSCAL Documentation
• Tutorials
• OSCAL White Paper

No. Although OSCAL was developed by NIST and is heavily used within the U.S. federal government, it is an open standard that any organization can adopt. Private companies, universities, nonprofits, and international organizations can also use OSCAL to standardize security and compliance information.

The OSCAL project is maintained as an open-source project on GitHub by NIST. The GitHub repository contains:

• OSCAL source code
• Documentation
• JSON, XML, and YAML schemas
• Model definitions
• Issue tracker
• Release history
• Development roadmap

Developers can browse source code, report issues, suggest enhancements, and contribute improvements through GitHub.

Yes. NIST maintains a separate repository called OSCAL-Content, which contains official OSCAL representations of many NIST publications and security guidance.

Examples include:

• NIST SP 800-53 security control catalogs
• NIST SP 800-171
• FedRAMP baselines
• Control profiles
• Assessment content
• Sample System Security Plans
• Other reusable OSCAL artifacts

These files help organizations adopt OSCAL without creating documents from scratch. The OSCAL Content repository is the primary location for reusable OSCAL resources

NIST has developed an automated content production process for generating and maintaining OSCAL content from authoritative security guidance. One of the primary tools supporting this process is Capordino, which helps transform source publications into structured OSCAL content while maintaining consistency and reducing manual effort.

This workflow helps ensure that:

• OSCAL content stays synchronized with official publications.
• Updates are easier to manage.
• Human error is minimized.
• Multiple output formats can be generated consistently.

For more information, see the Capordino project documentation.

Yes. NIST has published several papers describing OSCAL, its design goals, and its applications.

Some notable publications include:

• NIST CSWP 53 - Charting the Course for NIST OSCAL
• NIST IR 8500A - BloSS@M (Blockchain-Based Secure Software Asset Management)

These publications discuss:

• Why OSCAL was developed
• How machine-readable security documentation improves automation
• Use cases across compliance and risk management
• Future directions for security automation

There resources are useful for researchers, developers, and organizations adopting OSCAL

Yes. NIST provides tutorials that introduce OSCAL concepts and demonstrate how to work with OSCAL documents.

Topics include:

• OSCAL fundamentals
• Understanding OSCAL models
• Creating OSCAL documents
• Validating OSCAL files
• Working with catalogs and profiles
• Building System Security Plans
• Assessment workflows

The tutorials are suitable for beginners as well as users looking to implement OSCAL within existing security processes.

OSCAL supports three formats: XML, JSON, YAML. Each format represents the same underlying OSCAL models, allowing users to choose the format that best fits their tools and workflows.

Yes! Community members can contribute by:

• Reporting bugs
• Suggesting new features
• Improving documentation
• Submitting pull requests
• Participating in discussions on GitHub 
• Presenting their work with OSCAL at Monthly Adopters' Workshops

Contribution guidelines are available in the project's GitHub repository.

NIST team is not maintaining any repository of Component Definitions, nor does the team knows of the existence of such repository for public consumption available today. NIST team is aware of different OSCAL community entities interested in creating and maintaining such community-managed repositories. NIST will provide pointers to such repositories as soon as reliable information is available.

The OSCAL Assessment Results model is composed of (among other things): observations, risks, and findings. Observations can contain human or machine-generated evidence of compliance or non-compliance.

OSCAL is on the "higher level of abstraction" side, allowing for implementors to collect evidence from a wide variety of tools and processes without prescribing a specific tool output.

For a really simple example of an automated workflow generating Assessment Results documents based off of tool output (in this case, a Python test), check out this case study that our team recently presented on.

The OSCAL Content repository includes numerous examples, sample system security plans, catalogs profiles, assessment plans, and other artifacts that can be used as templates or references.