Open Security Controls Assessment Language OSCAL

OSCAL Models

OSCAL is organized in a series of layers that each provides a set of models. 

A model represents an information structure supporting a specific operational purpose or concept.

Each model is comprised of information structures that form an information model for each OSCAL model. This information model is then bound to multiple serialization formats (i.e., XML, JSON, YAML), which represent a concrete data model. Thus, a data model defines how to represent an OSCAL information model in a serialized format. While the syntax of each format differs, all formats for a given model represent the same set of information or information model. In this way, OSCAL content expressed in one of the supported formats ( XML, JSON, or YAML) can be translated into any of the other supported formats without data loss.

The OSCAL layers and models are:

• Control Layer
  • Catalog model 
  • Profile model
  • Control Mapping model
• Implementation Layer
  • Component Definition model 
  • System Security Plan (SSP) model
• Assessment Layer
  •  Assessment Plan model
  •  Assessment Results model
  •  Plan of Action and Milestones (POA&M) model

The release state of each model, along with download links for the latest versions of XML and JSON schema for each model are provided in the table, below. YAML is also supported through conversion between JSON and YAML. Since YAML is a superset of JSON, some YAML tooling allows JSON schema to be used for YAML validation. In this way, the provided JSON schema supports both JSON and YAML.