Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Projects

Open Security Controls Assessment Language OSCAL

Overview

The Open Security Controls Assessment Language (OSCAL) is a NIST-led initiative created in partnership with industry to improve and automate security and compliance workflows. It introduces open, machine-readable formats in XML, JSON, and YAML that simplify control-based risk assessments and compliance activities. Through automation, OSCAL can reduce audit timelines from months to just minutes, decrease the likelihood of human error, and help organizations adapt more quickly to the changing regulatory requirements.

OSCAL also supports hardware security by enabling machine-readable descriptions of hardware security controls and compliance data, which allows for automated assessment, continuous monitoring, and lifecycle risk management for hardware components alongside software assets. As a result, security teams can spend less time managing documentation and more time addressing actual cybersecurity risks.

Visit the OSCAL website to find a detailed overview of the OSCAL project, including tutorials, concepts, references, downloads, and much more.

OSCAL CSRC Banner

Data-Centric icon

Data-Centric

integrated api icon

Integrated

extensible data icon

Extensible

automation icon

Automated

traceable icon

Traceable
Transitions the legacy, document-based approach to security planning (Word and Excel) to a data-centric model built on common, machine-readable standards such as XML, JSON, and YAML and which is spanning the full system life cycle, from control catalogs and baselines through implementation and assessment, not just individual controls. Transitions the legacy, document-based approach to security planning (Word and Excel) to a data-centric model built on common, machine-readable standards such as XML, JSON, and YAML and which is spanning the full system life cycle, from control catalogs and baselines through implementation and assessment, not just individual controls. Puts security compliance data to work through an extensible architecture that expresses security controls, their implementation, and their assessment in both machine- and human-readable formats, with native traceability linking every layer back to its source control. Data becomes fuel for the automation engine: because OSCAL content is structured and traceable end-to-end, it natively identifies changes anywhere in the stack and can trigger continuous assessment, applying in this way the benefits of the data-centric approach to processes that are resource-intensive today, saving time and increasing efficiency. Provides native traceability across the entire OSCAL stack, from assessment findings and plans of action back through system implementation, the applicable baseline, and the originating control catalog, allowing for each compliance artifact to be linked to its source, and every change to be tracked as it propagates through the stack.

 

Explore These Helpful Resources About OSCAL:

OSCAL Models

The OSCAL architecture is organized in a stack of layers, with each layer containing models for a specific purpose. Each model defines how information is structured. That same information can be saved in different file formats, such as XML, JSON, or YAML. Although these formats look different, they all represent the same security information, allowing for conversion of OSCAL content between supported formats without losing any data. Each layer in the stack provides information structures that are referenced and used by each higher layer. Learn more about the layers by visiting this page: OSCAL Layers and Models.

 

OSCAL Virtual Escape Room

Explore OSCAL through the NIST OSCAL Virtual Escape Room, an engaging, interactive learning experience. Challenge yourself with puzzles that test your understanding of OSCAL concepts and see if you can escape before time runs out in just 30 minutes.

 

Additional Resources

The following resources provide the official and community ecosystem for working with OSCAL. The NIST GitHub repositories contain the OSCAL specification and example content, the Gitter lobby offers a community forum for questions and collaboration, and the U.S. and EU community websites curate tools, documentation, best practices, and additional resources to help organizations adopt and implement OSCAL.

OSCAL Monthly Adopters' Workshops

Each month, OSCAL hosts a community workshop where participants share how they are adopting OSCAL across a variety of projects. These sessions provide valuable opportunities to learn from real-world implementations, exchange ideas, and discover how organizations across different industries are using OSCAL to support their goals. Visit the OSCAL Adopters' Workshops page to learn how to attend an upcoming workshop or submit a request to present your own OSCAL adoption experience.

 

Past OSCAL Events
Explore past OSCAL workshops and conferences:
The NIST OSCAL team welcomes participation from the OSCAL community. In addition to our monthly OSCAL workshops, we host community meetings throughout the year on a variety of OSCAL development topics. These meetings provide opportunities to learn about ongoing work, share ideas, ask questions, and help shape the future of OSCAL.
 
All community meetings and announcements are shared through the OSCAL mailing lists. We encourage you to subscribe to stay informed and receive invitations to upcoming meetings.
 

OSCAL Mailing Lists

For developers, contributors, and anyone interested in discussing OSCAL development, sharing ideas, asking technical questions, or contributing to the project.

 

[email protected]

For occasional project announcements, release updates, and other important OSCAL news.

 

 

Contacts

OSCAL - NIST
[email protected]

Dr. Michaela Iorga - OSCAL Program Director - NIST
[email protected]

Created April 24, 2018, Updated September 22, 2026