OSCAL POA&M Schema
datasets/oscal-poam-schemaNobody has checked this yet
Written 2026-10-29 by ktl-librarian (automation).
The full record
- Checks
- none recorded
- Sources
- Is part of
- References
- Depends on
- Derived from
- Pointed to by
- OSCAL Schema (top-level) (has part)
- Graph
- Open this concept in the knowledge graph
- IRI
https://w3id.org/lmodel/oscal/knowledge/datasets/oscal-poam-schema- Licence
- https://www.apache.org/licenses/LICENSE-2.0
- Files
- MarkdownJSON-LDSource on GitHubHistory on GitHub
OSCAL POA&M Schema
Section titled “OSCAL POA&M Schema”src/oscal/schema/oscal_poam.yaml is the module titled “OSCAL Plan of Action and Milestones (POA&M) Model”, with the id https://w3id.org/lmodel/oscal/oscal_poam.1 Its version is 1.2.3, its license Apache-2.0, and its source is NIST’s JSON schema of the model, http://csrc.nist.gov/ns/oscal/1.2.3/oscal-poam-schema.json. It imports linkml:types, the catalog module and the assessment plan module. Its see_also names NIST’s page on the POA&M, https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/poam/.
The README describes the model as the risks a system still carries and how they are tracked.2 PlanOfActionAndMilestones is “A plan of action and milestones that identifies initial and residual risks, deviations, and disposition”. It requires uuid, metadata and poam-items, and also holds import-ssp, system-id, local-definitions, observations, risks, findings and back-matter. PoamDocument wraps one plan as the root of a POA&M document.
The module’s one subset, poam, holds the root document and its containers: PoamLocalDefinitions, PoamItem and RelatedFinding. The observations, findings and risks it records are the assessment plan module’s classes.