Scope, influences and mappings

Scope, influences and mappings

What the schema renders

The README says that the schema models NIST’s Open Security Controls Assessment Language (OSCAL) 1.2.3, with one module for each of its models: catalog, profile, component definition, system security plan, assessment plan, assessment results, plan of action and milestones, and mapping collection.¹ docs/about.md says that every element renders a definition of OSCAL’s metaschema at the v1.2.3 release.² CONTRIBUTING.md says that the schema lets LinkML’s tools validate OSCAL documents, and lets a knowledge bundle type its concepts with OSCAL’s models.

NOTICE says that src/oscal/schema/*.yaml, src/oscal/datamodel/ and project/ are this project’s rendering of OSCAL 1.2.3 as a LinkML schema, with NIST as the source of the definitions. They are not NIST’s, and their use does not imply endorsement by NIST.³ The README adds that this is not an official NIST project.

Influences

The README names none beyond OSCAL itself, because the schema renders one specification. Its module layout, its release asset and its governance files follow lmodel/slsa.

Mappings

The README says that there are none yet: no element names a term of another vocabulary.

Not modelled

The README says that OSCAL’s metaschema states constraints that the schema does not check:

• the keys that an index, index-has-key or is-unique constraint names;
• expect tests;
• has-cardinality counts.

So an OSCAL document that passes the schema can still fail NIST’s own validators on these. Validate OSCAL data against the schema says what each check in this repository covers.

Footnotes

1. README.md, the What it models, Influences, Mappings, Not modelled here and License sections ↩

2. docs/about.md, the opening paragraph ↩

3. NOTICE, the paragraph on src/oscal/schema/*.yaml ↩