NIST OSCAL

NIST OSCAL

The Open Security Controls Assessment Language (OSCAL) is a language of the National Institute of Standards and Technology (NIST), as NOTICE names them.¹ docs/about.md calls it NIST’s language for control catalogs, profiles, component definitions, system security plans, assessment plans and results, plans of action and milestones, and control mappings.² The README links its pages at https://pages.nist.gov/OSCAL/, and says that the schema in this repository models OSCAL 1.2.3, one module for each of its models.³

The release the schema renders

The umbrella schema’s header gives its version as 1.2.3, its source as the src/metaschema folder of usnistgov/OSCAL at commit e061961c7702afeabffdf5e59894d35e748dade1, and that tag and commit in its oscal_tag and oscal_commit annotations.⁴ Its see_also names the OSCAL-Reference pages of v1.2.3 and the release, https://github.com/usnistgov/OSCAL/releases/tag/v1.2.3. The OSCAL metaschema copy holds that commit’s metaschema sources. NIST’s readme.md there says that an OSCAL metaschema defines the information structures of an OSCAL model in a format-neutral form, and that OSCAL’s XML and JSON schemas and model documentation are generated from it.⁵

The layers

The modules’ see_also addresses place each model in a layer of NIST’s OSCAL concepts:⁶

• the control layer: the catalog, the profile and the mapping collection;
• the implementation layer: the component definition and the system security plan;
• the assessment layer: the assessment plan, the assessment results and the POA&M.

CONTRIBUTING.md says that a problem in OSCAL itself belongs upstream, in usnistgov/OSCAL’s issue tracker.

Footnotes

1. NOTICE, the paragraph on src/oscal/schema/*.yaml ↩

2. docs/about.md, the opening paragraph ↩

3. README.md, the What it models section ↩

4. src/oscal/schema/oscal.yaml, the header’s version, source, see_also and annotations ↩

5. src/oscal/schema/metaschema/readme.md, the whole page ↩

6. src/oscal/schema, the see_also addresses of the eight modules ↩