OSCAL
also: OSCAL, Open Security Controls Assessment Language
OSCAL (Open Security Controls Assessment Language) is an XML-based standard for expressing security control catalogs, profiles, and assessment results in a machine-readable format. It enables automated security compliance documentation and control validation across systems.
OSCAL is a standardized language developed by NIST for representing security control information in a structured, interoperable format. It allows organizations to define, catalog, and assess security controls in a way that can be automatically processed and shared between tools and systems.
OSCAL consists of several layered models: the Catalog (defining available controls), Profile (selecting controls for a specific system or standard like NIST SP 800-53), Component Definition (documenting how system components implement controls), and Assessment Results (recording control compliance status). This layered approach enables modular reuse and reduces duplication.
Example: An organization might use OSCAL to express that their web server component satisfies control AC-2 (Account Management) from the NIST 800-53 catalog, with evidence and implementation details in machine-readable XML, allowing automated compliance reporting tools to aggregate results across all system components.