The Open Security Controls Assessment Language (OSCAL): schema and metaschema
National Institute of Standards and Technologies / Information Technology Laboratory
The Information Technology Lab at NIST is developing prototype formats for machine-readable documentation related to systems security. The Open Security Controls Assessment Language (OSCAL) defines lightweight schemas, along with related infrastructure, for tagging system security information to support routine tasks like crosschecking, validating against arbitrary constraints, and producing punchlists. OSCAL is not conceived as “another big XML application” but as a metaschema. This approach allows us to simplify the design and maintenance of schemas and related tooling; support generation of documentation; produce multiple parallel schemas for XML, JSON, and YAML; and construct conversion tools more easily. Documents and tools leverage basic HTML, or even Markdown, for simplicity even though it limits the expressiveness of what can be directly imported. Conversion is simplified by the metaschema approach, even when multiple schemas apply to a single set of information. We hope that these simplifications will lead to more useful documents.