The Open Security Controls Assessment Language (OSCAL): Schema and Metaschema

Wendell Piez

National Institute of Standards and Technologies / Information Technology Laboratory

expand Wendell Piez

Balisage logo

Preliminary Proceedings

expand How to cite this paper

The Open Security Controls Assessment Language (OSCAL): Schema and Metaschema

Balisage: The Markup Conference 2019
July 30 - August 2, 2019


The Information Technology Lab at NIST is developing technical standards for documentation related to systems security. The Open Security Controls Assessment Language (OSCAL) defines lightweight schemas, along with related infrastructure, for tagging system security information to support routine tasks like crosschecking, validating against arbitrary constraints, and producing punchlists. OSCAL is not conceived as “another big XML application” but as a metaschema. This approach allows us to simplify the design and maintenance of schemas and related tooling; support generation of documentation; produce multiple parallel schemas for XML, JSON, and YAML; and construct conversion tools more easily. Documents and tools leverage basic HTML, or even Markdown, for simplicity even though it limits the complexity of what can be directly imported. Conversion is simplified by the metaschema approach, even when multiple schemas apply to a single data collection. We hope that these simplifications will lead not only to more documents but also to more useful documents.