The Open Security Controls Assessment Language (OSCAL) was developed by the National Institute of Science and Technology (NIST) in cooperation with FedRAMP. OSCAL is an information exchange format designed to communicate control definitions, system implementations, assessment results and continuous monitoring of certification frameworks such as:
- American Institute of Certified Public Accountants (AICPA) Systems and Organization Controls 2 (SOC 2)
- US Federal Information System Modernization Act (FISMA) NIST SP 800-53 and Authorization to Operate (ATO) process
- Cloud Security Alliance (CSA) Security, Trust Assurance and Risk (STAR)
OSCAL is public domain and intended to allow tools from different vendors and stakeholders to interoperate. While there have been other efforts to provide machine-readable capabilities for this goal, OSCAL stands out in several important ways:
- OSCAL is designed with the entire lifecycle and all stakeholders in mind, where as prior solutions were focused on a portion of the lifecycle.
- OSCAL is more granular and flexible, allowing organizations to determine the level of granularity appropriate for their needs, and move to greater granularity over time.
- OSCAL is a formal standard from a recognized standards body.
If you would like to learn more about whether OSCAL is the right choice for your organization, contact us for a free 30 minute consultation.
