About Us
About OSCAL Foundation
The Open Security Controls Assessment Language (OSCAL) is a machine-readable language that simplifies and standardizes information system security assessments through the exchange of information via automation.
Originally developed by the National Institutes of Standards and Technology in collaboration with FedRAMP and industry, OSCAL aims to improve the efficiency, timeliness, accuracy, and consistency of system security assessments.
The OSCAL Foundation is dedicated to furthering the development and adoption of the OSCAL standards. The Foundation is a nonprofit organization seeking 501(c)(3) tax-exempt status recognition.
Our Community
Steering Committee
Technical Advisory Group
Our Objectives
Adoption
- Create open-source, standards-based automation of compliance processes to reduce resource overheads for all stakeholders
- Open opportunities for new cutting-edge security technologies
- Enables interoperability and cooperation at a level that is otherwise impossible
The Foundation will work to encourage global adoption and implementation of OSCAL at government agencies and in private industry to realize this fully integrated vision of security automation.
Education
The Foundation provides educational resources to all members to advance the general level of OSCAL expertise and experience across all stakeholder categories and use cases.
This includes, but is not limited to:
- Tutorials of varying levels of technical complexity
- Example OSCAL content
- Trainings to facilitate knowledge transfers
- Educational materials identified by Foundation leadership
Community
The Foundation recognizes that OSCAL is and always has been a community effort and seeks to streamline and enable interactions between industry and government.
We facilitate regular meetings to further the dialogue between OSCAL stakeholders.
These groups include, but are not limited to:
- Tool developers
- Control content authors
- Regulatory and compliance-managing government agencies
- End users of OSCAL generated or derived products
Development
This community of OSCAL stakeholders powers the development and use of the language. This community will drive the focus of the OSCAL Foundation and seeks to facilitate the ongoing technical development of the OSCAL language in support of models and proof-of-concept tools and examples.
We seek to facilitate this development in a transparent and open fashion through:
- Hosting and encouragement of open-source code development
- Providing OSCAL technical expertise to aid all stakeholders to succeed on a technical level
- Supporting other development efforts, such as fedramp.gov
Extension
- Additions to OSCAL models identified by the community members and voted by the Foundation members
- Management of an official Registry for third-party OSCAL extensions
By providing a shared space for the registration and management of third-party extensions, the Foundation provides the framework for interoperability between otherwise disparate use cases and stakeholders.
The Foundation intends to provide the OSCAL community the tools it needs to support new use cases and enable cross-enterprise interoperability, not to dictate what use cases are valid.
Internationalization
The Foundation intends to grow international adoption of OSCAL. This will enable:
- Multinational organizations to develop and deliver automated international compliance in continuous fashion
- Global government adoption of a common language that can create easy compliance reciprocity and continuous monitoring
- Deliver potential cost savings for organizations that work in multiple countries delivering the same or similar products and services that require compliance