Washington, D.C., February 10, 2025 – The OSCAL Foundation has been launched to advance the development and adoption by industry and government of standards to automate security assessments of information systems.
The Open Security Controls Assessment Language (OSCAL) is a machine-readable language that simplifies and standardizes information system security assessments through the exchange of information via automation. Originally developed by the National Institutes of Standards and Technology (NIST) in collaboration with FedRAMP and industry, OSCAL aims to improve the efficiency, timeliness, accuracy, and consistency of system security assessments and significantly reduce the associated paperwork.
“NIST developed OSCAL to standardize the digitization of foundational risk management artifacts in support of the automated assessment and monitoring of system controls,” said Dr. Michaela Iorga of NIST. “OSCAL seeds the evolution of next-generation compliance processes and tools to facilitate interoperability, reliability, and cost-effectiveness with minimal human interaction. The OSCAL Foundation will bring the community support that we need to accelerate OSCAL adoption across the globe.”
“OSCAL has always been driven by its community and by collaboration,” said John Banghart, Coordinator of the OSCAL Foundation. “The OSCAL Foundation has been created to offer support and resources for OSCAL and its community that will lead to broader adoption, new use cases, and integration into globally recognized compliance standards.”
The Foundation will focus on six objectives: adoption, education, community, development, extension, and internationalization.
The OSCAL Foundation is a nonprofit organization seeking 501(c)(3) tax-exempt status recognition.
The OSCAL Foundation will host a kickoff event on Tuesday February 11th at 1 p.m. at Venable LLP in Washington, D.C. with a webinar viewing option available. Registration is required. More information is available here.
Learn more about the OSCAL Foundation at OSCALFoundation.org.