# The Open Security Controls Assessment Language (OSCAL)

NIST is developing OSCAL as a set of machine-readable data exchange formats, referred to as "OSCAL models" (https://pages.nist.gov/OSCAL/concepts/layer/). These models enable organizations to express and exchange detailed, security and privacy control-related information in an implementation neutral way that spans the needs of multiple industries and compliance regimes. NIST is facilitating the creation and maintenance of the core OSCAL models. These models are provided in Extensible Markup Language (XML), JavaScript Object Notation (JSON), and YAML Ain't Markup Language (YAML) formats that are synchronized allowing them to represent  the same information. OSCAL has been designed to be extended by other organizations to address industry-specific, compliance-specific, or organization-specific content.

More information about OSCAL can be found on the OSCAL Project Website: https://nist.gov/oscal.
Documentation for the OSCAL models can be found at: https://pages.nist.gov/OSCAL/reference/

# Release Contents

This release provides 2 types of resources, each located in a different subdirectory:

- xml: Provides the XML schemas and content converters that are needed to support the OSCAL model XML-based formats. Instructions for using this information can be found at: https://github.com/usnistgov/OSCAL/tree/master/xml.
- json: Provides the JSON schemas and content converters that are needed to support the OSCAL model JSON-based formats. Instructions for using this information can be found at: https://github.com/usnistgov/OSCAL/tree/master/json.

These directories provide stable, released versions of the resources provided on the OSCAL GitHub repository: https://github.com/usnistgov/OSCAL.

Please note that OSCAL content examples, which were once included in these archives are now located at: https://github.com/usnistgov/oscal-content.

If you have existing content targeting the previous `oscal-version` from a prior release, you can use the content upgrade transforms to upgrade them to this release as documented in this directory's README: https://github.com/usnistgov/OSCAL/tree/main/src/release/content-upgrade/.

# The OSCAL Roadmap

OSCAL is being developed through a series of milestone releases, which are focused around stabilizing the OSCAL model layers in a progression. While the project is being developed iteratively, the OSCAL team is working to reduce the impact of changes between each milestone release, to provide for early adoption of OSCAL content and the development of tools supporting the lower-layer models.

More information on these milestones and complete OSCAL Roadmap is always available at: https://pages.nist.gov/OSCAL/contribute/roadmap/.

# How to Contribute

OSCAL is being developed in a public GitHub repository, in collaboration with industry and government. We welcome community participation in the project. We are always in need to volunteers willing to:

- Review content and tools providing feedback on what is working well, and where issues are found.
- Help with developing OSCAL models and associated content.
- Assistance with developing documentation, tutorials, and other informational resources.

If you are interested in helping, please visit or contributing page for more information at: https://github.com/usnistgov/OSCAL/blob/master/CONTRIBUTING.md.

Please direct any questions, comments, concerns, or kudos by email to: oscal@nist.gov.