# oscal

Source: https://startwithidentity.com/glossary/oscal/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

OSCAL (Open Security Controls Assessment Language) is a NIST-led set of machine-readable formats, in XML, JSON and YAML, for writing down security controls and the evidence that a system meets them. Its models cover control catalogs, profiles (baselines selected from a catalog), component definitions, system security plans, assessment plans, assessment results, and plans of action and milestones. The specification and NIST's own SP 800-53 Rev. 5 catalog are published on [GitHub](https://github.com/usnistgov/OSCAL) and documented at [pages.nist.gov/OSCAL](https://pages.nist.gov/OSCAL/).

OSCAL matters to identity teams because compliance mapping is still mostly done by hand from prose standards into spreadsheets. When a control set exists as structured data, a GRC tool can import it, track each requirement against the systems that implement it, and diff the result when the standard changes. In October 2026 NIST [published version 0.1 conformance criteria for SP 800-63-4 in OSCAL](https://startwithidentity.com/blog/2026-10-06-nist-opens-implementation-hub-for-sp-800-63-4/), which turns IAL, AAL and FAL requirements into controls you can assess rather than paragraphs you interpret. OSCAL is a format, not a certification: a clean OSCAL package says the evidence is well organized, not that it is true.

See also: [NIST 800-63](https://startwithidentity.com/glossary/nist-800-63/), [FedRAMP](https://startwithidentity.com/glossary/fedramp/), [compliance guides](https://startwithidentity.com/guides/compliance/), [SOC 2](https://startwithidentity.com/glossary/soc2/)