OSCAL (Open Security Controls Assessment Language)

OSCAL (Open Security Controls Assessment Language) is a NIST-led set of machine-readable formats, in XML, JSON and YAML, for writing down security controls and the evidence that a system meets them. Its models cover control catalogs, profiles (baselines selected from a catalog), component definitions, system security plans, assessment plans, assessment results, and plans of action and milestones. The specification and NIST's own SP 800-53 Rev. 5 catalog are published on GitHub and documented at pages.nist.gov/OSCAL.

OSCAL matters to identity teams because compliance mapping is still mostly done by hand from prose standards into spreadsheets. When a control set exists as structured data, a GRC tool can import it, track each requirement against the systems that implement it, and diff the result when the standard changes. In October 2026 NIST published version 0.1 conformance criteria for SP 800-63-4 in OSCAL, which turns IAL, AAL and FAL requirements into controls you can assess rather than paragraphs you interpret. OSCAL is a format, not a certification: a clean OSCAL package says the evidence is well organized, not that it is true.

See also: NIST 800-63, FedRAMP, compliance guides, SOC 2