OSCAL (Open Security Controls Assessment Language)
OSCAL is a NIST standard set of machine-readable formats (XML, JSON, YAML) for security control catalogs, baselines, system security plans, assessment plans, assessment results, and plans of action and milestones. It lets tools exchange compliance data as structured data instead of as prose in a Word or PDF binder.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
OSCAL is maintained by NIST. The current release is OSCAL 1.1.2, whose SSP and POA&M JSON schemas carry an oscal-version field set to that value. FedRAMP 20x asks for machine-readable, automated, reusable evidence rather than a static Word SSP; the Security Decision Record and Collaborative Continuous Monitoring are expressed as structured, ongoing data. OSCAL is the open interchange format that structured data can be serialized to. scm.cc assembles a schema-valid OSCAL 1.1.2 system security plan and plan of action and milestones from the plan, control, and weakness records it already holds, so the same pinned evidence that drives the dashboard can be exported as structured documents.
How to implement
Treat OSCAL as an output format, not a source of truth: keep intended state and evidence in version control and live collectors, then serialize to OSCAL 1.1.2. Validate every export against the NIST OSCAL schema for the model you emit (SSP, POA&M). Keep the oscal-version field aligned with the schema you validated against. Do not hand-edit generated OSCAL; regenerate from the records.
Common mistakes
- Calling an OSCAL file a certification. OSCAL is a document format; FedRAMP authorization is a government decision. - Emitting OSCAL with an oscal-version that does not match the schema the document was validated against. - Hand-editing generated OSCAL instead of regenerating it from the underlying records. - Assuming OSCAL output means a system is FedRAMP-authorized.
Questions teams ask
- What does OSCAL stand for?
- Open Security Controls Assessment Language — a NIST standard for representing security control catalogs, baselines, system security plans, assessment plans and results, and POA&Ms as machine-readable data.
- Which OSCAL version does scm.cc export?
- scm.cc builds OSCAL 1.1.2 system security plan and POA&M documents, with the oscal-version field set to 1.1.2 and validated against the matching NIST schema.
- Does an OSCAL file mean my system is FedRAMP authorized?
- No. OSCAL is a document format. Authorization is a FedRAMP decision. scm.cc is not an assessor and is not FedRAMP-authorized.
Related
Primary sources
- NIST OSCAL project (retrieved 2026-10-11)
- FedRAMP 20x overview & Core Principles (retrieved 2026-10-11)
- Security Decision Record (replaces the SSP) (retrieved 2026-10-11)
Last verified 2026-10-11. FedRAMP.gov is authoritative.