Tool

OSCAL

NIST Open Security Controls Assessment Language for machine-readable controls, profiles and assessment results.

pages.nist.gov/OSCAL

Where it helps

• Governance is Version Controlled

  Controls, profiles, SSPs and assessment results are serialised as reviewable artefacts.

• Governance Is Composable

  Profiles and overlays specialise baselines without replacing the whole catalogue.

• Evidence by Default

  Assessment results are structured evidence that can be emitted continuously, not assembled later.

• Build a Governance Twin

  Provides portable control and assessment semantics a twin can reference.