3rd Open Security Controls Assessment Language (OSCAL) Workshop

The National Institute of Standards and Technology will be hosting the third workshop in the series focusing on the Open Security Controls Assessment Language (OSCAL). 

Setting the foundation for security automation, with particular focus on the continuous authorization to operate (ATO) processes and continuous monitoring, OSCAL provides machine-readable representations of control catalogs, control baselines or profiles, system security plans, assessment plans, assessment results, and plan of actions and milestones, in a set of formats expressed in XML, JSON, and YAML.

The OSCAL project, and with this workshop series, align with NIST’s mission of promoting U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. NIST works to maximize its impact and mission fulfillment by positioning itself to anticipate future technology trends and develop the most important measurements and standards products that are aligned with industry drivers and needs.

The workshop will provide attendees an opportunity to familiarize themselves and build skills in the development and use of OSCAL. We encourage developers of control-oriented security tools and organizations that want to use or create OSCAL-based information, to register and attend the workshop.

Who should attend:

• Leaders in digital transformation and security automation from the government, private, and academic sectors;
• Vendors of security automation tools who are considering implementing OSCAL formats in their tools;
• Participants in standard development organizations focusing on developing and publishing control catalogs and baselines;
• System owners from the government, private, and academic sectors, who want to streamline the documentation of controls used in their information systems.

EVENT FORMAT

Day one of the workshop will highlight OSCAL 1.0.0 layers and models, with the goal to familiarize the audience with the OSCAL architecture, formats, how these models can be used to support security assessment automation, continuous monitoring, continuous ATO and development, security and operations (DevSecOps). Additionally, the audience will be introduced to the NIST SP 800-53 (Rev4 and Rev5) catalogs, assessment objectives, and associated baselines in OSCAL.

Day two of the workshop will explore OSCAL-based automation solutions, starting with the Federal Risk and Authorization Management Program (FedRAMP) Program Management Office’s (PMO) efforts to digitalize authorization packages submitted in OSCAL, will present FedRAMP’s updated OSCAL resources that include a comprehensive set of guides for additional deliverables.

During both days of the event, we will have a few time slots reserved for participants to give presentations. Attendees interested in being considered to present during the workshop, are encouraged to review the Call for Proposals (see below) for additional information, instructions, and consideration.

Links to previous OSCAL workshops from this series:

2019: Open Security Controls Assessment Language (OSCAL) Workshop

2021: 2nd Open Security Controls Assessment Language (OSCAL) Workshop