Welcome

The goal of the OSCAL Patterns Library is to maximize interoperability across OSCAL tools. The library accomplishes this by defining the recommended OSCAL representation for specific use cases. Recommendations are based on the consensus of participating Foundation members.

Adoption

The OSCAL Foundation has defined the following adoption strategies:

• FedRAMP SSP Adoption Strategies
• Prioritization of additional artifacts TBD

Leave Comments

If you have feedback on any of the content, please leave a comment on the page. Commenting is enabled after you self-register using the "Log in" button in the upper right.

Library Organization

• Core OSCAL: Patterns, guidance, information and resources common to any OSCAL representation regardless of framework or control set.

• FedRAMP: Patterns, guidance, information and resources for expressing FedRAMP Authorization Packages in OSCAL.

  • FedRAMP System Security Plan (SSP): Represent FedRAMP SSP content in OSCAL (In Progress)
  • FedRAMP Plan of Action and Milestones (POA&M): Represent FedRAMP POA&M content in OSCAL (Next)
  • FedRAMP Assessments: Represent FedRAMP SAP and SAR content in OSCAL (Future)

• Additional Frameworks and Industries: Additional frameworks and industries are prioritized based on demand and available resources.)

Project Status and Next Steps

The OSCAL Foundation jumpstarted this library using prior content created by former FedRAMP PMO members. The initial deployment focuses on deployment and cleanup of that FedRAMP-specific content in response to new OSCAL requirements for FedRAMP-authorized systems.

See the Milestones, Approach and Status for completed work, current status and future steps.

Governance

Content in this library is drafted by Technical Focus Groups (TFG). Each TFG reports status at the weekly Technology Working Group (TWG) meeting, held each Tuesday at 11:00 AM Eastern Time.

All content is subject to potential review and approval by the Technical Advisory Group (TAG). Steering Committee and/or Board. approval is also required for more changes to core OSCAL, strategic or broad-reaching topics; and to resolve conflicts.

The organizational structure of the Foundation is as follows:

• Board of Directors
  • Executive Steering Committee
    • Technical Advisory Group (TAG)
      • Technical Working Group (TWG) *
        • Multiple Technical Working Groups (TFG)

* There are other OSCAL Foundation working groups, which are not currently involved in this effort.

Getting Involved

The OSCAL Foundation TWG and TFGs are open to the public. Join the appropriate OSCAL Foundation group lists to see meeting details and receive announcements.

Paid membership is required for approval or voting rights, and to ensure the Foundation's future viability. See the Get Involved page to enquire about membership.