OSCAL is distributed in a series of releases that represent increments of features and functionality that have been added to OSCAL over time.

This reference provides format documentation for the following OSCAL releases.

• Development Snapshot
• Latest Release (v1.1.2)
• prototype-mapping-model
• prototype-shared-responsibility-model
• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.1.0
• 1.1.1

How do I use this documentation?

Each specification consists of an outline, an index, and a reference, for both JSON and XML formats.

Outline Pages

An outline is a navigable, tree-based representation of OSCAL’s models. For example, below is the collapsed OSCAL System Security Plan outline in JSON and XML, respectively. The name links to the corresponding entry in the XML or JSON formats.

By clicking on the black triangle in front of an entry, it expands to show child entries.

In an outline, the cardinality, the minimum and maximum number of instances required, follows the entry as a number in square brackets. The data type follows the cardinality (see the cardinality [1] in the image below).

Reference Pages

In an outline, each entry links to its corresponding reference providing a definition for an entry and its constraints.

Index Pages

An index for each OSCAL model lists all entries in alphabetical order.

Each entry in the index lists a specific location in the applicable model, in both JSON and XML formats.