Skip to main content

Open Security Controls Assessment Language (OSCAL) Monthly Workshop Series

OSCAL Monthly Workshop Series

The NIST OSCAL team is hosting a new series of mini workshops, that aims to address topics of interest for our community and to open this forum for its members to present their OSCAL-related work. Unless specifically stated, the workshops will not require a deep, technical understanding of OSCAL, and the dialog is informal, allowing the community to interact with the presenters and with the OSCAL team members.

Please see below the call for proposals if you are interested in presenting your OSCAL work. To submit topics for discussion, please email us at oscal@nist.gov.

The OSCAL project and this workshop series are aligned with NIST’s mission of promoting U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. NIST works to maximize its impact and mission fulfillment by positioning itself to anticipate future technology trends and develop the most important measurements and standards products that are aligned with industry drivers and needs.

We encourage developers of control-oriented security tools, organizations that want to use or create OSCAL-based information to automate security assessment, and those planning to move towards continuous Authorization to Operate (cATO) to attend the workshops.

Who should attend:

  • Leaders in digital transformation and security automation from the government, private, and academic sectors;
  • Vendors of security automation tools who are considering implementing OSCAL formats in their tools;
  • Participants in standard development organizations focusing on developing and publishing control catalogs and baselines;
  • System owners from the government, private, and academic sectors, who want to streamline the documentation of controls used in their information systems.

Call for Proposals

NIST OSCAL Monthly Workshop program committee is seeking timely, topical, and thought-provoking technical presentations or demonstrations highlighting OSCAL editorial tools, OSCAL-based security assessment automation processes, and Governance Risk and Compliance (GRC) tools supporting OSCAL formats for integration into such processes.

NIST does not endorse any of the OSCAL tools or services presented. Presentations or demos promoting such tools or services, as opposed to focusing on the OSCAL-related technical aspects, will not be permitted.

We encourage proposals from a diverse array of organizations and individuals with different perspectives, from the public and private sectors, international bodies, assessment and authorization (A&A), or certification and authorization (C&A) providers.

Please find below the calendar of proposed dates. Before submitting a proposal, please consult the calendar and indicate the preferred date with your submission and the duration of your presentation (60 min, including Q&A). We will do our best to update the calendar as soon as a submission is approved.

Submit your proposal via email to oscal@nist.gov, with the subject line: “OSCAL Workshop - [Date: yyyy/mm/dd]”, where the “Date” is the selected date from the calendar below. Please include in your submission a pre-assessment of the OSCAL knowledge level the audience will need using a 4-levels scale with level one (L1/bronze) being equivalent to novice and level four (L4/platinum) being an OSCAL expert.


Attend the Next Monthly Workshop Event

We'd love for you to be a part of our upcoming virtual OSCAL Workshop! These engaging workshops are held monthly, typically around the middle of the month. For up-to-date information about the workshops, please visit our OSCAL CSRC page.

Visit our Events Page to explore an interactive web calendar and download our iCalendar for seamless access to both upcoming and past events.

Meeting ID: 160 984 5104

Passcode: 10782510


Workshops Calendar: jump to: 2025, 2024, 2023, 2022

2025

DateTimeTalk/Demo/DiscussionPresenter & AffiliationType
2025/3/1911:00Am-12:00PM EDTOSCAL-based AI-augmented CISO AgentYuji Watanabe, Research Senior Technical Staff Member, IBM Tokyo; Hirokuni Kitahara, Research Scientist, IBM Tokyo; Takumi Yanagawa, Research Advisory, IBM Tokyo; Saki Takano, Research Scientist, IBM Tokyo; Anca Sailer, Distinguished Engineer, IBM TJ WatsonRecording will be available after the workshop concludes.
2025/2/1911:00AM-12:00PM EDTThe OSCAL Implementer's Guide: Strategies, Lessons, and Best PracticesMacy Smith, Vice President & Co Founder, USAI; Matthew Coughlin, Information System Security Officer, USAIpresentation, video part 1, video part 2, transcript
2025/1/1511:00AM-12:00PM EDTFrom One-Size-Fits-All to Right-Sizing: Adapting OSCAL for the Singapore Government's Tech StandardsHunter Nield, Distinguished Engineer, GovTech Singapore; Eugene Lim, Lead Cybersecurity Engineer, GovTech Singaporepresentation, video part 1, video part 2, video part 3, transcript

2024

DateTimeTalk/Demo/DiscussionPresenter & AffiliationType
2024/11/2011:00AM-12:00PM EDTLeveraging OSCAL to support cybersecurity lifecycle managementSara Nieves Matheu Garcia, Post Doctoral Researcher, University of Murcia, Spain; Antonio Skarmeta, Full Professor, University of Murcia, Spainpresentation, video part 1, video part 2, video part 3, transcript
2024/11/06 SPECIAL EDITION11:00AM-12:00PM EDTCompliance Framework: An OSCAL-based framework for recording and reporting an audit stateIan Miell, Partner, Container Solutions; Christiaan Vermeulen, Principal Consultant, Container Solutionspresentation, video part 1, video part 2, transcript
2024/09/1811:00AM-12:00PM EDTDigital Authorizations: FedRAMP Modernization using OSCALDavid Waltermire, FedRAMP; Rene-Claude Tshiteya, FedRAMPpresentation, video part 1, video part 2, transcript
2024/07/1711:00AM-12:00PM EDTOSCAL-COMPASS - Open Security Control Assessment Language Compliance Automated Standard SolutionVikas Agarwal, Senior Research Scientist, IBM; Manjiree Gadgil, Engineering Manager, IBM; Jenn Power, Senior Product Security Engineer, RedHat; Anca Sailer, Distinguised Engineer, IBM; Takumi Yanagawa, Senior Engineer, IBMpresentation, video, transcript
2024/06/2011:00AM-12:00PM EDTAutomating Compliance Narratives and Artifacts in AWS*Rick Kidder, USN (Ret), Senior Certified Cloud Security Specialist, AWSpresentation, video part 1, video part 2, video part 3, transcript
2024/06/05 SPECIAL EDITION11:00AM-12:00PM EDTATO as Code - Enabling Cybersecurity Modernization Through Risk Management Framework Compliance AutomationGaurav Pal, stackArmorpresentation, video part 1, video part 2, video part 3, transcript
2024/05/1511:00AM-12:00PM EDTAdoption of OSCAL in ServiceNow CAM (Continuous Authorization & Monitoring)Dharav Devani, ServiceNow; Ayush Srivanstava, ServiceNowpresentation
2024/04/1711:00AM-12:00PM EDTAutomated Governance - Modular Assessments for Quick Feedback LoopsBrandt Keller, OSS Maintainer, Defense Unicornspresentation, video, demo
2024/04/03 SPECIAL EDITION11:00AM-12:00PM EDTStreamlining CMMC Compliance Deliverables with OSCALKenny Scott, Co-Founder & CEO, Paramifypresentation, video, transcript
2024/03/2011:00AM-12:00PM EDTOSCAL Community CapabilitiesBrian Ruf, Director of Cybersecurity, Easy Dynamics; Chris Robles, CTO Strategic Advisor, Security and Product Development (Consultant), Easy Dynamicspresentation, video part 1, video part 2, video part 3, transcript
2024/02/1511:00AM-12:00PM EDTPwC Compliance as Code with OSCALTom Nash, PwC, UK; Joshua Kong, PwC, UKpresentation
2024/1/1411:00AM-12:00PM EDTA Developer's View of OSCAL - Experiences and recommendations for implementing OSCAL LibrariesRob Sherwood, Principal Consultant, Credentive Securitypresentation, video part 1, video part 2, transcript

2023

DateTimeTalk/Demo/DiscussionPresenter & AffiliationType
2023/11/1511:00AM-12:00PM EDTCyber Compliance Management PlatformTom Nash, PwC, UK; Siva Mallampati, PwC, UK; Salma Bedair, PwC, UK; Joshua Kong, PwC, Middle East, Shereef Assem, PwC, Middle Eastpresentation
2023/10/1811:00AM-12:00PM EDTOSCAL-Pydantic: A python library for OSCALRobert Sherwood, Principal Consultant, Credentive Securitypresentation, video, transcript
2023/09/2011:00AM-12:00PM EDTOSCAL in an Enterprise ContextJJ Contessa, COO, C1Secure; Vijay Addicam, Senior Developer, C1Secure; Todd Hughes, Senior Security Analyst, C1Secure; Steve Grogan, VP of Servicespresentation, video part 1, video part 2, transcript part 1, transcript part 2
2023/08/2311:00AM-12:00PM EDTStep-by-Step Introduction to NIST's OSCAL-CLI ToolAlexander Stein, OSCAL Technical Director, NISTpresentation, video, transcript
2023/07/1911:00AM-12:00PM EDTTracer - Accelerating ATOs at Scale with an Inheritance-driven Community Compliance PlatformClark Pain, Product Manager, Rise8presentation, video, transcript, demo
2023/05/1711:00AM-12:00PM EDTApplying OSCAL in the Context of Public Key InfrastructureRobert Sherwood, Principal Consultant, Credentive Securitypresentation, video, transcript
2023/03/1511:00AM-12:00PM EDTTelos's Journey of Bringing OSCAL Adoption to RealityStephanie Lacy, Senior Solution Architect, Telos; Connor Hite, Solution Architect, Telospresentation, video, transcript
2023/03/01 SPECIAL EDITION11:00AM-12:00PM EDTShifting Left the Right Way With OSCAL (research use case and proof of concept)Chris Compton, Senior IT Specialist, NIST; Alexander Stein, Senior IT Specialist, NIST; Nikita Wootten, Project Lead, IT Specialist, NISTpresentation, video, demo, presentation transcript, demo transcript
2023/02/1511:00AM-12:00PM EDTGoogle's Internal OSCAL AdoptionVikram Khare, Director – Continuous Assurance and Controls Engineering, Google; Val Mihai, Cloud CISO - Continuous Assurance and Controls Engineering, Googlepresentation, video, transcript
2023/02/01 SPECIAL EDITION11:00AM-12:00PM EDTA Modern Authorization and Accreditation Platform Enabled by OSCALJohn Tibbits, Principal, IMPLERUS Corporation; Marcin Staszewski, Chief Development Officer, IMPLERUS Corporationpresentation, video & demo, transcript

2022

DateTimeTalk/Demo/DiscussionPresenter & AffiliationTypeKnowledge Level
2022/11/3011:00AM-12:00PM EDTThe OSCAL Futurist: Musing on What Is Possible and What is NeededGreg Elin, Founder & CEO, GovReady PBCpresentation, video, transcriptL2-L3
2022/11/0211:00AM-12:00PM EDTImplementing an Agency Security Assessment Framework (SAF) with OSCAL "ComplianceOps"Robert Ficcaglia, CNCF Kubernetes Policy Co-Chair, CNCF Security Technical Advisory Group Lead Assessor, Kubernetes SIG-Security Audit Teampresentation, video, transcriptL1-L3
2022/10/0511:00AM-12:00PM EDTCompliance as Code - from Upstream to OpsBrandt Keller, Software Engineer, Defense Unicornspresentation & demoL2-L3
2022/09/0711:00AM-12:00PM EDTNIST OSCAL Open Source ToolingDavid Waltermire, OSCAL Technical Director, NIST; Dmitry Cousin, OSCAL Team Member, NISTvideo p1&p2, presentation1, presentation2 & demosL1-L3
2022/08/1011:00AM-12:00PM EDTExtreme Automation with OSCAL - Exercising the Full OSCAL Stack in a Next Generation GRC videoTravis Howerton, Co-Founder & CTO, RegScalepresentation & demoL1-L3
2022/07/1311:00AM-12:00PM EDTOSCAL Implementation: Early Lessons Learned videoMatthew Donkin, Security Assurance Manager, AWS; Stephanie Lacy, Senior Solutions Architect, TelospresentationL3
2022/06/1511:00AM-12:00PM EDTIBM's Trestle - compliance as code orchestrator and automation workflowDr. Anca Sailer video; Dr. Vikas Agarwal video; Lou DeGenaro videopresentation & demo summaryL4
2022/05/1811:00AM-11:40AM EDT1. Compliance as Code for Big Bang Risk Management Framework (RMF) Control Mapping to Accelerate Department of Defense (DoD) Authorization to Operate (ATO)Maj Camdon Cady, Chief Operating Officer, Platform One, US Airforce; Tom Runyon, Defense UnicornspresentationL2
2022/05/1811:40AM-12:00PM EDT2. OSCAL Catalog Authoring Tool (CAT)Dmitry Cousin, OSCAL Team Member, NISTpresentation demoL1

This page was last updated on March 4, 2025.