Open Security Controls Assessment Language (OSCAL) Monthly Workshop Series
Navigate this Page
What is the OSCAL Monthly Workshop Series? Attend the Workshops Call for Proposals Workshops Calendar
What is the OSCAL Monthly Workshop Series?
The NIST OSCAL team hosts a series of mini workshops for the OSCAL community to learn, share, and connect. Each session explores topics of interest, highlights real-world OSCAL implementations, and gives community members an opportunity to present their work and exchange ideas. Most of the workshops are designed to be accessible to a broad audience and do not require deep technical knowledge of OSCAL. Discussions are interactive, with plenty of opportunities to ask questions and engage with presenters and the OSCAL team.
If you are interested in presenting your OSCAL-related work or proposing a topic for discussion, please see the Call for Proposals section below or email the OSCAL team at [email protected].
Who should attend?
These workshops are for anyone interested in using OSCAL to improve security automation, including:
- Government, industry, and academic leaders focused on digital transformation and security automation.
- Developers and vendors building security and compliance tools with OSCAL support.
- Organizations creating or using OSCAL content to streamline security documentation and assessment.
- Standards organizations developing control catalogs and baselines.
- Teams exploring or implementing continuous Authorization to Operate (cATO).
We encourage developers of control-oriented security tools, organizations that want to use or create OSCAL-based information to automate security assessment, and those planning to move towards continuous Authorization to Operate (cATO) to attend the workshops.
Attend the Next Monthly Workshop
We'd love for you to join us at an upcoming virtual OSCAL Workshop!
These engaging sessions are held monthly, typically around the middle of each month. For the latest workshop details and schedules, please visit the OSCAL CSRC page.
You can also explore our Events Page for an interactive calendar and download our iCalendar to easily keep track of upcoming and past OSCAL events.
Don't miss out on the next upcoming session!
Join Zoom Workshop
Meeting ID: 160 984 5104
Passcode: 10782510
Call for Proposals
The OSCAL Monthly Workshop Program Committee is seeking timely, relevant, and thought-provoking technical presentations or demonstrations that showcase practical applications of OSCAL.
Find important information about how to get involved with the workshops below:
Suggested Topics
Proposed topics may include:
- OSCAL editorial tools and related workflows
- OSCAL-based security assessment automation processes
- Governance, Risk, and Compliance (GRC) tools that support OSCAL formats and integrate with OSCAL-based processes
Important Guidelines
- NIST does not endorse any OSCAL tools, products, or services presented during the workshops
- Presentations should focus on the technical aspects of OSCAL, including implementation approaches, lessons learned, and interoperability considerations
- Proposals primarily intended to promote or market a specific tool or service will not be accepted
Who Can Submit
We welcome submissions from a wide range of organizations and individuals representing diverse perspectives, including:
- Public and private sector organizations
- International bodies
- Assessment and authorization (A&A) communities
- Certification and authorization (C&A) providers
Finding an Available Workshop Date
Before submitting a proposal, please review the workshop calendar and identify your preferred presentation date. Each workshop session is 60 minutes long, including time for questions and discussion. The calendar will be updated as soon as possible after a submission is approved.
Where to Submit the Proposal
Submit your proposal by email to [email protected] using the subject line format: “OSCAL Workshop - [Date: yyyy/mm/dd]”
Workshops Calendar
Explore upcoming workshop schedules and access recordings and materials from past sessions to see how the OSCAL community is applying OSCAL in real-world projects.
2026
| Date | Time | Talk/Demo/Discussion | Presenter & Affiliation | Type |
|---|---|---|---|---|
| 2026/08/19 [UPCOMING] | 11:00AM-12:00PM EDT | German BSI Baseline Manual goes OSCAL: Tools and Learnings | Christoph Puppe, Principal Enterprise Security Architect, NTT DATA, Deutschland | Recording will be available once the workshop concludes. |
| 2026/07/15 | 11:00AM-12:00PM EDT | The Continuous Compliance Framework - An Updated Demonstration | Gustavo Carvalho, Principal Engineer, Container Solutions | presentation, video, transcript |
| 2026/06/24 | 11:00AM-12:00PM EDT | Automating Continuous Authorization: Leveraging OSCAL for Real-Time Compliance with ComplySyncATO | Vijay Narasimhan, Chief Technology Officer, ASSYST; Joe Anderson, Chief Operating Officer, ASSYST; John Kimberl, Business Development Specialist, ASSYST | presentation, video, transcript |
| 2026/05/20 | 11:00AM-12:00PM EDT | OSCAL.io for Evaluating Interoperability | Pirooz Javan, Chief Technology Officer, Easy Dynamics | presentation, video, transcript |
| 2026/04/15 | 11:00AM-12:00PM EDT | FedRAMP Deliverables in OSCAL | Brian J. Ruf, FedRAMP Technology Focus Group Lead, OSCAL Foundation; Stephen Banghart, Technical Coordinator, OSCAL Foundation | presentation, video, transcript |
| 2026/03/18 | 11:00AM-12:00PM EDT | OSCAL Pocket Guide: Putting NIST Compliance in Your Pocket - Powered by OSCAL | Tevin Harris, Federal Employee & Founder, euCann | presentation, video, transcript |
| 2026/02/18 | 11:00AM-12:00PM EDT | OSCAL Hub - Open Source Visual Tools for Rapid Authorizations and Content Sharing using OSCAL | Travis Howerton, Co-Founder and CEO, RegScale | presentation, video part 1, video part 2, video part 3, transcript |
| 2026/02/04 SPECIAL EDITION | 11:00AM-12:00PM EDT | AI Agent for OSCAL: Instant OSCAL Expertise for All | Fritz Kunstler, Principal Security Engineer, AWS | presentation, video, transcript |
2025
2025
| Date | Time | Talk/Demo/Discussion | Presenter & Affiliation | Type |
|---|---|---|---|---|
| 2025/8/20 | 11:00AM-12:00PM EDT | CAPORDINO: A Data Converter to OSCAL Catalogs | Selena Xiao, Computer Scientist, NIST | presentation, video, transcript |
| 2025/7/16 | 11:00AM-12:00PM EDT | Collaboratively Maturing the OSCAL Control Mapping Model at the OSCAL Foundation | Anca Sailer, Distinguished Engineer, IBM Research; Stephen Banghart, Technical Coordinator, OSCAL Foundation; Vikas Agarwal, Senior Technical Staff Member, IBM Research - India | presentation, video part 1, video part 2, transcript |
| 2025/6/18 | 11:00AM-12:00PM EDT | OSCAL - A "FastTrack" to agency contracting | Mats Nahlinder, CEO & Co-Founder, Sunstone Secure; Robert Ficcaglia, CTO & Co-Founder, Sunstone Secure | presentation, video, transcript |
| 2025/5/21 | 11:00AM-12:00PM EDT | Automated OSCAL-based evidence gathering with The Continuous Compliance Framework | Chris Vermeulen, Principal Engineer, Container Solutions; Ian Miell, Partner, Container Solutions | presentation, video, transcript |
| 2025/4/16 | 11:00AM-12:00PM EDT | OSCAL Catalogs: Create Easily and Use Broadly | Pirooz Javan, CTO, Easy Dynamics; Brian Ruf, Independent Consultant, RufRisk; Juan Risso, Lead Software Engineer, Easy Dynamics | presentation, video, transcript |
| 2025/3/19 | 11:00AM-12:00PM EDT | OSCAL-based AI-augmented CISO Agent | Yuji Watanabe, Research Senior Technical Staff Member, IBM Tokyo; Hirokuni Kitahara, Research Scientist, IBM Tokyo; Takumi Yanagawa, Research Advisory, IBM Tokyo; Saki Takano, Research Scientist, IBM Tokyo; Anca Sailer, Distinguished Engineer, IBM TJ Watson | presentation, video part 1, video part 2, transcript |
| 2025/2/19 | 11:00AM-12:00PM EDT | The OSCAL Implementer's Guide: Strategies, Lessons, and Best Practices | Macey Smith, Vice President & Co Founder, USAI; Matthew Coughlin, Information System Security Officer, USAI | presentation, video part 1, video part 2, transcript |
| 2025/1/15 | 11:00AM-12:00PM EDT | From One-Size-Fits-All to Right-Sizing: Adapting OSCAL for the Singapore Government's Tech Standards | Hunter Nield, Distinguished Engineer, GovTech Singapore; Eugene Lim, Lead Cybersecurity Engineer, GovTech Singapore | presentation, video part 1, video part 2, video part 3, transcript |
2024
2024
| Date | Time | Talk/Demo/Discussion | Presenter & Affiliation | Type |
|---|---|---|---|---|
| 2024/11/20 | 11:00AM-12:00PM EDT | Leveraging OSCAL to support cybersecurity lifecycle management | Sara Nieves Matheu Garcia, Post Doctoral Researcher, University of Murcia, Spain; Antonio Skarmeta, Full Professor, University of Murcia, Spain | presentation, video part 1, video part 2, video part 3, transcript |
| 2024/11/06 SPECIAL EDITION | 11:00AM-12:00PM EDT | Compliance Framework: An OSCAL-based framework for recording and reporting an audit state | Ian Miell, Partner, Container Solutions; Christiaan Vermeulen, Principal Consultant, Container Solutions | presentation, video part 1, video part 2, transcript |
| 2024/09/18 | 11:00AM-12:00PM EDT | Digital Authorizations: FedRAMP Modernization using OSCAL | David Waltermire, FedRAMP; Rene-Claude Tshiteya, FedRAMP | presentation, video part 1, video part 2, transcript |
| 2024/07/17 | 11:00AM-12:00PM EDT | OSCAL-COMPASS - Open Security Control Assessment Language Compliance Automated Standard Solution | Vikas Agarwal, Senior Research Scientist, IBM; Manjiree Gadgil, Engineering Manager, IBM; Jenn Power, Senior Product Security Engineer, RedHat; Anca Sailer, Distinguised Engineer, IBM; Takumi Yanagawa, Senior Engineer, IBM | presentation, video, transcript |
| 2024/06/20 | 11:00AM-12:00PM EDT | Automating Compliance Narratives and Artifacts in AWS | *Rick Kidder, USN (Ret), Senior Certified Cloud Security Specialist, AWS | presentation, video part 1, video part 2, video part 3, transcript |
| 2024/06/05 SPECIAL EDITION | 11:00AM-12:00PM EDT | ATO as Code - Enabling Cybersecurity Modernization Through Risk Management Framework Compliance Automation | Gaurav Pal, stackArmor | presentation, video part 1, video part 2, video part 3, transcript |
| 2024/05/15 | 11:00AM-12:00PM EDT | Adoption of OSCAL in ServiceNow CAM (Continuous Authorization & Monitoring) | Dharav Devani, ServiceNow; Ayush Srivanstava, ServiceNow | presentation |
| 2024/04/17 | 11:00AM-12:00PM EDT | Automated Governance - Modular Assessments for Quick Feedback Loops | Brandt Keller, OSS Maintainer, Defense Unicorns | presentation, video, demo |
| 2024/04/03 SPECIAL EDITION | 11:00AM-12:00PM EDT | Streamlining CMMC Compliance Deliverables with OSCAL | Kenny Scott, Co-Founder & CEO, Paramify | presentation, video, transcript |
| 2024/03/20 | 11:00AM-12:00PM EDT | OSCAL Community Capabilities | Brian Ruf, Director of Cybersecurity, Easy Dynamics; Chris Robles, CTO Strategic Advisor, Security and Product Development (Consultant), Easy Dynamics | presentation, video part 1, video part 2, video part 3, transcript |
| 2024/02/15 | 11:00AM-12:00PM EDT | PwC Compliance as Code with OSCAL | Tom Nash, PwC, UK; Joshua Kong, PwC, UK | presentation |
| 2024/1/14 | 11:00AM-12:00PM EDT | A Developer's View of OSCAL - Experiences and recommendations for implementing OSCAL Libraries | Rob Sherwood, Principal Consultant, Credentive Security | presentation, video part 1, video part 2, transcript |
2023
2023
| Date | Time | Talk/Demo/Discussion | Presenter & Affiliation | Type |
|---|---|---|---|---|
| 2023/11/15 | 11:00AM-12:00PM EDT | Cyber Compliance Management Platform | Tom Nash, PwC, UK; Siva Mallampati, PwC, UK; Salma Bedair, PwC, UK; Joshua Kong, PwC, Middle East, Shereef Assem, PwC, Middle East | presentation |
| 2023/10/18 | 11:00AM-12:00PM EDT | OSCAL-Pydantic: A python library for OSCAL | Robert Sherwood, Principal Consultant, Credentive Security | presentation, video, transcript |
| 2023/09/20 | 11:00AM-12:00PM EDT | OSCAL in an Enterprise Context | JJ Contessa, COO, C1Secure; Vijay Addicam, Senior Developer, C1Secure; Todd Hughes, Senior Security Analyst, C1Secure; Steve Grogan, VP of Services | presentation, video part 1, video part 2, transcript part 1, transcript part 2 |
| 2023/08/23 | 11:00AM-12:00PM EDT | Step-by-Step Introduction to NIST's OSCAL-CLI Tool | Alexander Stein, OSCAL Technical Director, NIST | presentation, video, transcript |
| 2023/07/19 | 11:00AM-12:00PM EDT | Tracer - Accelerating ATOs at Scale with an Inheritance-driven Community Compliance Platform | Clark Pain, Product Manager, Rise8 | presentation, video, transcript, demo |
| 2023/05/17 | 11:00AM-12:00PM EDT | Applying OSCAL in the Context of Public Key Infrastructure | Robert Sherwood, Principal Consultant, Credentive Security | presentation, video, transcript |
| 2023/03/15 | 11:00AM-12:00PM EDT | Telos's Journey of Bringing OSCAL Adoption to Reality | Stephanie Lacy, Senior Solution Architect, Telos; Connor Hite, Solution Architect, Telos | presentation, video, transcript |
| 2023/03/01 SPECIAL EDITION | 11:00AM-12:00PM EDT | Shifting Left the Right Way With OSCAL (research use case and proof of concept) | Chris Compton, Senior IT Specialist, NIST; Alexander Stein, Senior IT Specialist, NIST; Nikita Wootten, Project Lead, IT Specialist, NIST | presentation, video, demo, presentation transcript, demo transcript |
| 2023/02/15 | 11:00AM-12:00PM EDT | Google's Internal OSCAL Adoption | Vikram Khare, Director – Continuous Assurance and Controls Engineering, Google; Val Mihai, Cloud CISO - Continuous Assurance and Controls Engineering, Google | presentation, video, transcript |
| 2023/02/01 SPECIAL EDITION | 11:00AM-12:00PM EDT | A Modern Authorization and Accreditation Platform Enabled by OSCAL | John Tibbits, Principal, IMPLERUS Corporation; Marcin Staszewski, Chief Development Officer, IMPLERUS Corporation | presentation, video & demo, transcript |
2022
2022
| Date | Time | Talk/Demo/Discussion | Presenter & Affiliation | Type | Knowledge Level |
|---|---|---|---|---|---|
| 2022/11/30 | 11:00AM-12:00PM EDT | The OSCAL Futurist: Musing on What Is Possible and What is Needed | Greg Elin, Founder & CEO, GovReady PBC | presentation, video, transcript | L2-L3 |
| 2022/11/02 | 11:00AM-12:00PM EDT | Implementing an Agency Security Assessment Framework (SAF) with OSCAL "ComplianceOps" | Robert Ficcaglia, CNCF Kubernetes Policy Co-Chair, CNCF Security Technical Advisory Group Lead Assessor, Kubernetes SIG-Security Audit Team | presentation, video, transcript | L1-L3 |
| 2022/10/05 | 11:00AM-12:00PM EDT | Compliance as Code - from Upstream to Ops | Brandt Keller, Software Engineer, Defense Unicorns | presentation & demo | L2-L3 |
| 2022/09/07 | 11:00AM-12:00PM EDT | NIST OSCAL Open Source Tooling | David Waltermire, OSCAL Technical Director, NIST; Dmitry Cousin, OSCAL Team Member, NIST | video p1&p2, presentation1, presentation2 & demos | L1-L3 |
| 2022/08/10 | 11:00AM-12:00PM EDT | Extreme Automation with OSCAL - Exercising the Full OSCAL Stack in a Next Generation GRC video | Travis Howerton, Co-Founder & CTO, RegScale | presentation & demo | L1-L3 |
| 2022/07/13 | 11:00AM-12:00PM EDT | OSCAL Implementation: Early Lessons Learned video | Matthew Donkin, Security Assurance Manager, AWS; Stephanie Lacy, Senior Solutions Architect, Telos | presentation | L3 |
| 2022/06/15 | 11:00AM-12:00PM EDT | IBM's Trestle - compliance as code orchestrator and automation workflow | Dr. Anca Sailer video; Dr. Vikas Agarwal video; Lou DeGenaro video | presentation & demo summary | L4 |
| 2022/05/18 | 11:00AM-11:40AM EDT | 1. Compliance as Code for Big Bang Risk Management Framework (RMF) Control Mapping to Accelerate Department of Defense (DoD) Authorization to Operate (ATO) | Maj Camdon Cady, Chief Operating Officer, Platform One, US Airforce; Tom Runyon, Defense Unicorns | presentation | L2 |
| 2022/05/18 | 11:40AM-12:00PM EDT | 2. OSCAL Catalog Authoring Tool (CAT) | Dmitry Cousin, OSCAL Team Member, NIST | presentation demo | L1 |