Skip to main content


The OSCAL models provide standardized formats for exchanging control, control implementation, and control assessment information in XML, JSON, and YAML. These formats allow this information to be exchanged between tools and for individual tools to process exchanged data, supporting analytics, user interaction, and increased automation.

Tools exist that support the use of the OSCAL models. These tools are listed below in the following categories:

  • OSCAL Project provided tools and libraries
  • Open Source Tools provided by 3rd parties

If you have produced a tool that supports the OSCAL formats that you would like to have listed on this page, please contact us.


Certain products may be identified on this web page, but such identification doesn’t imply recommendation by the US National Institute of Standards and Technology or other agencies of the US Government, nor does it imply that the products identified are necessarily the best available for the purpose.

See the NIST Software Disclaimer for more information.

OSCAL Tools and Libraries

Compliance trestleIBMA python SDK and command line tool which manipulates OSCAL structures and supports transformation of data into source
OSCAL Java LibraryNIST OSCAL ProjectA Java-based programming API for reading and writing content conformant to the OSCAL XML, JSON, and YAML based source
OSCAL React Component LibraryEasy DynamicsA library of reusable React components and an example user interface application that provides a direct UI into source
OSCAL REST APIEasy DynamicsAn initial OpenAPI definition of an OSCAL REST API that describes how systems might manipulate catalogs, profiles, components, and source
XSLT ToolingNIST OSCAL ProjectA variety of Extensible Stylesheet Language (XSL) Transformations (XSLT), Cascading Style Sheets (CSS), and related utilities for authoring, converting, and publishing OSCAL content in various source
XML Jelly SandwichWendell Piez (NIST)Interactive XSLT in the browser includes OSCAL source
Xacta 360TelosXacta 360 is a cyber risk management and compliance analytics platform that enables users to create and submit FedRAMP system security plans (SSPs) in OSCAL format. Future OSCAL capabilities are forthcoming as the standard evolves.license
Atlasity: Continuous Compliance AutomationC2 LabsAtlasity CE (release 2.0) runs in any environment and supports the development of OSCAL v1.0 content for Catalogs, Profiles, System Security Plans and Components. Additional detail can be found in this blog post: Atlasity Delivers Free Tools to Create OSCAL edition

This page was last updated on January 21, 2022.