Skip to main content

This website and its code are not currently under active development: read more details here.

U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Skip to main content

Schema Validation Emulator

OSCAL Catalog Validator

Checking your XML document against rules defined by the OSCAL Catalog Metaschema

NB - work in progress - features and testing still to come -

(Coming soon - not just catalogs but other OSCAL models as well)

Load your OSCAL XML catalog file(s) here for instant validation...

Explanation

The OSCAL Validator reads an arbitrary XML document and reports back findings from an inspection relative to rules defined for the OSCAL catalog (meta)schema:

  • If it is (not) a catalog XML document in the OSCAL namespace (i.e., represented to be an OSCAL catalog)
  • If it sees unknown element occurrences (foreign or out of place)
  • On recognized elements, it reports:
    1. Unrecognized attributes
    2. Required elements and attributes (checking for elements missing)
    3. Cardinality (of elements appearing) - too many or too few
    4. Order of elements - impermissible element ordering
    5. Datatype-based lexical constraints (castable as) constraints (also tested on attributes)
    6. To come... further metaschema-based constraints (allowed-values etc.)

Effectively, this feature set is intended to match that of the normative XML Schema Definition (XSD)-based expression of constraints defining the (XML) OSCAL catalog format. If you find any disparities between this tool, and a compliant application of the OSCAL catalog XSD, please let the developer know.

The SP 800-53 Catalog Validator is an OSCAL demonstration. Use with appropriate caution. Source code is available for inspection or analysis.

Data processing on this page runs entirely in your browser, under SaxonJS. No data is transferred to any other party, monitored or analyzed in any way other than what is displayed.

This page was last updated on March 16, 2023.