oscal-catalog

OSCAL Catalog Model

The Catalog model is the foundation of OSCAL. It defines security controls that can be selected and tailored by profiles, implemented in SSPs, and assessed.

Related skills:

• oscal-basics - OSCAL overview and concepts
• oscal-profile - Selecting and tailoring controls from catalogs

Purpose

A catalog organizes a collection of security controls into groups and provides detailed control definitions including:

• Control statements (requirements)
• Parameters (configurable values)
• Control objectives
• Assessment methods
• Guidance and references

Common Catalogs

Catalog	Description
NIST SP 800-53	Federal information systems security controls
NIST SP 800-171	Protecting CUI in non-federal systems
ISO 27001	International information security standard
FedRAMP	Federal cloud service provider requirements
CISA SCuBA	Secure Cloud Business Applications

Document Structure

catalog:
  uuid: <unique-identifier>
  metadata:
    title: "Catalog Title"
    version: "1.0.0"
    oscal-version: "1.1.2"
  groups:           # Optional hierarchical organization
    - id: ac
      title: "Access Control"
      controls:
        - id: ac-1
          title: "Policy and Procedures"
  controls:         # Top-level controls (if not in groups)
    - id: control-1
      title: "Control Title"
  back-matter:      # References and resources
    resources: []

Control Structure

Control Definition

controls:
  - id: ac-1
    class: SP800-53
    title: "Policy and Procedures"
    params:
      - id: ac-1_prm_1
        label: "organization-defined personnel or roles"
    props:
      - name: label
        value: "AC-1"
      - name: sort-id
        value: "ac-01"
    parts:
      - id: ac-1_smt
        name: statement
        parts:
          - id: ac-1_smt.a
            name: item
            props:
              - name: label
                value: "a."
            prose: "Develop, document, and disseminate..."
      - id: ac-1_gdn
        name: guidance
        prose: "Access control policy..."
    controls:  # Control enhancements (nested controls)
      - id: ac-1.1
        title: "Enhancement One"