oscal-component-definition

OSCAL Component Definition Model

The Component Definition model describes how components (hardware, software, services, policies, processes) can satisfy security controls. Component definitions are reusable across multiple systems.

Related skills:

• oscal-ssp - System Security Plans that incorporate components
• oscal-profile - Baselines that define required controls

Purpose

Component definitions:

• Document control implementations for products/services
• Enable reuse across multiple system security plans
• Support supply chain security documentation
• Describe configuration options for security compliance

Component Types

Type	Examples
software	Operating systems, applications, databases
hardware	Servers, network devices, HSMs
service	Cloud services, managed services
policy	Security policies, procedures
process	Operational processes, workflows
procedure	Step-by-step instructions
plan	Contingency plans, incident response
guidance	Security guidance documents
standard	Technical standards
validation	FIPS 140-2 certificates, FedRAMP ATOs

Document Structure

component-definition:
  uuid: <unique-identifier>
  metadata:
    title: "Component Name"
    version: "1.0.0"
    oscal-version: "1.1.2"
  import-component-definitions: []  # Reference other components
  components:
    - uuid: component-uuid
      type: software
      title: "Product Name"
      description: "Product description"
      control-implementations: []
  capabilities: []                  # Optional capability groupings
  back-matter:
    resources: []

Components

Basic Component Definition

components:
  - uuid: "550e8400-e29b-41d4-a716-446655440000"
    type: software
    title: "Enterprise Database Server"
    description: "Relational database management system"
    props:
      - name: vendor
        value: "Database Corp"
      - name: version
        value: "15.2"
    protocols:
      - uuid: protocol-uuid
        name: https
        port-ranges:
          - start: 443
            end: 443
            transport: TCP
    control-implementations:
      - uuid: impl-uuid
        source: "profile.json"
        description: "Controls implemented by this component"
        implemented-requirements: []