oscal-profile

OSCAL Profile Model

The Profile model enables selecting, organizing, and tailoring controls from catalogs to create security baselines. Profiles can import from catalogs or other profiles.

Related skills:

• oscal-catalog - Control definitions that profiles select from
• oscal-ssp - System Security Plans that implement profile baselines

Purpose

A profile:

• Selects specific controls from source catalogs
• Tailors controls by modifying parameters, adding constraints, or supplementing guidance
• Organizes controls into custom groupings
• Creates baselines like FedRAMP Low/Moderate/High

Common Profiles

Profile	Based On	Description
FedRAMP Low	NIST 800-53	Low-impact cloud systems
FedRAMP Moderate	NIST 800-53	Moderate-impact cloud systems
FedRAMP High	NIST 800-53	High-impact cloud systems
CMMC Level 2	NIST 800-171	Contractor cybersecurity maturity

Document Structure

profile:
  uuid: <unique-identifier>
  metadata:
    title: "Baseline Profile"
    version: "1.0.0"
    oscal-version: "1.1.2"
  imports:          # Source catalogs/profiles
    - href: "catalog.json"
      include-controls:
        - with-ids:
            - ac-1
            - ac-2
  merge:            # How to combine imports
    combine:
      method: merge
    as-is: true
  modify:           # Tailoring modifications
    set-parameters: []
    alters: []
  back-matter:
    resources: []

Imports

Importing from Catalogs

imports:
  - href: "https://example.com/oscal/nist-800-53-catalog.json"
    include-controls:
      - with-ids:
          - ac-1
          - ac-2
          - ac-3

Importing from Other Profiles

imports:
  - href: "fedramp-moderate-baseline.json"
    include-controls:
      - with-ids:
          - ac-1

Include/Exclude Patterns

Include all controls:

imports:
  - href: "catalog.json"
    include-all: {}

Include by matching:

imports:
  - href: "catalog.json"
    include-controls:
      - matching:
          - pattern: "ac-*"    # All access control
          - pattern: "sc-*"    # All system/comms protection