OSCAL basics
NIST's Open Security Controls Assessment Language as it shows up next to FedRAMP 20x artifacts — SSP catalogs, assessment results, and schema validation.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
This is scm.cc skills training. Completing a course or receiving an scm.cc training certificate does not make you a FedRAMP Recognized Independent Assessor, is not a FedRAMP credential, and is not government recognition. Official recognition requires A2LA accreditation (REC-IAS-ACC) and FedRAMP Recognition. FedRAMP.gov is the authoritative source. This is not legal advice.
Who it is for
Engineers and reviewers who will open OSCAL JSON/XML without becoming 'the OSCAL vendor.'
- Explain OSCAL as NIST's machine-readable assessment language.
- Contrast a Rev5 OSCAL SSP with a 20x Security Decision Record.
- Validate a file against a pinned schema and report the actual error.
Lessons
- What OSCAL is
OSCAL is NIST's Open Security Controls Assessment Language: a standardized, machine-readable way to express catalogs, profiles, system security plans, and assessment results.
- OSCAL SSP vs the 20x Security Decision Record
Under 20x the Security Decision Record is the core package artifact in place of the traditional SSP. OSCAL SSPs still appear on Rev5 paths and in tooling. Do not treat one file as the other.
- Assessment results in OSCAL
OSCAL assessment-results documents record observations, findings, and residual risk in a structured tree. They are how a Recognized service might serialize work — not something scm.cc issues.
- Validate against the pinned schema
Honesty in machine-readable review: say which schema version you used, and quote the validator error. Do not 'fix' the file silently to obtain a green check.
Labs (auto-graded)
- Read a schema validation failure
Pick the honest description of a missing required OSCAL field.
Enroll
Related
Questions
- Is this a FedRAMP or A2LA credential?
- No. Completing the course yields an scm.cc training certificate only. Official Recognition requires A2LA accreditation (REC-IAS-ACC).
- What is indexable before I pay?
- This landing page, the lesson previews, and the free intro lesson body. Paid lesson bodies are omitted from the public HTML — the same for humans and crawlers.