SRMBOK Guide to OSCAL Open Security Controls Assessment Language — Turning security compliance from documents into data
 
Most organisations keep the same controls in six incompatible documents. Insurers, customers, regulators and auditors each ask substantially the same questions; each answer is rewritten by hand. The result is expensive, silent drift and boards that are told the controls are adequate without any practical way to see whether they are.
 
OSCAL is the free, open, machine-readable grammar NIST created to stop the retyping. It is not a framework, a tool or a certification. It is a shared way of writing the things you already write down so that software—and therefore other organizations—can actually use them.
 
This 42-page guide is the version we would want to read before committing budget. It assumes no technical background. It explains what OSCAL actually is, how the eight models fit together, what a single control looks like end-to-end, why the multi-framework promise is more qualified than the marketing, and what belongs on a board agenda. It is equally clear about the limitations: the authoring gap, the people problem, the ISO/IEC 27001 licensing barrier, the softer regulatory signal than many claim, and the absence of any independent measurement of return.
 
You will find:
A one-page “OSCAL at a glance”
Ten questions a board should ask
A twelve-question vendor checklist that eliminates most of the field
A ninety-day pilot sized to produce a decision, not a programme
A readiness self-assessment you can run in a single meeting
Honest workarounds for the frameworks that still have no lawful free catalog
 
Written for directors, CISOs, risk heads and the people who will actually have to do the work. Free to download, circulate and use as the basis of a board paper.
 
If it saves you one expensive conversation with a vendor or one premature platform purchase, it has done its job.