Notice2024-16381
Community Engagement on the Open Security Controls Assessment Language (OSCAL)
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
July 25, 2024
Issuing agencies
Commerce DepartmentNational Institute of Standards and Technology
Abstract
The National Institute of Standards and Technology (NIST) is seeking to identify stakeholders involved in ongoing or planned activities, including but not limited to standardization, education, and adoption, related to the Open Security Controls Assessment Language (OSCAL).
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 143 (Thursday, July 25, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 143 (Thursday, July 25, 2024)]
[Notices]
[Page 60356]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-16381]
[[Page 60356]]
-----------------------------------------------------------------------
DEPARTMENT OF COMMERCE
National Institute of Standards and Technology
Community Engagement on the Open Security Controls Assessment
Language (OSCAL)
AGENCY: National Institute of Standards and Technology, Department of
Commerce.
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: The National Institute of Standards and Technology (NIST) is
seeking to identify stakeholders involved in ongoing or planned
activities, including but not limited to standardization, education,
and adoption, related to the Open Security Controls Assessment Language
(OSCAL).
DATES: NIST will accept written questions for clarification, comments,
and/or pertinent feedback until 11:59 p.m. Eastern Time on August 8,
2024.
ADDRESSES: Community members involved in ongoing or planned OSCAL-
related efforts can submit written questions for clarification,
comments, and/or pertinent feedback via email to: <a href="/cdn-cgi/l/email-protection#96f9e5f5f7fad6f8ffe5e2b8f1f9e0"><span class="__cf_email__" data-cfemail="d6b9a5b5b7ba96b8bfa5a2f8b1b9a0">[email protected]</span></a> or by
mail to the contact identified below. Submissions via email should
include ``OSCAL Engagement'' in the subject line of the message.
FOR FURTHER INFORMATION CONTACT: Michaela Iorga via email to
<a href="/cdn-cgi/l/email-protection#86e9f5e5e7eac6e8eff5f2a8e1e9f0"><span class="__cf_email__" data-cfemail="f29d8191939eb29c9b8186dc959d84">[email protected]</span></a> or by phone at 301-975-8431, or by mail to National
Institute of Standards and Technology, 100 Bureau Drive, Gaithersburg,
Maryland 20899, Attn: Michaela Iorga, ITL/CSD.
SUPPLEMENTARY INFORMATION:
Background: The Federal Information Security Modernization Act
(FISMA) of 2014 (Pub. L. 113-283, 44 U.S.C. 3554) emphasized the
importance of information security to the economic and national
security interests of the United States. FISMA requires agency heads to
report on the adequacy and effectiveness of their enterprise's
information security policies, procedures, and practices. For two
decades, agencies worked diligently to implement the Office of
Management and Budget (OMB) Circular A-130: ``Managing Information as a
Strategic Resource,'' employing Authorization to Operate (ATO)
processes reliant on paper-based documentation, manual assessment
processes, and non-interoperable proprietary automation processes and
tools that do not support security data portability.
NIST initiated the development of the Open Security Controls
Assessment Language (OSCAL) to support automated (or computer-assisted)
assessment and risk management through operationally sustainable means
and to fill federal, national, and international gaps in security
assessment automation by providing a set of data-centric, regulatory-
agnostic, technical specifications capable of expressing security
information in machine-readable formats (XML, JSON or YAML), in support
of risk management automation.
The NIST OSCAL program has been working with the public to develop
a standardized, open-source, actionable data framework referred to as
OSCAL, OSCAL models, or OSCAL framework, and a service interface and
proof-of-concept tools for representing and exchanging high-fidelity
controls-based IT system risk management data between applications
hosted by multiple organizations. This OSCAL framework, the service
interface, and tools provide the foundation for a high degree of
automation around assessing the underlying system implementation state
and the extent to which this state ensures that security and privacy
controls are implemented and remain effective.
The immediate acceptance and successful international adoption of
the OSCAL framework calls for a long-term NIST vision of OSCAL
evolution and incremental maturity into open-source standards developed
by industry-accepted standards development organizations. OSCAL will
also promote innovation around applying machine learning, robotic
process automation, and new knowledge domains to the IT system risk
management space.
Community Engagement Areas: NIST seeks to identify community
members involved in ongoing or planned activities, including but not
limited to standardization, education, and adoption, related to OSCAL.
Individual and organizational community members with ongoing or planned
activities in these areas may respond to this notice to describe these
activities and inform NIST's planning and coordination efforts across
the OSCAL program.
Exemplary activities could include, but are not limited to, the
following:
<bullet> Assessing OSCAL maturity level readiness for international
standardization. The category could include development of open-source
OSCAL content for community's consumption based on the OSCAL latest
released set of models (7), development of tests or OSCAL content
exercising the latest prototype OSCAL models.
<bullet> Developing enhancements or new OSCAL models as deemed
necessary by the community.
<bullet> Developing OSCAL educational material (tutorials, videos)
for all OSCAL-adoption levels, from novice to advanced.
<bullet> Organizing OSCAL events such as conferences, webinars,
workshops for security experts, assessors, auditors and developers
implementing OSCAL-based solutions.
<bullet> Establishing OSCAL incubators (labs) that will develop
proof of concept implementations (pilots), tools and adoption best
practices guidance.
<bullet> Implementing OSCAL solutions for internal purpose.
<bullet> Implementing OSCAL Governance Risk and Compliance (GRC)
tools.
Authority: 15 U.S.C. 272(b)(10).
Alicia Chambers,
NIST Executive Secretariat.
[FR Doc. 2024-16381 Filed 7-24-24; 8:45 am]
BILLING CODE 3510-13-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on July 25, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.