Lion Cipher Lab
Compliance as code: author and validate an OSCAL document
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
For decades, compliance evidence has lived in Word documents and Excel spreadsheets — a 300-page System Security Plan no tool can read, a control matrix that is out of date the week after it is signed, evidence that has to be re-typed for every audit. OSCAL is NIST's answer: express control catalogs, baselines, plans and results as structured, machine-readable data instead of prose, so a document becomes something software can validate, diff, and reuse. This is the concrete meaning of 'compliance as code' and 'GRC-as-code', and it is exactly the direction FedRAMP's modernization ('FedRAMP…
What you'll learn
- Explaining what OSCAL is and why 'compliance as code' matters, from zero
- Naming the OSCAL model layers (Catalog, Profile, Component Definition, SSP, SAP, SAR, POA&M) and mapping them to RMF documents
- Hand-authoring a small, valid OSCAL JSON document with correct top-level structure
- Validating an OSCAL document against the official JSON Schema with a standard validator
- Reading a schema validation error, breaking a document on purpose, and fixing it
- Judging when a Word/Excel SSP is fine and when machine-readable compliance pays off
Steps in this lab
- What OSCAL is, in plain language
- The OSCAL model layers — and how they map to documents you already know
- Set up: install a validator and grab the official schema
- Understand the top-level shape every OSCAL document shares
- Hand-author a small, valid OSCAL component-definition
- Validate it — and see what a PASS looks like
- Break it on purpose — and see what a validation ERROR looks like
- Optional: try a purpose-built OSCAL tool (follow its current README)
- When compliance-as-code pays off, when a Word SSP is still fine, and how a pro does it better
- What you just did — and why it's rare