Automating Security and Compliance via a new standard-of-standards
summary
OSCAL defines a machine-readable schema for control catalogs and profiles (JSON/XML) mapping NIST SP 800-53, ISO 27001 and COBIT into a common model, enabling toolchains to import catalogs, map profiles like FedRAMP, and run automated checks. Demo shows Docker Enterprise EE with a FIPS-enabled container runtime, an OSCAL proxy storing artifacts in Docker secrets, and a docker compliance audit command that returns OSCAL-format reports (example cluster: 51% access controls, 81% audit controls satisfied). Goal is continuous, platform-neutral assessment and reduced manual labor.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:40Why a scale
- 6:22Agenda
- 7:03Terminology
- 9:03Oskol
- 13:03AA Scale Profile
- 13:37BottomUp Approach
- 14:30Plan Going Forward
- 15:48Long Term Goals
- 16:45AAscale
- 20:51Continuous Compliance
- 24:02NIST cryptographic module
- 25:14AAscale specification
- 26:22Proxy service
- 28:13Audit command
- 29:19Audit report
- 30:54Scale
- 36:32Profiles Baselines
related talks
37mPath To Production: Sustainable Compliance In Strict Environments
22mOSCAL in Action: Real World Examples of Automating Policy & Comp...
43m12 Essential Requirements for Policy Enforcement and Governance with OSCAL
08mTrestle Compliance Collab Platform OS Project + NIST Compliance as Code OSCAL Standard
35mOSCAR - Automate software analysis, compliance and security
29mZero Trust Maturity Assessment With OSCAL
07mZero Trust Visualization
54mCompliance-As-Code For API Security