Fast, Lean, Precise, Controlled: Compliance Automation With OSCAL in Our Open-S...
summary
Claims a concrete, developer‑centric pipeline: requirements from NIST/BSI and SSDLC become OSCAL as data, stored in GitHub, linked to components and Jira tickets, validated by OSCAL tools and surfaced in an OSCAL viewer and dashboards. CI/CD scripts plus AI agents parse prose statements, run daily scans and tests, and feed continuous monitoring so audits (formerly 3–6 weeks of panic) are always ready. Real cases include transforming license/SSDLC catalogs, mapping a 17‑item risk list to controls, and running live compliance checks for published OSS projects.
AI-written summary · about
chapters (6)
- 0:00Introduction and challenges
- 10:24Introducing OSCAL
- 17:06OSCAL layers and governance
- 21:49OSCAL for open source compliance
- 26:22Real cases and automation
- 28:51Summary and benefits
related talks
35mOSCAR - Automate software analysis, compliance and security
15mShifting Open Source Compliance Activities Left
33mORT Automate compliance using Open Source & InnerSource
28mSimplifying Global Compliance for CNCF Projects With the OpenSSF OSPS Baseline
33mAI-Powered Open Source Risk Management: ISO Self-Certification Kit and 5-Level AI Coding Guide
36mPolicy To Pipeline: How OSPOs Can Power Regulatory Readines...
45mAgile Alchemy: Balancing Flexibility and Compliance in Software Development
18mExploration of Compliance Governance Based on Operating Systems