OSCAL

The Open Security Controls Assessment Language (OSCAL) is a standardized, machine-readable format for representing security control information. Developed by NIST, OSCAL allows security plans, assessment results, and control catalogs to be expressed in structured data formats (JSON, XML, YAML) rather than Word documents and spreadsheets.

OSCAL is designed to automate much of the compliance documentation burden. Instead of manually creating and updating security plans, you can maintain machine-readable artifacts that tools can process, validate, and report on automatically.