AI Governance Engineer
GitHub

OSCAL

By Updated

The Open Security Controls Assessment Language, a NIST machine-readable format for controls, assessments and evidence, used here as the format for audit-ready evidence 1.

Developed in
ch. 05, Pattern: Machine-Readable Evidence (OSCAL)
Chapters
ch. 04, The Stack · ch. 05, Patterns · ch. 10, Reading List
Source
1 numbered reference, listed below

Where it is used

15 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

OSCAL: mentions per chapter32 mentions of the term across 15 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter03 Values & Principles: 2 mentions03 Values & Principles204 The Stack: 8 mentions04 The Stack805 Patterns: 2 mentions05 Patterns206 The Role: 3 mentions06 The Role307 Maturity Model: 1 mention07 Maturity Model108 Regulatory Map: 1 mention08 Regulatory Map110 Reading List: 4 mentions10 Reading List411 AI Defined: 2 mentions11 AI Defined212 Governance Program: 1 mention12 Governance Program113 Risk Management: 1 mention13 Risk Management114 Development: 2 mentions14 Development216 Fairness & XAI: 1 mention16 Fairness & XAI117 Incidents: 1 mention17 Incidents120 Existing Law: 1 mention20 Existing Law122 Principles & Standards: 2 mentions22 Principles & Standards2No mentions in the other 8 chaptersSource: the Body of Knowledgev0.5.0
OSCAL: mentions per chapter32 mentions of the term across 15 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter00010203 Values & Principles: 2 mentions20304 The Stack: 8 mentions80405 Patterns: 2 mentions20506 The Role: 3 mentions30607 Maturity Model: 1 mention10708 Regulatory Map: 1 mention10810 Reading List: 4 mentions41011 AI Defined: 2 mentions21112 Governance Program: 1 mention11213 Risk Management: 1 mention11314 Development: 2 mentions2141516 Fairness & XAI: 1 mention11617 Incidents: 1 mention117181920 Existing Law: 1 mention1202122 Principles & Standards: 2 mentions22223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of OSCAL per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition0No
02 Why Now0No
03 Values & Principles2No
04 The Stack8Yes
05 Patterns2Yes
06 The Role3No
07 Maturity Model1No
08 Regulatory Map1No
10 Reading List4Yes
11 AI Defined2No
12 Governance Program1No
13 Risk Management1No
14 Development2No
15 Deployment0No
16 Fairness & XAI1No
17 Incidents1No
18 EU AI Act0No
19 Privacy & AI0No
20 Existing Law1No
21 AI Laws Worldwide0No
22 Principles & Standards2No
23 AI Agents0No

Patterns that use this term

12 pattern pages use the term; the 10 that use it most:

OSCAL: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedColour: stack layer of the pattern01 Govern-as-Code02 Inventory03 Evals05 AssuranceOSCALRelated terms (3)Audit-ready evidence · RelatedAudit-ready evidenceJSON Schema · RelatedJSON SchemaMachine-readable evidence · RelatedMachine-readable evidencePatterns using it most (6)AIBOM, 1 mention · Uses the termAIBOMEval Gate in CI, 1 mention · Uses the termEval Gate in CIFramework Crosswalk, 2 mentions · Uses the termFramework CrosswalkMachine-Readable Evidence (OSCAL), 9 mentions · Uses the termMachine-Readable EvidenceModel Card as Control Evidence, 1 mention · Uses the termModel Card as Control EvidencePolicy Card, 1 mention · Uses the termPolicy Card
OSCAL: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedColour: stack layer of the pattern01 Govern-as-Code02 Inventory03 Evals05 AssuranceRelated terms (3)Audit-ready evidence · RelatedAudit-ready evidenceJSON Schema · RelatedJSON SchemaMachine-readable evidence · RelatedMachine-readable evidencePatterns using it most (6)AIBOM, 1 mention · Uses the termAIBOMEval Gate in CI, 1 mention · Uses the termEval Gate in CIFramework Crosswalk, 2 mentions · Uses the termFramework CrosswalkMachine-Readable Evidence (OSCAL), 9 mentions · Uses the termMachine-Readable EvidenceModel Card as Control Evidence, 1 mention · Uses the termModel Card as Control EvidencePolicy Card, 1 mention · Uses the termPolicy CardOSCAL
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of OSCAL
FamilyItemRelation
Related termsAudit-ready evidenceRelated
Related termsJSON SchemaRelated
Related termsMachine-readable evidenceRelated
Patterns using it mostAIBOM, 1 mentionUses the term
Patterns using it mostEval Gate in CI, 1 mentionUses the term
Patterns using it mostFramework Crosswalk, 2 mentionsUses the term
Patterns using it mostMachine-Readable Evidence (OSCAL), 9 mentionsUses the term
Patterns using it mostModel Card as Control Evidence, 1 mentionUses the term
Patterns using it mostPolicy Card, 1 mentionUses the term
  • JSON Schema

    A vocabulary for describing the structure of JSON documents so a validator can check them: which fields exist, which are required, their types and allowed…

  • Machine-readable evidence

    Evidence a machine can query, diff and aggregate (OSCAL artefacts, structured eval results, signed logs), as opposed to screenshots and exported spreadsheets.

  • Audit-ready evidence

    Evidence emitted as a by-product of the build in a form an auditor can read directly (machine-readable, signed, timestamped), so the audit is a query, not a…

Sources

  1. [1] NIST AI Risk Management Framework 1.0 (Govern, Map, Measure, Manage); OSCAL. NIST. 2023. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). OSCAL. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/oscal. CC BY 4.0

BibTeX

@misc{aige2026oscal,
  author  = {Jorge García Aibar},
  title   = {{OSCAL}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/oscal}
}