---
title: "OSCAL"
description: "The Open Security Controls Assessment Language, a NIST machine-readable format for controls, assessments and evidence, used here as the format for audit-ready evidence."
canonical: https://aigovernanceengineer.com/glossary/oscal
author: "Jorge García Aibar"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)"
doi: https://doi.org/10.5281/zenodo.22956197
version: "0.5.0"
updated: 2026-09-24
---

# OSCAL

The Open Security Controls Assessment Language, a NIST machine-readable format for controls, assessments and evidence, used here as the format for audit-ready evidence [1].

- Developed in: [ch. 05, Pattern: Machine-Readable Evidence (OSCAL)](https://aigovernanceengineer.com/bok/patterns#pattern-machine-readable-evidence-oscal)
- Chapters: [ch. 04, The Stack](https://aigovernanceengineer.com/bok/the-stack) · [ch. 05, Patterns](https://aigovernanceengineer.com/bok/patterns) · [ch. 10, Reading List](https://aigovernanceengineer.com/bok/reading-list)
- In the glossary chapter: https://aigovernanceengineer.com/bok/glossary#t-oscal

## Sources

[1] NIST AI Risk Management Framework 1.0 (Govern, Map, Measure, Manage); OSCAL. NIST. 2023. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)