What is OSCAL?
OSCAL — the Open Security Controls Assessment Language — is a NIST-published machine-readable schema for security control catalogs, baselines, System Security Plans, assessment plans, and assessment results. It is XML and JSON, designed so that compliance artifacts can be authored, exchanged, and consumed programmatically instead of as PDFs and Word documents that humans have to re-key. For CMMC, OSCAL is the bridge between the human-readable artifacts your C3PAO reviews and the DoD acquisition systems that ingest them.
Why OSCAL matters for CMMC
The DoD acquisition stack is moving toward OSCAL-native ingestion. eMASS, prime contractor portals, and the next generation of DIBCAC tooling are increasingly designed to consume OSCAL JSON rather than PDF or Word. A platform that emits OSCAL today interoperates with those systems immediately; a platform that emits PDF only is a platform you will have to replace in 24 months as the regulatory and tooling stack moves underneath it.
OSCAL also makes the assessment auditable in ways PDFs cannot. Every control statement, every assessment objective, every finding, every piece of evidence carries a structured identifier — so a reviewer or a downstream system can trace any line in the SAR back to the source without re-parsing prose.
OSCAL models relevant to CMMC
- Catalog. The control catalog itself — NIST SP 800-171 in OSCAL form.
- Profile / Baseline. The CMMC Level 2 baseline derived from the catalog.
- System Security Plan (SSP). Your SSP expressed against the baseline — system characteristics, control implementations, evidence references.
- Assessment Plan (AP). The plan a C3PAO follows for your assessment.
- Assessment Results (AR). The findings — POA&M items, observations, the SAR — emitted in machine-readable form.
- POA&M. The Plan of Action & Milestones, structured per item with milestones, owners, and evidence.
What Athena's OSCAL output includes
- SSP exported as OSCAL JSON against the NIST SP 800-171 baseline.
- POA&M exported as OSCAL Assessment Results with per-item milestones and closure evidence.
- Assessment Results bundle containing the SAR findings and observations.
- Cryptographic provenance embedded in the OSCAL metadata — SHA-256 hashes, snapshot IDs, reviewer attribution.
- Validation against the published OSCAL schema before export.
- Bundled alongside human-readable artifacts in the eMASS submission package.
OSCAL in the assessment workflow
OSCAL is not a separate workflow — it is a side-effect of doing the rest of CMMC automation correctly. Once the platform tracks evidence at the 320-objective level, drives SSP automation from real evidence, manages the POA&M from open objectives, and calculates the SPRS score live, OSCAL export is just a serialization of the same data. The workflow automation pillar shows the end-to-end picture.