Automating the CIS Controls with OSCAL

In the face of complex and ever-changing cybersecurity threats and compliance demands, organizations often find themselves burdened by time-consuming, manual processes for documenting and assessing security controls. This manual approach can lead to inefficiencies, inconsistencies, and delays in demonstrating compliance and managing risk. NIST's Open Security Controls Assessment Language (OSCAL) can help. 

The Value of OSCAL

OSCAL is a standardized, data-centric framework designed for documenting and assessing the security controls of information systems. Currently, security controls and their baselines are often in proprietary formats. This leads to laborious data conversion and manual efforts to describe their implementation. OSCAL aims to change this by moving toward machine-readable formats like XML, JSON, and YAML.OSCAL provides the platform to convert control catalogs, system security plans (SSPs), and assessments into machine-readable formats.

• Easily access control information from catalogs and other security documentation.
• Significantly reduce the administrative burden of maintaining manual documentation.
• Focus on the critical aspects of security rather than tedious administrative tasks.

OSCAL tackles the problem of manually creating documentation and can result in accelerating the Authority to Operate (ATO) process. FedRAMP has already started to accept authorization deliverables using OSCAL.

OSCAL Automates Version Updates 

OSCAL also helps to automate mappings and streamline the transition between different framework versions. This is particularly valuable for organizations grappling with compliance across multiple frameworks. Many organizations do not have the luxury of following just one or two frameworks in this diverse ecosystem of security and technology.

The good news is that significant overlap exists between many of these frameworks. This is where the power of mappings becomes evident. The Center for Internet Security (CIS) provides mappings to over 25 different frameworks, offering assistance for managing a Governance, Risk, and Compliance (GRC) program. 

As OSCAL gains adoption in the marketplace, it enables organizations to to navigate the complexities of multi-framework compliance with greater efficiency. For example, a GRC tool vendor could import mappings into their tooling automatically, then allow end-organizations to cross-reference those mappings easily within a platform, as compared to within a spreadsheet. 

CIS Critical Security Controls + OSCAL

CIS is actively embracing OSCAL. Our commitment centers on facilitating the automation of the CIS Controls catalog and the intricate mapping process for both our valued users and product vendors. Currently, the CIS Controls OSCAL Repository provides OSCAL serializations for both v8 and v8.1 of the CIS Critical Security Controls. This means that the prescriptive, prioritized cybersecurity best practices outlined in the CIS Controls are now available in a standardized, machine-readable format that can be integrated into your end-users and product vendors' own tooling.