Kudo adapted to OSCAL
Adaptation of the Kudo framework to OSCAL (Open Security Controls Assessment Language)
Kudo Framework
| Element | Count |
|---|---|
| Domains | 8 |
| Controls | 35 |
| Requirements | 491 |
What is OSCAL?
OSCAL (Open Security Controls Assessment Language) is a set of formats developed by NIST (National Institute of Standards and Technology) that standardizes how information about information system security controls is expressed, assessed and exchanged.
OSCAL formats
OSCAL supports three formats: json, xml and yaml.
With Kudo we also generate an export in: toon.
Kudo-OSCAL integration
The Kudo framework is designed to be compatible with OSCAL, providing a practical implementation of security controls expressed in the 7 main components of the OSCAL model:
Catalog
Catalog of the Kudo framework's security controls structured according to the OSCAL model
Profile
Implementation profile that defines the specific selection and configuration of Kudo controls
Component Definition
Definition of system components and their control implementations according to the OSCAL model
System Security Plan (SSP)
Comprehensive system security plan documenting the implementation of controls according to the Kudo framework
Assessment Plan (AP)
OSCAL-based security control assessment plan to validate the implementation of Kudo controls
Assessment Results (AR)
Results of the Kudo security control assessment documented according to OSCAL standards
Plan of Actions & Milestones (POA&M)
Corrective action plan and schedule to remediate deficiencies identified in security controls
Reference
Adapting Kudo to OSCAL is a collaborative project. To contribute:
- Check our GitHub repository
- Review NIST's OSCAL standards