compliance-oscal-validator_skill

Overview

This skill validates OSCAL System Security Plan (SSP) documents across three tiered depths: fast schema checks, profile alignment, and deep cross-reference audits. It accepts JSON, XML, or YAML SSPs, detects OSCAL version, and emits a structured JSON report with actionable errors, warnings, and remediation suggestions. The validator supports strict and permissive modes and records citation and timestamp metadata for auditability.

How this skill works

The validator parses the SSP format, extracts metadata/oscal-version, and selects the appropriate schema for format-specific validation (JSON Schema or XSD). For profile-enabled runs it resolves the profile, compares required controls and parameters to control implementations, and computes a coverage score. For deep audits it validates internal UUID references, component mappings, link integrity, and generates rationale with fix suggestions; strict mode enforces harsher failure rules.

When to use it

• You have an SSP in JSON/XML/YAML and need schema compliance checks.
• Before submitting SSPs for FedRAMP or other compliance reviews.
• Integrating SSP validation into CI/CD or automated compliance pipelines.
• Debugging or QA for tools that author or transform SSP documents.
• When you need tiered validation depth from quick checks to comprehensive audits.

Best practices

• Ensure ssp_path is reachable and uses HTTPS for remote files; check read permissions for local files.
• Specify profile only when you require control alignment; otherwise use Tier 1 for speed.
• Use strict=true for pre-submission audits and strict=false for iterative authoring.
• Keep OSCAL schema versions pinned; warn if document version is outside supported range.
• Sanitize outputs to avoid leaking directory paths or secrets in reports.

Example use cases

• Tier 1: Quick schema validation of a generated my-ssp.json before commit.
• Tier 2: Validate SSP against an agency profile to identify missing control implementations and parameter gaps.
• Tier 3: Full audit for a FedRAMP package including component cross-reference validation and link/url integrity checks.
• CI pipeline gate: run Tier 1 on pull requests and escalate to Tier 2/3 on release builds.
• Authoring tool debug: surface first three schema errors to speed up fixes.