Compliance Patterns

[xee5ch]

I have been reading a lot of excellent messages, as of late from @mruge with follow-ups from @openprivacy, around how to structure data with OSCAL in repeatable patterns. This goes beyond the basic building blocks of OSCAL 1.0.0 models like catalogs, profiles, and components. It is more about how you structure data inside of them and cross-reference between them.

I feel the conversations continue to refine the idea of design patterns like the Gang of Four in software development, but with how a developer should structure data within the syntax of catalogs, profiles, components and other OSCAL information models. I intend to write on some of those patterns, and hope to get feedback here around building up a pattern library with some useful examples.

Feedback welcome!

[xee5ch]

UPDATE: I started a channel on Gitter for those interested in this topic and trying to build out fuller materials.