https://anaivebidder.com/tags/oscal/Recent content in OSCAL on A naive bidderen-usWed, 30 Sep 2026 00:00:00 +0000https://anaivebidder.com/posts/compliance-with-standards/Wed, 30 Sep 2026 00:00:00 +0000Ruben Afonsohttps://anaivebidder.com/posts/compliance-with-standards/<p>In the previous post, <a href="https://anaivebidder.com/posts/towards-repeatable-compliance/">Towards Repeatable Compliance</a>, we explored the basics of a generic framework to define compliance requirements, extract controls and execute them as part of a deterministic verification set.</p> <p>That is useful on its own, but we can do better by aligning each of the components involved with industry standards, gaining better integration and reusing existing patterns.</p> <p>This post starts from <a href="https://www.govinfo.gov/content/pkg/PLAW-107publ204/pdf/PLAW-107publ204.pdf">SOX</a> regulation, and introduces a well-known governance framework (<a href="https://www.coso.org/guidance-on-ic">COSO</a>), a set of controls (<a href="https://securecontrolsframework.com/">SCF</a>) and a standard format for expressing findings (NIST&rsquo;s <a href="https://pages.nist.gov/OSCAL/">OSCAL</a>).</p>