OSCAL
OSCAL is NIST's machine-readable format (XML or JSON) for security control catalogs, System Security Plans, and Assessment Results, the interchange layer FedRAMP and GRC tools expect. Caisson's Compliance bundle maps each signed evidence pack into OSCAL v1.2.2 Security Assessment Results and Plan-of-Action-and-Milestones documents, bundled alongside a per-framework Assessment Plan and a SHA-256 integrity binding.
In code
const target: OscalFindingTarget =
control.readiness === "ready"
? {
type: "objective-id",
"target-id": control.controlId,
status: { state: "satisfied" },
}
: {
type: "objective-id",
"target-id": control.controlId,
status: { state: "not-satisfied", remarks: gapReason(control) },
};
findings.push({
uuid: newId(),
title: `${control.controlId} — ${control.title}`,
description: control.statement,
target,
"related-observations": related,
});How it holds
Two documents, one mapping
The Security Assessment Results (SAR) gets one finding per control plus one observation per evidence item; the Plan of Action & Milestones (POA&M) gets one poam-item per gap control, referencing only the flagged evidence, a clean pack ships zero GAP poam-items, only a single truthful "no open remediation items" entry, which NIST's OSCAL schema requires (poam-items is min-1).
Deterministic, not generative
The wall-clock now and the UUID source newId are both injected seams (newId defaults to crypto.randomUUID, so raw output is non-deterministic unless a seam is pinned. With the UUID seam pinned, the same evidence pack canonicalizes to byte-identical OSCAL output) the same discipline the signed evidence pack and the WORM audit chain already run on.
Flag-never-guess carries over
A not-satisfied finding's remarks is the flagged evidence's recorded reason (gapReason()), never an inferred explanation, the canonical manifest it maps from has no unresolved evidence by construction.
Bundled and hash-bound, not linked to a dead URL
Caisson authors a real per-framework Assessment-Plan and ships it inside the same signed bundle as the SAR and POA&M, referenced by a relative rlink with a SHA-256 hashes[] binding, replacing an earlier caisson.sh link that was never actually served.