Export OSCAL

Export NIST OSCAL (Open Security Controls Assessment Language) JSON from compliance evidence stored in the ArangoDB graph. Supports NIST 800-171 and CMMC Level 2 frameworks.

Usage

Export compliance evidence

./run.sh export --framework NIST-800-171
./run.sh export --framework CMMC-L2

Dry run (no ArangoDB required)

./run.sh export --framework NIST-800-171 --dry-run

Generates a valid OSCAL assessment-results structure with example data. Useful for testing downstream consumers without a running database.

Validate an OSCAL file

./run.sh validate <file.json>

Checks that the JSON file contains required OSCAL assessment-results fields: uuid, metadata, and results.

Output

All output goes to stdout as formatted JSON. Redirect to a file as needed:

./run.sh export --framework NIST-800-171 > oscal-export.json

OSCAL Structure

The exported JSON follows the OSCAL assessment-results model:

• uuid -- unique identifier for this export
• metadata.title -- framework name and export context
• metadata.last-modified -- ISO 8601 timestamp
• metadata.version -- export version
• metadata.oscal-version -- OSCAL specification version
• results[] -- array of assessment results, each mapping a control to evidence
  • uuid -- unique result identifier
  • title -- control identifier and name
  • start -- assessment timestamp
  • findings[] -- evidence entries from QRA and lessons collections

Data Sources

Queries three ArangoDB collections in the sparta database: