OSCAL Validator Skill

Validate OSCAL documents against NIST schemas and perform structural integrity checks to ensure compliance data quality.

When to Use This Skill

Use this skill when you need to:

• Verify an OSCAL document is properly formatted
• Check for missing required fields
• Validate UUIDs and cross-references
• Ensure metadata completeness
• Identify structural issues before further processing

✅ Data Source Principle

This skill validates documents you provide against structural rules and OSCAL schema requirements. Validation logic is safe — it checks format and syntax, not compliance content.

Note: For baseline completeness validation (e.g., "does this SSP cover all FedRAMP Moderate controls?"), you must also provide the baseline profile/catalog.

Validation Severity Levels

Validation Rules

Structure Validation (STRUCT)

Metadata Validation (META)

UUID Validation (UUID)

Reference Validation (REF)

How to Validate an OSCAL Document

Step 1: Check Basic Structure

1. Verify document is not empty
2. Confirm root element exists
3. Validate root element is a valid OSCAL type

Step 2: Validate Metadata

1. Check for required metadata section
2. Verify title is present and non-empty
3. Confirm last-modified is valid ISO timestamp
4. Check version is present
5. Validate oscal-version matches expected format

Step 3: Validate UUIDs

1. Check document-level UUID exists
2. Validate UUID format (8-4-4-4-12 hexadecimal)
3. Build list of all UUIDs
4. Check for duplicates

Step 4: Validate References

1. Find all internal references (e.g., #uuid-value)
2. Verify each reference resolves to existing element
3. Check control-id references against imported catalogs
4. Validate party-uuid references

Step 5: Model-Specific Validation

For Catalogs:

• Groups should have controls
• Controls should have statements
• Parameters should have values or selections

For SSPs:

• Import-profile must reference valid profile
• System-characteristics must include system-ids
• Control-implementation must address all imported controls

For Component Definitions:

• Components must have titles
• Control implementations must reference valid controls

Validation Report Format

Provide validation results as:

VALIDATION REPORT
=================
Document: [filename]
Model Type: [type]
Valid: [YES/NO]

Issues Found:
- [SEVERITY] [RULE-ID]: [Message] at [location]

Summary:
- Errors: X
- Warnings: Y
- Info: Z

Common Issues and Fixes

Example Usage

When asked "Validate this SSP for compliance":

1. Parse the document
2. Run all validation checks
3. Collect issues by severity
4. Report findings with specific locations
5. Provide actionable fix recommendations