OSCAL Validator Skill

Validate OSCAL documents against NIST schemas and perform structural integrity checks to ensure compliance data quality.

When to Use This Skill

Use this skill when you need to:

Verify an OSCAL document is properly formatted
Check for missing required fields
Validate UUIDs and cross-references
Ensure metadata completeness
Identify structural issues before further processing

✅ Data Source Principle

This skill validates documents you provide against structural rules and OSCAL schema requirements. Validation logic is safe — it checks format and syntax, not compliance content.

Note: For baseline completeness validation (e.g., "does this SSP cover all FedRAMP Moderate controls?"), you must also provide the baseline profile/catalog.

Validation Severity Levels

| Level | Meaning | Action Required | |-------|---------|-----------------| | ERROR | Document is invalid | Must fix before use | | WARNING | Potential issues | Should review | | INFO | Suggestions | Optional improvements |

Validation Rules

Structure Validation (STRUCT)

| Rule | Description | |------|-------------| | STRUCT-001 | Document must not be empty or null | | STRUCT-002 | Document must have a root element | | STRUCT-003 | Root element must be a valid OSCAL model type |

Metadata Validation (META)

| Rule | Description | |------|-------------| | META-001 | Metadata section is required | | META-002 | Title is required | | META-003 | Last-modified timestamp is required | | META-004 | Version is required | | META-005 | OSCAL version should match current spec |

UUID Validation (UUID)

| Rule | Description | |------|-------------| | UUID-001 | Document UUID must be present | | UUID-002 | UUIDs must be valid RFC 4122 format | | UUID-003 | UUIDs must be unique within document |

Reference Validation (REF)

| Rule | Description | |------|-------------| | REF-001 | Internal references must resolve | | REF-002 | Control references must exist | | REF-003 | Party references must resolve |

How to Validate an OSCAL Document

Step 1: Check Basic Structure

Verify document is not empty
Confirm root element exists
Validate root element is a valid OSCAL type

Step 2: Validate Metadata

Check for required metadata section
Verify title is present and non-empty
Confirm last-modified is valid ISO timestamp
Check version is present
Validate oscal-version matches expected format

Step 3: Validate UUIDs

Check document-level UUID exists
Validate UUID format (8-4-4-4-12 hexadecimal)
Build list of all UUIDs
Check for duplicates

Step 4: Validate References

Find all internal references (e.g., #uuid-value)
Verify each reference resolves to existing element
Check control-id references against imported catalogs
Validate party-uuid references

Step 5: Model-Specific Validation

For Catalogs:

Groups should have controls
Controls should have statements
Parameters should have values or selections

For SSPs:

Import-profile must reference valid profile
System-characteristics must include system-ids
Control-implementation must address all imported controls

For Component Definitions:

Components must have titles
Control implementations must reference valid controls

Validation Report Format

Provide validation results as:

VALIDATION REPORT
=================
Document: [filename]
Model Type: [type]
Valid: [YES/NO]

Issues Found:
- [SEVERITY] [RULE-ID]: [Message] at [location]

Summary:
- Errors: X
- Warnings: Y
- Info: Z

Common Issues and Fixes

| Issue | Cause | Fix | |-------|-------|-----| | Missing metadata | Incomplete document | Add required metadata section | | Invalid UUID | Malformed identifier | Generate new RFC 4122 UUID | | Unresolved reference | Broken link | Update reference or add target | | Missing timestamp | Incomplete metadata | Add ISO 8601 timestamp |

Example Usage

When asked "Validate this SSP for compliance":

Parse the document
Run all validation checks
Collect issues by severity
Report findings with specific locations
Provide actionable fix recommendations