KYE Protocol™ is OSCAL-native. Every signed evidence pack maps deterministically to NIST OSCAL component-definition, system-security-plan and assessment-results JSON — the same artefacts FedRAMP 3PAOs, DoD eMASS, and enterprise GRC tools (Drata, Vanta, Hyperproof, AuditBoard) already consume.
NIST OSCAL (Open Security Controls Assessment Language) is the machine-readable representation of NIST 800-53, FedRAMP, and increasingly ISO 27001:2022, SOC 2, and CMMC controls. Without an OSCAL bridge, KYE™ evidence packs would need bespoke ingestion in every downstream tool. With it, KYE™ drops in.
Each KYE™ artefact maps 1:1 to an OSCAL document type. The KYE Compliance Mapping Rail™ provides the binding from KYE™ control identifiers (KYE-EUAIACT-001, etc.) to OSCAL control-id values in the relevant catalog. KYE™ control IDs are stable across catalog versions.
component-definition
A KYE™ profile (e.g. kye-payments-1.0) becomes an OSCAL component-definition declaring which NIST 800-53 controls the profile satisfies, with one implemented-requirement per binding and the binding source URN as link.href.
OSCAL ref: component-definition layer →
system-security-plan
The KYE™ entity registry plus its delegation chain produces the system-implementation section of the SSP — component inventory, user/role mapping, authorisation boundaries, data-flow declarations.
OSCAL ref: system-security-plan layer →
assessment-results
A signed KYE™ evidence pack — including decision logs, recovery proofs, and signal-bus telemetry — renders as an OSCAL assessment-results document with one finding per control, evidence linked by URN.
OSCAL ref: assessment-results layer →
assessment-plan
A scheduled KYE™ self-audit run becomes an OSCAL assessment-plan: scope, controls under test, methods, schedule, and signing keys all declared in machine-readable form.
OSCAL ref: assessment-plan layer →
poam
Open recovery requests, unresolved signals, and failed self-audit checks aggregate into a Plan-of-Actions-and-Milestones (POA&M) document — with each item carrying its KYE™ URN and target close date.
OSCAL ref: plan-of-action-and-milestones layer →
profile
A regulator profile (FedRAMP Moderate, NIS2, EU AI Act) becomes an OSCAL profile that selects controls from the relevant catalog and declares parameter values. KYE™ profile mapping rides on top.
OSCAL ref: profile layer →
POST /v1/oscal/export takes an evidence-pack URN, returns OSCAL JSON validated against the upstream schemas.
Conformance: the exporter validates output against NIST’s upstream OSCAL JSON schemas (github.com/usnistgov/OSCAL) before returning. Drift is a hard fail, not a warning.