Compliance-trestle
Python CLI and SDK for creating, validating, and governing NIST OSCAL compliance artifacts inside Git repositories as versioned code.
Technical Architecture & Overview
Compliance Trestle is a Python command-line tool and SDK maintained by the OSCAL Compass community. It creates, validates, and governs OSCAL-based compliance artifacts inside Git repositories, so teams can manage system security plans, component definitions, and control mappings as code. It runs as part of a CI/CD pipeline and transforms other document formats into OSCAL for downstream enforcement and reporting.
Targeted Technical Use Cases
Teams that need machine-readable FedRAMP, NIST 800-53, or other OSCAL compliance content that can be versioned, reviewed, and validated automatically before submission to assessors.
Evaluation & Trade-offs
Core Strengths
- +Native OSCAL schema support and validation.
- +Git-friendly fragmentation of large compliance documents into manageable files.
- +Python SDK and CLI for CI/CD automation.
Trade-Offs & Limitations
- -Requires OSCAL and regulatory knowledge to use effectively.
- -Does not scan endpoints or generate evidence automatically.
- -Needs integration with other tools for a full GRC workflow.
Defensive Security Application
Validate OSCAL artifacts for schema and content errors before submission and keep control mappings synchronized with code changes to reduce audit risk.
Frequently Asked Questions
What is Compliance-trestle?→
Compliance Trestle is a Python command-line tool and SDK maintained by the OSCAL Compass community. It creates, validates, and governs OSCAL-based compliance artifacts inside Git repositories, so teams can manage system security plans, component definitions, and control mappings as code. It runs as part of a CI/CD pipeline and transforms other document formats into OSCAL for downstream enforcement and reporting.
What is Compliance-trestle used for?→
Teams that need machine-readable FedRAMP, NIST 800-53, or other OSCAL compliance content that can be versioned, reviewed, and validated automatically before submission to assessors.
What are the strengths of Compliance-trestle?→
- +Native OSCAL schema support and validation.
- +Git-friendly fragmentation of large compliance documents into manageable files.
- +Python SDK and CLI for CI/CD automation.
What are the limitations of Compliance-trestle?→
- +Requires OSCAL and regulatory knowledge to use effectively.
- +Does not scan endpoints or generate evidence automatically.
- +Needs integration with other tools for a full GRC workflow.
How is Compliance-trestle used defensively?→
Validate OSCAL artifacts for schema and content errors before submission and keep control mappings synchronized with code changes to reduce audit risk.