SecBaseline
About
prose → oscal

AI-assisted extraction

The assistant extracts structure from prose with provenance and confidence. It never invents OSCAL content — missing fields are flagged as gaps.

Loaded deterministic baseline. Click Extract to call Lovable AI.
Target model

Prose input

paste a control narrative, POA&M, or system description

Extracted OSCAL draft

SSP · oscal 1.1.2

control-idai · 98%
Matched "AC-2" in heading.
by-component.componentai · 82%
Prose mentions "API gateway" — matched to component Acme API Gateway.
by-component.descriptionai · 70%
First narrative paragraph.
props.account-typesai · 90%
Extracted from: "privileged administrators"
props.approval-processai · 85%
Prose: "New accounts require manager approval through our ticketing system".
props.review-frequencyneeds information
⚠ needs information
End-user account review frequency is explicitly unfinalized in source prose. Required by ac-2(j).
responsible-rolesneeds information
⚠ needs information
Responsible role / party UUID for ac-2 not present in prose; required for OSCAL responsible-roles.

Assembled implemented-requirement (preview)

json · will be embedded into control-implementation.implemented-requirements

1{
2  "uuid": "<assign on save>",
3  "control-id": "ac-2",
4  "statements": [
5    {
6      "statement-id": "ac-2_smt.a",
7      "uuid": "<assign on save>",
8      "by-components": [
9        {
10          "component-uuid": "<select component>",
11          "uuid": "<assign on save>",
12          "description": "Acme operates a SaaS platform on AWS GovCloud. The platform supports three account\ntypes: privileged administrators, service accounts used by automation, and end-user\naccounts for agency staff. Account types are defined in our IAM policy and enforced\nat the API gateway component.",
13          "props": [
14            {
15              "name": "account-types",
16              "value": "privileged administrators"
17            },
18            {
19              "name": "approval-process",
20              "value": "Manager approval via ticketing system prior to provisioning."
21            }
22          ]
23        }
24      ]
25    }
26  ]
27}

Schema check before save

ssp · 1.1.2

2 schema errors1 warnings
  • $.system-security-plan.system-characteristics.system-ids
    SSPs must include at least one system identifier (e.g. a FedRAMP package ID) under system-characteristics.system-ids.
  • $.system-security-plan.system-implementation.components
    An SSP must list at least one component under system-implementation.components.

Draft cannot be saved as valid until all schema errors are resolved. Fill in the system-characteristics fields and at least one component to clear them.