convert format

JSON ↔ XML ↔ YAML

Lossless format conversion per the OSCAL specification. Result is validated against the schema.

Source

auto-detect json / xml / yaml

parsed

{
  "system-security-plan": {
    "uuid": "11111111-2222-3333-4444-555555555555",
    "metadata": {
      "title": "Acme Federal System — System Security Plan",
      "last-modified": "2026-06-01T00:00:00Z",
      "version": "1.0.0",
      "oscal-version": "1.1.2",
      "parties": [
        {
          "uuid": "p-1",
          "type": "organization",
          "name": "Acme Federal, Inc."
        }
      ]
    },
    "import-profile": {
      "href": "#fedramp-moderate-baseline"
    },
    "system-characteristics": {
      "system-ids": [
        {
          "id": "ACME-FED-001",
          "identifier-type": "https://fedramp.gov"
        }
      ],
      "system-name": "Acme Federal System",
      "description": "Multi-tenant SaaS providing case-management workflows to federal agencies.",
      "security-sensitivity-level": "moderate",
      "system-information": {
        "information-types": [
          {
            "uuid": "it-1",
            "title": "Case records",
            "description": "PII case management records."
          }
        ]
      },
      "security-impact-level": {
        "security-objective-confidentiality": "moderate",
        "security-objective-integrity": "moderate",
        "security-objective-availability": "low"
      },
      "status": {
        "state": "operational"
      },
      "authorization-boundary": {
        "description": "All Acme-managed components in AWS GovCloud (us-gov-west-1)."
      }
    },
    "system-implementation": {
      "users": [],
      "components": [
        {
          "uuid": "c-1",
          "type": "software",
          "title": "Acme API Gateway",
          "description": "Edge API gateway terminating TLS and enforcing authn/authz.",
          "status": {
            "state": "operational"
          }
        },
        {
          "uuid": "c-2",
          "type": "service",
          "title": "AWS RDS (PostgreSQL)",
          "description": "Encrypted-at-rest managed PostgreSQL instance for case data.",
          "status": {
            "state": "operational"
          }
        }
      ]
    },
    "control-implementation": {
      "description": "Implementation narratives for the FedRAMP Moderate baseline.",
      "implemented-requirements": [
        {
          "uuid": "ir-ac-2",
          "control-id": "ac-2",
          "statements": [
            {
              "statement-id": "ac-2_smt.a",
              "uuid": "ir-ac-2-a",
              "by-components": [
                {
                  "component-uuid": "c-1",
                  "uuid": "ir-ac-2-a-c1",
                  "description": "Account types (privileged, service, end-user) are defined in the IAM policy and enforced at the API gateway."
                }
              ]
            }
          ]
        }
      ]
    }
  }
}

Target

output · yaml

1system-security-plan:
2  uuid: "11111111-2222-3333-4444-555555555555"
3  metadata:
4    title: Acme Federal System — System Security Plan
5    last-modified: "2026-06-01T00:00:00Z"
6    version: 1.0.0
7    oscal-version: 1.1.2
8    parties:
9      -
10        uuid: "p-1"
11        type: organization
12        name: Acme Federal, Inc.
13  import-profile:
14    href: "#fedramp-moderate-baseline"
15  system-characteristics:
16    system-ids:
17      -
18        id: "ACME-FED-001"
19        identifier-type: "https://fedramp.gov"
20    system-name: Acme Federal System
21    description: "Multi-tenant SaaS providing case-management workflows to federal agencies."
22    security-sensitivity-level: moderate
23    system-information:
24      information-types:
25        -
26          uuid: "it-1"
27          title: Case records
28          description: PII case management records.
29    security-impact-level:
30      security-objective-confidentiality: moderate
31      security-objective-integrity: moderate
32      security-objective-availability: low
33    status:
34      state: operational
35    authorization-boundary:
36      description: "All Acme-managed components in AWS GovCloud (us-gov-west-1)."
37  system-implementation:
38    users:
39[]
40    components:
41      -
42        uuid: "c-1"
43        type: software
44        title: Acme API Gateway
45        description: Edge API gateway terminating TLS and enforcing authn/authz.
46        status:
47          state: operational
48      -
49        uuid: "c-2"
50        type: service
51        title: AWS RDS (PostgreSQL)
52        description: "Encrypted-at-rest managed PostgreSQL instance for case data."
53        status:
54          state: operational
55  control-implementation:
56    description: Implementation narratives for the FedRAMP Moderate baseline.
57    implemented-requirements:
58      -
59        uuid: "ir-ac-2"
60        control-id: "ac-2"
61        statements:
62          -
63            statement-id: "ac-2_smt.a"
64            uuid: "ir-ac-2-a"
65            by-components:
66              -
67                component-uuid: "c-1"
68                uuid: "ir-ac-2-a-c1"
69                description: "Account types (privileged, service, end-user) are defined in the IAM policy and enforced at the API gateway."

result valid against schemasystem-security-plan · oscal 1.1.2

Exports include: OSCAL converted with OSCAL Bridge. Validated against NIST OSCAL schema version 1.1.2. Verify with authoritative OSCAL tooling and against current program requirements before official submission.