Proposal for documenting CAM catalog in OSCAL

[mosi-k-platt]

I wanted to present this to the working group the first week of February, but I need to push that date back (probably to the end of the month). Here are slides and mapping doc I'm working on. I will add a JSON example. I asked a member of the NIST OSCAL team to review and provide their feedback. Next week, I am meeting with Anil Karmel, CSA DC chapter president and CEO of RegScale (a compliance automation platform vendor), and Greg Elin, RegScale Principal Engineer for OSCAL. I hope to get one of them to agree to join me at a working group meeting for a discussion. The next NIST OSCAL community meeting is Feb. 16th. I want to get feedback there, too.

[mosi-k-platt]

The Secure Control Framework (SCF) was published in OSCAL. The Security Metrics Reporting Model for the SCF could be a a potential use case for the CAM catalog in OSCAL. I will reach out to the SCF community on Discord to see if there is any interest there.