Smart OSCAL conversion
Word, Excel, and FedRAMP SSPs into validated, machine-readable OSCAL.
OscalIQ is a smart OSCAL converter. It reads your existing System Security Plan - narrative, tables, copy-pasted control language and all - extracts the control implementations, parameters, and responsible roles, and maps them to the NIST OSCAL model as validated JSON, XML, or YAML. Then it keeps that OSCAL living as your system changes, so conversion is the start of a workflow, not a one-off document exercise.
How the conversion works
Upload
Drop in a legacy Word or Excel document - an SSP, a control-implementation workbook, or a FedRAMP template.
Extract
OscalIQ reads control implementations, parameters, and responsible roles out of the narrative and tables, and maps them to the OSCAL model.
Validate
The result is checked against the NIST OSCAL constraints so what you export actually parses - no hand-written XML or JSON.
Keep it living
Maintain the OSCAL as your system changes and export any time, instead of re-converting a document every cycle.
OSCAL conversion FAQ
What is an OSCAL converter?
An OSCAL converter takes security documentation that lives in a human format - a Word or Excel System Security Plan, a control-implementation workbook, a FedRAMP template - and expresses the same information as OSCAL: NIST's Open Security Controls Assessment Language, a set of machine-readable formats (JSON, XML, YAML) for SSPs, catalogs, baselines, assessment plans and results, and POA&Ms. OscalIQ is an OSCAL converter that also keeps the result living rather than producing a one-off file.
What does "smart" OSCAL conversion mean?
The hard part of converting to OSCAL is not writing JSON - it is pulling discrete control statements, parameter values, and responsible roles out of prose and tables and mapping them to the right OSCAL fields with stable identifiers. OscalIQ does that extraction and mapping for you, validates the output, and can optionally use your own AI model to translate cryptic control and STIG language into plain English. The AI is off by default and only ever sees the public standard's requirement text, never your SSP content.
Which formats can I convert to OSCAL?
OscalIQ ingests legacy Word (.docx) and Excel (.xlsx) System Security Plans and control workbooks - including FedRAMP templates - and produces validated OSCAL you can export as JSON, XML, or YAML.
Is there a free way to convert to OSCAL?
NIST and GSA publish open-source OSCAL tooling and official templates, and they are a genuine starting point. But they largely assume your content is already structured and mapped; they do not read an arbitrary narrative SSP and produce valid OSCAL. OscalIQ is built for exactly that gap - reading real, messy documents and producing validated OSCAL.
Do I have to convert again every audit?
No - that is the point. OscalIQ keeps your SSP as living OSCAL you maintain as the system evolves, so you convert once and export current OSCAL any time, rather than re-converting a Word file under deadline each cycle.
New to this? Read the guide: How to Convert a Word SSP to OSCAL.