Consider using OSCAL or OpenCRE to advertise control/requirements mapping

[SecurityCRob]

There are a few groups seeking to express security requirements/controls/criteria in a machine-readable format. At some point we should talk about possibly using:
OSCAL

• https://pages.nist.gov/OSCAL/
  OpenCRE
• https://www.opencre.org/

[xee5ch]

Hello, founding member of the OSCAL Club, a.k.a Self-Appointed Treehouse Manager. 👋 I am happy to advise or pitch in on the OSCAL front. Let me know how I can be of service.

[JonZeolla]

Also happy to contribute here - I'm focused on automating compliance/assurance and have been working on similar things in the CNCF for the past few years