Research & tooling · compliance engineering
OSCAL
Make security requirements easier to connect, trace, and use.
From documents to structured knowledge
My OSCAL work explores how machine-readable security content can reduce the effort small defense industrial base organizations spend understanding and implementing CMMC requirements.
The work includes catalogs, profiles, source provenance, pinned source hashes, and validation tooling. It connects control language with the assessment and implementation material people need to act on it.
The engineering discipline
Traceability matters: a local conversion must be distinguishable from an upstream publication, and a repaired reference must remain explainable. Schema and reference checks help find structural problems; they do not establish that a client has implemented a control or passed an assessment.
Current focus
This is ongoing research and tooling development. I’m exploring ways to make compliance content more usable while preserving its source and limits.