Skip to content

Compliance-trestle (also known as trestle)¤

OS Compatibility Python Compatibility pre-commit code-coverage pypi-downloads

Trestle is an ensemble of tools that enable the creation, validation, and governance of documentation artifacts for compliance needs. It leverages NIST's OSCAL as a standard data format for interchange between tools and people, and provides an opinionated approach to OSCAL adoption.

Trestle is designed to operate as a CICD pipeline running on top of compliance artifacts in git, to provide transparency for the state of compliance across multiple stakeholders in an environment friendly to developers. Trestle passes the generated artifacts on to tools that orchestrate the enforcement, measurement, and reporting of compliance.

It also provides tooling to manage OSCAL documents in a more human-friendly manner. By splitting large OSCAL data structures into smaller and easier to edit sub-structures, creation and maintenance of these artifacts can follow normal git workflows including peer review via pull request, versioning, releases/tagging.

Trestle provides three separate but related functions in the compliance space:

  • Manage OSCAL documents to allow editing and manipulation while making sure the schemas are enforced
  • Transform documents from other formats to OSCAL
  • Provide governance for markdown documents and enforce consistency of format and content based on specified templates

Trestle provides tooling to help orchestrate the compliance process across a number of dimensions:

  • Help manage OSCAL documents in a more human-friendly manner by expanding the large OSCAL data structures into smaller and easier to edit sub-structures while making sure the schemas are enforced.
  • Transform documents from other formats to OSCAL
  • Provide governance for markdown documents and enforce consistency of format and content based on specified templates
  • Tooling to manage markdown documents for compliance, including transformation to OSCAL.
  • Support within trestle to streamline management within a managed git environment.
  • An underlying object model that supports developers interacting with OSCAL artefacts.

Why Trestle¤

Compliance suffers from being a complex topic that is hard to articulate simply. It involves complete and accurate execution of multiple procedures across many disciplines (e.g. IT, HR, management) with periodic verification and audit of those procedures against controls.

While it is possible to manage the description of controls and how an organisation implements them in ad hoc ways with general tools (spreadsheets, documents), this is hard to maintain for multiple accreditations and, in the IT domain at least, creates a barrier between the compliance efforts and the people doing daily work (DevOps staff).

Trestle aims to reduce or remove this barrier by bringing the maintenance of control descriptions into the DevOps domain. The goal is to have changes to the system (for example, updates to configuration management) easily related to the controls impacted, and to enable modification of those controls as required in concert with the system changes.

Trestle implicitly provides a core opinionated workflow driven by its pipeline steps to allow standardized interlocks with other compliance tooling platforms.

Machine readable compliance format¤

Compliance activities at scale, whether size of estate or number of accreditations, require automation to be successful and repeatable. OSCAL as a standard allows teams to bridge between the "Governance" layer and operational tools.

By building human managed artifacts into OSCAL, Trestle is not only able to validate the integrity of the artifacts that people generate - it also enables reuse and sharing of artifacts, and furthermore can provide suitable input into tools that automate operational compliance.

Supported OSCAL elements and extensions¤

trestle implicitly supports all OSCAL schemas for use within the object model. The development roadmap for trestle includes adding workflow around specific elements / objects that is opinionated.

trestle supports OSCAL version 1.0.0-rc2 only at this stage. NIST, in pre-1.0.0 continuously updating their current posture. Trestle will be periodically updating to meet NIST's baseline. On the formal release of OSCAL 1.0.0 the strategy for trestle will be revaluated.

In addition to the core OSCAL objects, trestle supports the definition of a target. The target (and its container target-definition) is a generalization of the component model that is designed specifically to support configuration.

catalog and profile objects can define parameters. However, by their nature the parameter definitions are at the regulatory level. The trestle team has seen a need for an object that can define parameters at the control-implemenation level, e.g. component is an implementation and target is the definition of capabilities of the component.

Supported file formats for OSCAL objects.¤

OSCAL supports xml, json and yaml with their metaschema tooling. Trestle natively supports only json and yaml formats at this time.

Future roadmap anticipates that support for xml import and upstream references will be enabled. However, it is expected that full support will remain only for json and yaml.

Users needing to import XML OSCAL artifacts are recommended to look at NIST's XML to json conversion page here.

Python codebase, easy installation via pip¤

Trestle runs on most all python platforms (e.g. Linux, Mac, Windows) and is available on PyPi so it is easily installed via pip. It is under active development and new releases are made available regularly.

Development status¤

Compliance trestle is currently alpha. The expectation is that in ongoing work there may be unnannounced changes that are breaking within the trestle codebase. If you are using trestle please contact us so we are aware your usecase.

The underlying OSCAL schema is also currently changing. Until the formal release of OSCAL 1.0.0, the models in trestle will regularly update to track NIST's changes.

Contributing to Trestle¤

Our project welcomes external contributions. Please consult contributing to get started.

License & Authors¤

If you would like to see the detailed LICENSE click here. Consult contributors for a list of authors and maintainers for the core team.

# Copyright (c) 2020 IBM Corp. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.