Ask about or tell us how you can Metaschema outside of OSCAL!

[aj-stein-nist]

Greetings from the NIST mothership! The NIST team would like to hear more about any outsiders (i.e. not NIST staff) using Metaschema for any new or unique modeling domain, not only OSCAL. We want to hear different ways you Metaschema outside of OSCAL to develop and maintain XML Schema, JSON Schema, or maybe alternative instances with Metaschema source definitions. Let us know with a comment here.

We want to hear from you, and we will follow up in threads here to solicit more information or present more details to the community.

Thanks,
The NIST Metaschema Maintainers

[aj-stein-nist]

For awareness of the community, when area we are exploring now in an official use is maybe using SARIF for Metaschema constraint validation results in #516.

[aj-stein-nist]

One other use case I have been considering is embedding structure information (HTML or something else to be determined) in a custom profile of SVG 2 so a picture can be rendered and embedded content presented. I will update this post with a comment in the thread when I get around to it.

[aj-stein-nist]

One other consideration for stress-testing Metaschema that could be highly valuable due to its complexity and cross-format usage (like OSCAL) is one of the more recent releases of FHIR, which supports JSON, RDF (Turtle variant), and XML. I will post future updates as comments in a thread from this post.

[aj-stein-nist]

And yet another interesting idea with applications within cybersecurity and other domains is XBRL.

• Financial and cyber incident reporting for U.S. companies for the Securities and Exchange Commission
• Financial sustainability reporting with XBRL taxonomy for the EU ESRS pilot underway, possible related to the EU DORA Act?

There are many other use cases and applications for XBRL, but these are two primary use cases for an established information model in XML (and it seems maybe a JSON variant) with profiled customized experiences that would benefit from constraints, even within one use case (the SEC filing requirements appear to have multiple taxonomies for different types of stakeholders).