[Verse 1]
Component Definition starts the show
Software systems need a way to go
From STIG requirements to implementation code
Red Hat Enterprise Linux on the road
UUID identifies each piece we build
Control implementations get fulfilled
Source points to profiles that define the way
FedRAMP High compliance here to stay
[Chorus]
Stack them up, OSCAL format stack
Component first, Assessment tracks back
Evidence flows from SCAP to findings clear
Implementation statement makes it all appear
Stack them up, format by format
Documentation layers where compliance is at
[Verse 2]
Assessment Results come next in line
Observations capture what we find
Methods show us how the testing's done
SCAP scans tell us when the work is won
Relevant evidence points the way
OpenSCAP results from testing day
XCCDF benchmark version two R one
RHEL nine STIG scanning has begun
[Chorus]
Stack them up, OSCAL format stack
Component first, Assessment tracks back
Evidence flows from SCAP to findings clear
Implementation statement makes it all appear
Stack them up, format by format
Documentation layers where compliance is at
[Bridge]
Findings link the target to the proof
Objective ID becomes the truth
Implementation statement UUID connects
Component Definition to what we expect
Related observations tie it tight
Assessment evidence shines the light
[Verse 3]
From component type of software kind
To cryptography that's FIPS-aligned
AC seventeen point two control ID
Enforced through STIG methodology
Six seven one zero one zero rule
RHEL nine configuration tool
[Final Chorus]
Stack them up, OSCAL format stack
Component first, Assessment tracks back
Evidence flows from SCAP to findings clear
Implementation statement makes it all appear
Stack them up, two formats unite
OSCAL documentation done right
[Outro]
Component Definition shows the way
Assessment Results prove compliance today
Stack them up, stack them high
OSCAL formats reaching for the sky