OSCAL (Open Security Controls Assessment Language)
Supporting Control-Based Risk Management with Standardized Formats...
Also in the API standards catalog
This standard shows up on both sides of the house — as a data model here, and as a standard applied in API operations. Same standard, two lenses.
See it as an API standard →