compliance-trestle

What it is and what it does

Compliance-trestle is a Python toolkit for managing OSCAL (NIST's machine-readable compliance standard) documents in a developer-friendly way. It breaks large OSCAL structures into smaller, editable pieces that fit into normal git workflows—allowing teams to version, review, and collaborate on compliance artifacts via pull requests. The package validates schemas, transforms documents from other formats into OSCAL, and provides governance tooling for markdown and drawio files used in compliance authoring.

The package is built around a CI/CD-friendly pipeline that sits on top of compliance artifacts in git, making compliance state transparent across stakeholders. It supports JSON and YAML formats (not XML), includes detached signing and verification for artifacts, and exposes an underlying object model for developers to interact with OSCAL programmatically. Version 5 is actively developed and supports OSCAL 1.2.1 with pydantic v2; version 4 is in maintenance mode until December 31, 2026.

Use it for:

• Manage control descriptions and implementation details in git, linking system changes to affected compliance controls.
• Convert compliance documentation from spreadsheets or markdown into standardized OSCAL format for tool interoperability.
• Enforce consistent formatting and content in compliance markdown documents via template-based governance.
• Build compliance CI/CD pipelines that validate and version OSCAL artifacts alongside infrastructure code.
• Split large OSCAL catalogs into smaller, reviewable pieces for team collaboration and peer review.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Compliance-trestle manages, validates, and transforms OSCAL (NIST's compliance standard format) documents, splitting large structures into editable pieces while enforcing schema compliance and supporting markdown-to-OSCAL conversion.

Yes, if you work with NIST compliance frameworks or need to manage OSCAL documents at scale. The package is actively maintained, has no known vulnerabilities, supports current Python versions, and provides genuine value for teams bringing compliance into DevOps workflows. Install with confidence if your compliance tooling stack requires OSCAL interchange; skip it if you don't work with OSCAL or compliance automation.

Install

compliance-trestle on PyPI

pip install compliance-trestle

uv add compliance-trestle

poetry add compliance-trestle

Installing compliance-trestle

Before you install

Low friction installation via pip; actively maintained with releases every few days. Requires Python 3.10 or later and pulls in 19 runtime dependencies including cryptography, pydantic, and YAML/JSON handling libraries—typical for a compliance tooling suite.

License in practice

Apache-2.0 (permissive): you can use, modify, and distribute this package freely in commercial and private projects, provided you include the license notice and state material changes.

Quickstart

pip install compliance-trestle

from trestle.core.models import OscalBaseModel
# Load and manipulate OSCAL documents via the object model

Requires Python 3.10 or later; designed for use in git-based workflows with compliance artifacts.

Verify before relying

• Whether the package's 19 runtime dependencies introduce supply-chain risk in regulated environments.
• Performance characteristics when working with very large OSCAL catalogs or profiles.
• Extent of support for OSCAL 1.2.1 features beyond what v4 (maintenance mode) provides.

Package facts

Evidence: compliance_trestle-5.0.0-py3-none-any.whl

Keywords: Compliance, OSCAL, Security

Tags

More Security packages