---
id: compliance-trestle
version: "5.0.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# compliance-trestle — Tools to manage & autogenerate python objects representing the OSCAL layers/models

License: permissive · Maintenance: active · Downloads: 193.6K/mo

## What it is and what it does

Compliance-trestle is a Python toolkit for managing OSCAL (NIST's machine-readable compliance standard) documents in a developer-friendly way. It breaks large OSCAL structures into smaller, editable pieces that fit into normal git workflows—allowing teams to version, review, and collaborate on compliance artifacts via pull requests. The package validates schemas, transforms documents from other formats into OSCAL, and provides governance tooling for markdown and drawio files used in compliance authoring.

The package is built around a CI/CD-friendly pipeline that sits on top of compliance artifacts in git, making compliance state transparent across stakeholders. It supports JSON and YAML formats (not XML), includes detached signing and verification for artifacts, and exposes an underlying object model for developers to interact with OSCAL programmatically. Version 5 is actively developed and supports OSCAL 1.2.1 with pydantic v2; version 4 is in maintenance mode until December 31, 2026.

Use it for:

- Manage control descriptions and implementation details in git, linking system changes to affected compliance controls.
- Convert compliance documentation from spreadsheets or markdown into standardized OSCAL format for tool interoperability.
- Enforce consistent formatting and content in compliance markdown documents via template-based governance.
- Build compliance CI/CD pipelines that validate and version OSCAL artifacts alongside infrastructure code.
- Split large OSCAL catalogs into smaller, reviewable pieces for team collaboration and peer review.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Compliance-trestle manages, validates, and transforms OSCAL (NIST's compliance standard format) documents, splitting large structures into editable pieces while enforcing schema compliance and supporting markdown-to-OSCAL conversion.

Yes, if you work with NIST compliance frameworks or need to manage OSCAL documents at scale. The package is actively maintained, has no known vulnerabilities, supports current Python versions, and provides genuine value for teams bringing compliance into DevOps workflows. Install with confidence if your compliance tooling stack requires OSCAL interchange; skip it if you don't work with OSCAL or compliance automation.

## Install

pip install compliance-trestle
uv add compliance-trestle
poetry add compliance-trestle

## Installing compliance-trestle

Before you install: Low friction installation via pip; actively maintained with releases every few days. Requires Python 3.10 or later and pulls in 19 runtime dependencies including cryptography, pydantic, and YAML/JSON handling libraries—typical for a compliance tooling suite.

License in practice: Apache-2.0 (permissive): you can use, modify, and distribute this package freely in commercial and private projects, provided you include the license notice and state material changes.

Quickstart:

pip install compliance-trestle

from trestle.core.models import OscalBaseModel
# Load and manipulate OSCAL documents via the object model

Requires Python 3.10 or later; designed for use in git-based workflows with compliance artifacts.

Verify before relying:

- Whether the package's 19 runtime dependencies introduce supply-chain risk in regulated environments.
- Performance characteristics when working with very large OSCAL catalogs or profiles.
- Extent of support for OSCAL 1.2.1 features beyond what v4 (maintenance mode) provides.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 193.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

OSCAL document management, compliance automation tools, NIST compliance framework, compliance artifact validation, markdown to OSCAL conversion, compliance CI/CD pipeline, control documentation governance, compliance-automation, oscal, governance

[View on SkillFed](https://skillfed.io/packages/compliance-trestle) · [View on PyPI](https://pypi.org/project/compliance-trestle/)