> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OSCAL export

> Export tamper-evident compliance evidence as NIST OSCAL for your auditors.

MergeGuide can export your compliance evidence in **NIST OSCAL** (Open Security
Controls Assessment Language) format, the machine-readable standard auditors and
GRC tools increasingly expect. You assess your code in MergeGuide and hand your
auditor structured evidence instead of screenshots.

MergeGuide exports **OSCAL v1.1.2**.

## What you can export

MergeGuide generates the following OSCAL document types:

| Document                                 | What it contains                                         |
| ---------------------------------------- | -------------------------------------------------------- |
| **Component Definition**                 | The controls a component implements and how.             |
| **Assessment Results**                   | The outcome of assessing your code against the controls. |
| **Plan of Action & Milestones (POA\&M)** | Open items and the plan to remediate them.               |
| **Catalog**                              | The control catalog for a selected framework.            |

<Note>
  This page lists only the OSCAL document types that currently ship. Additional
  document types may be added over time.
</Note>

## Export from the dashboard

1. Open **Compliance** in the dashboard.
2. Choose the framework and the OSCAL document type you need.
3. Generate and download the OSCAL file.

## Verify exported evidence

MergeGuide evidence artifacts are signed. You can verify an artifact with the CLI:

```bash theme={null}
mergeguide verify-evidence ./evidence.json
```

The command exits 0 if the artifact is valid, 1 if it's been tampered with, 2 if
it's malformed, and 3 if a required verification step couldn't reach the network.
For air-gapped verification, see the [`verify-evidence` reference](/reference/cli#mergeguide-verify-evidence).

## Next steps

<CardGroup cols={2}>
  <Card title="Compliance overview" icon="clipboard-check" href="/compliance/overview">
    How compliance frameworks work in MergeGuide.
  </Card>

  <Card title="SBOM export" icon="boxes-stacked" href="/compliance/sbom-export">
    Generate a Software Bill of Materials.
  </Card>
</CardGroup>