Demonstrating that a digital product or service is secure can involve navigating multiple standards, regulations and certification schemes. Overlapping requirements increase compliance costs, particularly for SMEs, while traditional audits provide only a snapshot of security that can become outdated as systems evolve. These challenges are increasingly relevant in the context of European cybersecurity legislation, including the Cyber Resilience Act (CRA).

The COBALT project (Certification for Cybersecurity in EU ICT using Decentralized Digital Twinning) addressed these challenges by developing a model-driven framework for dynamic cybersecurity certification, building on and extending OSCAL model. By connecting structured certification information with operational evidence and risk assessment, COBALT explored how certification could become more automated, traceable and responsive to system changes.

Rather than relying on one-off, time-consuming audits, the COBALT project introduces a continuous assurance lifecycle divided into three main workflows:

• COBALT Setup (WF1): Establishing certification schemes, registering the Target of Evaluation (ToE), and synchronizing it with a high-fidelity Security Digital Twin (SDT).
• Point-in-Time Assessment (WF2): Continuously gathering evidence via specialized collectors (e.g., Clouditor, AIShield) and evaluating it against predefined compliance metrics.
• Continuous Certificate Management (WF3): Monitoring ongoing risk postures and automating certificate lifecycle decisions (continuation, update, suspension, or withdrawal).

How does COBALT use OSCAL?

To make all these pieces work together, COBALT builds on and extends OSCAL through a structured approach called the Common Certification Model (CCM), which is divided into two main parts:

 1) The Certification Standards (Cybersecurity Certification Scheme): This part acts as a universal bridge for regulations. Instead of treating every standard separately, COBALT links general security rules to major frameworks like EUCS, ISO 27001, or NIST. This allows a single automated check, such as verifying system logs or updates, to satisfy requirements across multiple standards at the same time, avoiding duplicate work.

2) The System Profile (Target of Evaluation Scheme): While the first part defines the rules, this profile describes the actual service or product being certified using OSCAL. To keep things practical and agile, COBALT avoids cluttering the main model with heavy data. Instead, it connects cleanly to external security files and inventories, such as software component lists (SBOMs), vulnerability reports, and network configuration (MUD). This means that whenever a system updates, the security assessment adapts automatically.

The CCM is managed by the CCM Manager.

Sharing COBALT’s work with the OSCAL community

COBALT’s contribution extended beyond technical integration. The project presented its work in NIST webinars featuring Michela Iorga, the main creator of OSCAL, sharing its approach to applying OSCAL-related concepts to dynamic certification.

At European level, COBALT participated in the OSCAL task force of the European Cyber Security Organisation (ECSO), and within the ECCO community, presenting the project and explaining how OSCAL was used in its framework. The project also held discussions with stakeholders from the German Federal Office for Information Security (BSI) and the European Commission.

Collaboration with other European research projects, including EMERALD, and participation in activities involving the European Cybersecurity Certification Cluster (EC3) further connected COBALT with initiatives addressing cybersecurity compliance and certification.

Publications and knowledge sharing

COBALT’s work on CCM was also disseminated through research publications and conference presentations, including:

• Towards the Automation of Attack Graph-Based Risk Assessment with OSCAL – published by Springer in 2025. The paper explores combining OSCAL with attack graphs and compliance-as-code to support automated security risk assessment.
• Automated Distributed Ledger Infrastructure for Continuous Cybersecurity Certification in Multi-Stakeholder Environments – presented at the LIFESEC workshop colocated with SmartComp 2026.
• Beyond Static Audits: Using OSCAL to Streamline Continuous Cybersecurity Certification – presented at the ETSI Security Conference 2026 in collaboration with the EMERALD project.