What we actually do is best reflected in our events, publications and research findings. Here is an outlook for the next quarters.

• First Workshop Series — quarter: from September 2026 (Q4 / 2026): Online workshops on the topics Git fundamentals, GoBD practice and OSCAL/Policy-as-Code.

• GitCover Core Alpha — quarter: from September 2026 (Q4 / 2026): First release of the GitCover Core library (MIT license) on Gitea and Codeberg. Focus: Git-native compliance patterns, UUIDv7 receipt identity, GCPN paths.

• Tutorial Videos & Moodle — quarter: Q4 / 2026: Tutorial videos (CC-BY-SA) on Git basics, compliance and best practices. Launch of self-paced courses on our own Moodle platform with certificates.

• R&D Program Phase 2 — quarter: Q1 / 2027: Deepening research into OSCAL/OPA policy frameworks, Merkle proofs for audit trails and secure AI agent orchestration under compliance guardrails.

• GitCover Conference — quarter: Q3 / 2027: Professional conference with 100–150 participants. Lectures, workshops, networking. Free of charge for students. Recordings under a free license.

• First Activity Report — quarter: Q4 / 2027: Full disclosure of income, expenditures and funded activities. Publication in accordance with Section 63 AO together with the annual financial statement.

OSCAL Community Membership (NIST)

The GitCover Commons gUG is a member of the OSCAL Community of the NIST (National Institute of Standards and Technology, a US authority). OSCAL (Open Security Controls Assessment Language) is a NIST-led initiative that standardises security and compliance controls in machine-readable formats (XML, JSON, YAML). Membership in the OSCAL Community enables the GCC:

• Early access to new OSCAL specifications and tools
• Participation in workshops and working groups with NIST, BSI and industry
• Influence on the further development of OSCAL with regard to German requirements (GoBD, AO, GDPR, BSI IT-Grundschutz)
• International understanding: cooperation with a US authority (NIST) and European partners (BSI) in the field of security standards

Sphere classification: The OSCAL Community Membership touches the GCC spheres Idealistic (education, research, consumer protection) and International understanding (international standardisation). NIST is a US government organisation; the cooperation takes place at civil-society level, not at government level.

BSI Workshop: "German BSI Baseline Manual goes OSCAL"

As part of the OSCAL Community Membership, the GCC participates in the workshop "German BSI Baseline Manual goes OSCAL". The workshop covers the transfer of the BSI IT-Grundschutz compendium into the OSCAL format.

Research and learning objectives

This workshop yields concrete research and learning objectives for the GCC:

1. OSCAL document structure for GoBD: How must OSCAL catalogs (Control Catalogs) and profiles be structured to map GoBD requirements (traceability, verifiability, immutability)?
2. OSCAL for AO and GDPR: Mapping of the Fiscal Code (AO) and the General Data Protection Regulation (GDPR) to OSCAL controls - which control statements are required?
3. BSI IT-Grundschutz in OSCAL: Structure of the IT-Grundschutz compendium as an OSCAL catalog - building blocks, requirements, threats as machine-readable artifacts.
4. Policy-as-Code bridge: Derivation of OPA Rego policies from OSCAL controls for automated compliance checking in Git hooks.

Relevance for the GCC statutory purposes

Note: NIST is a US government organisation (Department of Commerce). The OSCAL Community is an open, civil-society initiative. The GCC cooperates as a non-profit corporation (§ 60a AO) with NIST and BSI without performing government tasks. The cooperation serves exclusively the statutory purposes.