diff --git a/core/src/main/java/gov/nist/secauto/metaschema/core/util/UriUtils.java b/core/src/main/java/gov/nist/secauto/metaschema/core/util/UriUtils.java
new file mode 100644
index 000000000..17d5acf45
--- /dev/null
+++ b/core/src/main/java/gov/nist/secauto/metaschema/core/util/UriUtils.java
@@ -0,0 +1,60 @@
+/*
+ * Portions of this software was developed by employees of the National Institute
+ * of Standards and Technology (NIST), an agency of the Federal Government and is
+ * being made available as a public service. Pursuant to title 17 United States
+ * Code Section 105, works of NIST employees are not subject to copyright
+ * protection in the United States. This software may be subject to foreign
+ * copyright. Permission in the United States and in foreign countries, to the
+ * extent that NIST may hold copyright, to use, copy, modify, create derivative
+ * works, and distribute this software and its documentation without fee is hereby
+ * granted on a non-exclusive basis, provided that this notice and disclaimer
+ * of warranty appears in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED 'AS IS' WITHOUT ANY WARRANTY OF ANY KIND, EITHER
+ * EXPRESSED, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY
+ * THAT THE SOFTWARE WILL CONFORM TO SPECIFICATIONS, ANY IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND FREEDOM FROM
+ * INFRINGEMENT, AND ANY WARRANTY THAT THE DOCUMENTATION WILL CONFORM TO THE
+ * SOFTWARE, OR ANY WARRANTY THAT THE SOFTWARE WILL BE ERROR FREE.  IN NO EVENT
+ * SHALL NIST BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT,
+ * INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM,
+ * OR IN ANY WAY CONNECTED WITH THIS SOFTWARE, WHETHER OR NOT BASED UPON WARRANTY,
+ * CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR
+ * PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT
+ * OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER.
+ */
+
+package gov.nist.secauto.metaschema.core.util;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.nio.file.InvalidPathException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import edu.umd.cs.findbugs.annotations.NonNull;
+
+public final class UriUtils {
+
+  private UriUtils() {
+    // disable construction
+  }
+
+  public static URI toUri(@NonNull String location, @NonNull URI baseUri) throws URISyntaxException {
+    URI asUri;
+    try {
+      asUri = new URI(location);
+    } catch (URISyntaxException ex) {
+      // the location is not a valid URI
+      try {
+        // try to parse the location as a local file path
+        Path path = Paths.get(location);
+        asUri = path.toUri();
+      } catch (InvalidPathException ex2) {
+        // not a local file path, so rethrow the original URI expection
+        throw ex;
+      }
+    }
+    return baseUri.resolve(asUri.normalize());
+  }
+}
diff --git a/core/src/test/java/gov/nist/secauto/metaschema/core/util/UriUtilsTest.java b/core/src/test/java/gov/nist/secauto/metaschema/core/util/UriUtilsTest.java
new file mode 100644
index 000000000..be50c3f06
--- /dev/null
+++ b/core/src/test/java/gov/nist/secauto/metaschema/core/util/UriUtilsTest.java
@@ -0,0 +1,85 @@
+/*
+ * Portions of this software was developed by employees of the National Institute
+ * of Standards and Technology (NIST), an agency of the Federal Government and is
+ * being made available as a public service. Pursuant to title 17 United States
+ * Code Section 105, works of NIST employees are not subject to copyright
+ * protection in the United States. This software may be subject to foreign
+ * copyright. Permission in the United States and in foreign countries, to the
+ * extent that NIST may hold copyright, to use, copy, modify, create derivative
+ * works, and distribute this software and its documentation without fee is hereby
+ * granted on a non-exclusive basis, provided that this notice and disclaimer
+ * of warranty appears in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED 'AS IS' WITHOUT ANY WARRANTY OF ANY KIND, EITHER
+ * EXPRESSED, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY
+ * THAT THE SOFTWARE WILL CONFORM TO SPECIFICATIONS, ANY IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND FREEDOM FROM
+ * INFRINGEMENT, AND ANY WARRANTY THAT THE DOCUMENTATION WILL CONFORM TO THE
+ * SOFTWARE, OR ANY WARRANTY THAT THE SOFTWARE WILL BE ERROR FREE.  IN NO EVENT
+ * SHALL NIST BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT,
+ * INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM,
+ * OR IN ANY WAY CONNECTED WITH THIS SOFTWARE, WHETHER OR NOT BASED UPON WARRANTY,
+ * CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR
+ * PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT
+ * OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER.
+ */
+
+package gov.nist.secauto.metaschema.core.util;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+import java.net.URI;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import edu.umd.cs.findbugs.annotations.NonNull;
+
+class UriUtilsTest {
+  private static final boolean VALID = true;
+  private static final boolean INVALID = false;
+
+  private static Stream<Arguments> provideValuesTestToUri() {
+    List<Arguments> values = new LinkedList<>() {
+      {
+        add(Arguments.of("http://example.org/valid", VALID));
+        add(Arguments.of("https://example.org/valid", VALID));
+        add(Arguments.of("http://example.org/valid", VALID));
+        add(Arguments.of("ftp://example.org/valid", VALID));
+        add(Arguments.of("ssh://example.org/valid", VALID));
+        add(Arguments.of("example.org/good", VALID));
+        add(Arguments.of("bad.txt", VALID));
+        add(Arguments.of("relative\\windows\\path\\resource.txt", VALID));
+        add(Arguments.of("C:\\absolute\\valid.txt", VALID));
+        add(Arguments.of("local/relative/path/is/invalid.txt", VALID));
+        add(Arguments.of("/absolute/local/path/is/invalid.txt", VALID));
+        add(Arguments.of("1;", VALID));
+        add(Arguments.of(":", INVALID));
+        add(Arguments.of(">", INVALID));
+        add(Arguments.of("<", INVALID));
+      }
+    };
+    return values.stream();
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideValuesTestToUri")
+  void testToUri(@NonNull String location, boolean expectedResult) {
+    boolean valid = false;
+    Path cwd = Paths.get("");
+    try {
+      URI uri = UriUtils.toUri(location, cwd.toAbsolutePath().toUri());
+      valid = true;
+      System.out.println(String.format("%s -> %s", location, uri.toASCIIString()));
+    } catch (Exception ex) {
+      ex.printStackTrace();
+    }
+    assertEquals(valid, expectedResult);
+  }
+}