For department of defense dod users with a valid common access card. Security content automation protocol scap dod cyber exchange. Defense security service industrial security field. Security content automation protocol scap dod cyber. Scap enables an automated, standardized approach to maintaining the security of complex enterprise systems, such as implementing security configuration.
We are aware that certain scap benchmarks for microsoft office are missing that were previously available. Scap compliance checker is an automated vulnerability scanning tool. Security content automation protocol scap compliance checker scc scc is a scap 1. The stig viewer can also be used in a manual fashion e. Compliance checker scan results in order to view the compliance status of the systems security settings. The updated features include recent disa stig content for both windows and red hat systems and nist usgcb patch content. Select the appropriate scap compliance checker for your operating system from the list and provide your pki. Getting started with the scap compliance checker and. Machinereadable cce to 80053 data stream supporting resources. It features the nist certified command line scanner called oscap. Ncp checklist solaris 10 sparc and x86 manual stig. It leverages the defense information systems agency disa security technical implementation guides stigs and operating system.
Security content automation protocol scap compliance checker scc. Scap workbench is a tool that can open xccdf or sds files and allows the user to evaluate either local or remote machine using the content in the opened file. Remote machine for usgcb compliance with scap workbench tutorial. The scap compliance checker is an automated compliance. It provides the raw functionality of reading scap content and allows you to perform compliance scanning on a single system. Technical implementation of assessment and authorization. See also openscap user manual for instructions how to use openscap. Specifically, scap standards address the following objectives. One layer above stands the scap workbench, a graphical user interface that uses the functionality provided by. Security content automation protocol scap compliance checker v. For system remediation, an xccdf file with instructions is required. The oscap uses scap which is a line of specifications maintained by the nist. Security content automation protocol scap compliance checker. To access dod cyber exchange nipr, click on login with cac at the top right of the screen and use your cac with dod certificates to access this content.
Enumerate software flaws, securityrelated configuration issues, and product names. Obtaining the scap compliance checker and stig viewer. Scap compliance checker scc spawar systems center atlantic has released an updated version to the scap compliance checker scc tool. Synopsis scap compliance checks for windows systems. This paper discusses scap benchmark components and the development of a scap benchmark for automating cisco router security configuration compliance. Using the dod stig and scap tool basic rundown youtube. Description using the supplied credentials, this script performs a compliance check against the policy specified by scap content. The scc tool is only available on dod cyber exchange nipr. Scap consists of a suite of standards that enable automated vulnerability management, measurement, and policy compliance evaluation, for example, fisma compliance. Performs manual interview checks using ocil content.