Specification for the Extensible Configuration Checklist Description
Format (XCCDF) Version 1.1.4 as Applied to Federal Desktop Core
Configuration (FDCC)

Authors: Paul Cichonski, Peter Mell (revised by Neal Ziring)

Created: 9/27/2007

Modified: 11/29/2007 10:19:00 PM

[1 Introduction 2](#introduction)

[1.1 Intended Audience 2](#intended-audience)

[2 FDCC XCCDF Results Schema 2](#fdcc-xccdf-results-schema)

[2.1 TestResult 2](#testresult)

[2.2 TestResult/rule-result 2](#testresultrule-result)

[2.2 TestResult/rule-result/override 3](#testresultrule-resultoverride)

[2.3 Example FDCC XCCDF Result File 3](#example-fdcc-xccdf-result-file)

#   {#section .unnumbered}

# 1 Introduction

This specification serves to constrain the Extensible Configuration
Checklist Description Format (XCCDF) 1.1.4 specification for use with
the Federal Desktop Core Configuration (FDCC) Profile. This document
only constrains the portion of the XCCDF specification dealing with
XCCDF test results. It is necessary to define this syntax for XCCDF
users at both the government and vendor level. The Office of Management
and Budget has mandated that all government agencies comply with FDCC by
February 01, 2008. Agencies must utilize a SCAP certified tool to verify
FDCC compliance. In order for an SCAP certified tool to verify
compliance of a system it must compare the system to a FDCC XCCDF
checklist defined by NIST. The tool will export a XCCDF result file upon
completion of the test. To complete the compliance process the
government agency under review must send the XCCDF result file to NIST
for validation (per OMB mandate).

In order to streamline the last step in FDCC compliance, NIST is
recommending that both vendors and agencies use XCCDF results for
reporting. In particular, they should format FDCC XCCDF result files to
adhere to the syntax defined in this document. This document only
constrains the current XCCDF specification; it does not modify it in any
way. The syntax defined in this document deals only with the actual
results returned in a XCCDF results file, all other portions of the
XCCDF specification are deemed out of scope.

## 1.1 Intended Audience

The audience for this document consists of any individuals or
organizations working with XCCDF and FDCC. This includes all vendors
responsible for creating SCAP compliant tools that agencies will use to
certify FDCC compliance.

# 2 FDCC XCCDF Results Schema

This section lists the areas of the XCCDF specification that have been
constrained for use with the FDCC profile.

## 2.1 TestResult

  -------------- ------------------- -------------- --------------------------
  **Property**   **Type**            **Count**      **Change / Constraint**

  benchmark      URI                 1              This is now mandatory --
                                                    Must reference FDCC XCCDF
                                                    file

  identity       string+attributes   1              This is a new tag recently
                                                    added to 1.1.4 -- This is
                                                    where agencies will record
                                                    that an authenticated
                                                    entity and a privileged
                                                    entity ran the scan. May
                                                    or may not include the
                                                    identity name or username
                                                    itself. This is mandatory

  organization   string              1-n            This is a new tag recently
                                                    added to 1.1.4 -- This is
                                                    where agencies will input
                                                    their agency, bureau,
                                                    division, system etc.

  test-system    string              1              This is now mandatory --
                                                    Must name the tool used
                                                    for scanning.

  profile        identifier          1              This is now mandatory --
                                                    Must be FDCC Profile (i.e.
                                                    "FDCC-Desktop")
  -------------- ------------------- -------------- --------------------------

## 2.2 TestResult/rule-result

  -------------- -------------- -------------- --------------------------
  **Property**   **Type**       **Count**      **Change / Constraint**

  ident          string + URI   n              This is now mandatory. For
                                               FDCC and SCAP this must be
                                               the CCE-ID if it exists.
                                               URI must reference CCE
                                               (i.e. "URI:CCE")
  -------------- -------------- -------------- --------------------------

## 2.2 TestResult/rule-result/override

  -------------- -------------- -------------- --------------------------
  **Property**   **Type**       **Count**      **Change / Constraint**

  remark         string         1              This must be the agencies
                                               justification for their
                                               deviation from FDCC. This
                                               is strongly recommended
                                               when the rule status is
                                               not "pass".
  -------------- -------------- -------------- --------------------------

## 

## 2.3 Example FDCC XCCDF Result File 

\<cdf:Benchmark id=\"Windows-XP-Desktop-800-68-1\" resolved=\"1\"

xml:lang=\"en\" xmlns:cdf="<http://checklists.nist.gov/xccdf/1.1>"\>

.

.

.

\<cdf:TestResult id=\"Windows-XP-SP-800-68-1\"
end-time=\"2007-09-26T05:30:48\"\
test-system=\"cpe:/a:securitycompany:productname:1.0\"\>

\<cdf:benchmark href=\"SCAP-WinXPPro-XCCDF.xml\" /\>

\<cdf:platform idref="cpe:/o:Microsoft:windows-nt:xp:sp2"/\>

\<cdf:version\>0.61\</cdf:version\>

\<cdf:organization\>Department of Commerce\</cdf:organization\>

\<cdf:organization\>National Institute of Standard and
Technology\</cdf:organization\>

\<cdf:identity authenticated="1" privileged="1"/\>

    \<cdf:profile idref=\"FDCC-Desktop\"/\>

    \<cdf:target\>host1.net16.nist.gov\</cdf:target\>

    \<cdf:rule-result idref=\"MinimumPasswordAge\"
time=\"2007-09-26T05:30:49\"\>

      \<cdf:result\>fail\</cdf:result\>

      \<cdf:override time=\"2007-08-08T08:15:06\" authority=\"Stephen
Smith (s.smith@nist.gov)\"\>

        \<cdf:old-result\>fail\</cdf:old-result\>

        \<cdf:new-result\>fail\</cdf:new-result\>

        \<cdf:remark\>The OVAL test seemed to incorrectly check our
password age because its recorded

in fortnights instead of seconds.

\</cdf:remark\>

      \</cdf:override\>

      \<cdf:ident
system=\"http://cce.mitre.org/\"\>CCE-324\</cdf:ident\>

    \</cdf:rule-result\>

. . .

    \<cdf:score\>85\</cdf:score\>

 \</cdf:TestResult\>

\<cdf:Signature\>

. . .

\</cdf:Signature\>

\</cdf:Benchmark\>