**Security Content Automation Protocol**

**Product Compatibility**

Version 1.02 Beta, Last Revised 8/29/2007

This document defines Security Content Automation Protocol (SCAP)
product compatibility requirements and builds upon the SCAP overview
publication. It is assumed that the reader is already familiar with SCAP
concepts and terminology.

**Section 1: What does it mean for a product to be SCAP compatible?**

A security tool is considered "SCAP compatible" if it adopts at least
three (3) of the SCAP standards.

Examples of the types of tools that can benefit from SCAP are:

1.  Security configuration scanners

    a.  Local workstation evaluation tools that require a user with
        administration rights to be logged in

    b.  Network scanning tools that require authenticated scanning with
        administrative rights

    c.  Agent based solutions that require administrative rights for the
        initial installation of an agent, but do not require users to be
        connected (logically or physically) to be assessed;
        unauthenticated network scanner category.

    d.  Network scanning tools that do not have administrative rights on
        the computers being scanned

2.  Intrusion detection systems

3.  Vulnerability databases

4.  Asset management tools augmented with security relationships

Please note: Security configuration scanners must have the capability to
read NIST hosted SCAP content. At a minimum, this means XCCDF plus two
other standards in order to be considered SCAP capatible.

A list of vendors and products working towards SCAP compatibility and
products are available on the SCAP products page. Each SCAP compliant
product is given a "star rating" that shows the number of SCAP standards
that have been adopted by the product. The highest star rating is
currently six (6). Security tools that adopt three (3) or more SCAP
standards and that use those standards as required by SCAP (see below
for details) may be listed on the web site.

There does not exist a formal compliance program for SCAP although one
is planned. It is expected that this compliance program will require
vendor adoption of all applicable SCAP standards in order for a product
to become compliant. Note that NIST currently performs only minimal
testing of vendor assertions and the web site is open to any vendor.

The SCAP standards and data feeds are designed to be incorporated within
security tools. Security tool developers can leverage the SCAP content
feeds, license free, to augment their tool's capabilities and reduce the
need to create and manage the same data in proprietary formats. There
are no licensing restrictions on using the NVD SCAP content.

**Section 2: Standard Specific Compatibility Requirements**

This section describes each of the six SCAP standards and the
compatibility requirements specific to that standard.

**Common Vulnerabilities and Exposures SCAP Compatibility**

For a product to be considered SCAP compatible with respect to CVE, the
product must become CVE compatible according to the MITRE CVE
compatibility program. The product must also must hyperlink all CVE
identifiers to a web resource containing the CVE name, description,
references to additional information, and the SCAP mappings to CPE and
CVSS. Such web pages for all CVE entries are freely available from NVD
(format is http://nvd.nist.gov/cvecce.cfm?name=xxx-xxxx-xxxx, under
development). Note that linking CVE vulnerabilities to the NVD CVE pages
(or other third party CVE web pages) does not break a product's MITRE
CVE compatibility status.

CVE Homepage: [http://cve.mitre.org](http://cve.mitre.org/)/

CVE Compatibility: <http://cve.mitre.org/compatible/>

NVD CVE/CCE data feed:
[http://nvd.nist.gov/download.cfm](http://nvd.nist.gov/cvecce.cfm)

**Common Configuration Enumeration SCAP Compatibility**

For a product to be considered SCAP compatible with respect to CCE, it
must use CCE identifiers to tag all relevant configuration items. In
addition, it must display recommended secure settings for each CCE.
Lastly, it must hyperlink all CCE entries to a web resource containing
the CCE name, description, recommended settings, and SCAP mappings to
CPE and CVSS. Such web pages for all CCE entries are freely available
from NVD (although third party web sites may be used).

For a product to be considered SCAP compatible with respect to both CVSS
and CCE, it must output the CCE names when outputting XCCDF results.

CCE Homepage: [http://cce.mitre.org](http://cce.mitre.org/)/

NVD CVE/CCE data feed: <http://nvd.nist.gov/download.cfm> (UNDER
DEVELOPMENT)

**Common Platform Enumeration SCAP Compatibility**

For a product to be considered SCAP compatible with respect to CPE, the
product must either use the CPE dictionary as the underlying product's
dictionary or else maintain a translation table from the product's
dictionary to CPE (the former being the preferred approach). The NVD CPE
data feeds may contain additional information not provided by the actual
CPE specification (but will contain the core CPE data).

For a product to be considered SCAP compatible with respect to both CPE
and CVE, the product must display and use the SCAP CVE to CPE mapping.
This mapping is available from NVD.

For a product to be considered SCAP compatible with respect to both CPE
and CCE, the product must display and use the SCAP CCE to CPE mapping.
This mapping is available from NVD.

CPE Homepage: <http://cpe.mitre.org/>

NVD CPE data feed: <http://nvd.nist.gov/download.cfm#Dictionary>

**Common Vulnerability Scoring System SCAP Compatibility**

For a product to be considered SCAP compatible with respect to CVSS, the
product must use and display CVSS scores and vectors. It must hyperlink
all CVSS scores to a CVSS calculator that displays the metrics used to
create the score, allows the user to modify the CVSS metrics, and allows
the user to compute an environment specific score. NVD provides a CVSS
calculator that can easily integrate with vendor tools (the NVD CVSS
calculator takes a CVSS vector and a CVE or CCE vulnerability name as
URL input parameters). While the NVD CVSS calculator meets this
requirement, proprietary CVSS calculators may be used. This requirement
does not prohibit a product from also using proprietary scoring systems.

For a product to be considered SCAP compatible with respect to both CVSS
and CVE, the product must display and use the SCAP CVE to CPE mapping.
The CVE to CVSS mappings are available from NVD.

For a product to be considered SCAP compatible with respect to both CVSS
and CCE, the product must display and use the SCAP CVSS to CCE mapping.
The CCE to CVSS mappings are available from NVD.

CVSS Homepage: <http://www.first.org/cvss/index.html>

CVSS Specification: <http://www.first.org/cvss/cvss-guide.html>

NVD CVSS data feed: <http://nvd.nist.gov/cvss.cfm>

**Extensible Configuration Checklist Description Format SCAP
Compatibility**

For a product to be considered SCAP compatible with respect to XCCDF,
the product must implement the XCCDF specification (consume XCCDF and
produce results) to the extent that it can process any XCCDF checklist
that conforms to the SCAP template and style guide. In particular, it
must process the SCAP files provided by the NVD XCCDF data feed (see
below for link). It is not sufficient to hardcode specific XCCDF
checklists into a tool. Instead the tool must actively interpret XCCDF
version 1.1.2 or greater XML files.

XCCDF Standard: <http://nvd.nist.gov/xccdf.cfm>

SCAP XCCDF style guide: Under development

SCAP XCCDF template: Under development

NVD XCCDF/OVAL data feed: <http://nvd.nist.gov/scapchecklists.cfm>

NIST National Checklist Program: <http://nvd.nist.gov/ncp.cfm>

**Open Vulnerability and Assessment Language SCAP Compatibility**

For a product to be considered SCAP compatible with respect to OVAL the
product must become OVAL compatible according to the MITRE OVAL
compatibility program. It must also process OVAL version 5.0 or greater.

OVAL Homepage: [http://oval.mitre.org](http://oval.mitre.org/)/

OVAL Compatibility: <http://oval.mitre.org/compatible/>

NVD XCCDF/OVAL data feed: <http://nvd.nist.gov/scapchecklists.cfm>