**Security Content Automation Protocol**

Version 1.0 Beta Last Revised 5/22/2007

**What is the Security Content Automation Protocol?**

The Security Content Automation Protocol (SCAP), pronounced "S Cap", is
a method for using specific standards to enable automated vulnerability
management, measurement, and policy compliance evaluation (e.g., FISMA
compliance). More specifically, SCAP is a suite of selected open
standards that enumerate software flaws, security related configuration
issues, and product names; measure systems to determine the presence of
vulnerabilities; and provide mechanisms to rank (score) the results of
these measurements in order to evaluate the impact of the discovered
security issues. SCAP defines how these standards are combined. The
National Vulnerability Database provides a repository and data feeds of
content that utilize the SCAP standards.

The U.S. National Institute of Standards and Technology (NIST) defines
and maintains the protocol and the data feeds of content in the SCAP
standards. Thus, NIST defines how to use the open standards within the
SCAP context and defines the mappings between the SCAP enumeration
standards. However, NIST does not control the underlying standards that
are used within the protocol. SCAP is comprised of the following
standards:

-   Common Vulnerabilities and Exposures (CVE®)

-   Common Configuration Enumeration (CCE™)

-   Common Platform Enumeration (CPE™)

-   Common Vulnerability Scoring System (CVSS)

-   Extensible Configuration Checklist Description Format (XCCDF)

-   Open Vulnerability and Assessment Language (OVAL™)

These open standards were created and are maintained by a number of
different institutions including the MITRE Corporation, the NSA, and a
special interest group within the Forum of Incident Response and
Security Teams (FIRST). NIST recommends the use of SCAP for security
automation and policy compliance activities.

**What is SCAP content?**

SCAP content consists of security checklist data represented in
automated XML formats, vulnerability and product name related
enumerations, and mappings between the enumerations.

The SCAP security checklist data is configuration checklists written in
machine readable languages (XCCDF). SCAP checklists have been submitted
to, and accepted by, the NIST National Checklist Program. They also
conform to an SCAP template and style guide to ensure compatibility with
SCAP products and services. The SCAP template and style guide discuss
requirements for including SCAP enumerations and mappings within the
checklist (see below). SCAP checklists refer to SCAP test procedures
(low level checks of machine state written in OVAL). SCAP test
procedures are used in conjunction with SCAP checklists.

The SCAP enumerations are a list of all known security related software
flaws (see CVE below), a list of known software configuration issues
(see CCE below), and a list of standard vendor and product names (see
CPE below).

The SCAP mappings interrelate the enumerations and provide standards
based impact measurements for software flaws and configuration issues.
Thus, for any given software flaw (CVE) one can determine the affected
standard product names (CPE). For any given standard product name (CPE),
one can determine the configuration issues that affect that product
(CCE). For any given software flaw (CVE) or configuration issue (CCE),
one can determine the standard impact score (CVSS). The National
Vulnerability Database (NVD) provides the official SCAP mappings.

**How do I obtain SCAP content?**

The U.S. government data repository for SCAP content is the National
Vulnerability Database (NVD), available at
[http://nvd.nist.gov](http://nvd.nist.gov/). NVD contains data feeds for
each standard that can be used license free by the security community.
NVD, and the associated National Checklist Program, also contain SCAP
security checklist data that can be used in conjunction with SCAP
compatible tools to automate vulnerability management and compliance
activities (e.g., FISMA). These data feeds can be directly used by
organizations to assist in automating their compliance and vulnerability
management programs. NVD is a product of NIST and is sponsored by the
U.S. Department of Homeland Security (DHS).

SCAP content repositories for security checklists may become available
directly from software vendors or checklist organizations. In such
cases, NVD will provide links to the non-NVD SCAP resources.

**Overview of SCAP**

SCAP currently leverages six (6) open standards that are shown in
table 1. The purpose of each standard is shown in table 2. This suite of
standards is expected to grow over time to address emerging issues that
face the vulnerability management and security compliance community.

  ---------------------------------------------------- ----------- ----------------- ----------------------
  ![](media/image1.png){width="1.1465277777777778in"   **CVE**     Common            Standard identifiers
  height="0.7131944444444445in"}                                   Vulnerabilities   and dictionary for
                                                                   and Exposures     security
                                                                                     vulnerabilities
                                                                                     related to software
                                                                                     flaws

  ![](media/image2.png){width="1.4333333333333333in"   **CCE**     Common            Standard identifiers
  height="0.7458333333333333in"}                                   Configuration     and dictionary for
                                                                   Enumeration       system configuration
                                                                                     issues related to
                                                                                     security

  ![](media/image3.png){width="1.625in"                **CPE**     Common Platform   Standard identifiers
  height="0.6888888888888889in"}                                   Enumeration       and dictionary for
                                                                                     platform/product
                                                                                     naming

  ![](media/image4.png){width="1.8319444444444444in"   **XCCDF**   eXtensible        Standard XML for
  height="0.8333333333333334in"}                                   Configuration     specifying checklists
                                                                   Checklist         and for reporting
                                                                   Description       results of checklist
                                                                   Format            evaluation

  ![](media/image5.png){width="1.41875in"              **OVAL**    Open              Standard XML for
  height="0.6479166666666667in"}                                   Vulnerability and testing procedures for
                                                                   Assessment        security related
                                                                   Language          software flaws,
                                                                                     configuration issues,
                                                                                     and patches as well as
                                                                                     for reporting the
                                                                                     results of the tests

  ![](media/image6.png){width="1.0965277777777778in"   **CVSS**    Common            Standard for conveying
  height="0.6125in"}                                               Vulnerability     and scoring the impact
                                                                   Scoring System    of vulnerabilities
  ---------------------------------------------------- ----------- ----------------- ----------------------

Table 1: SCAP suite of open standards

  ---------------------------------------------------- ----------- ----------------- ---------------- --------------- --------------- -------------
                                                                   **Enumeration**   **Evaluation**   **Measuring**   **Reporting**   **Content**

  ![](media/image1.png){width="0.6861111111111111in"   **CVE**     •                                                                  •
  height="0.42777777777777776in"}                                                                                                     

  ![](media/image2.png){width="0.9340277777777778in"   **CCE**     •                                                                  •
  height="0.4888888888888889in"}                                                                                                      

  ![](media/image3.png){width="0.9131944444444444in"   **CPE**     •                                                                  •
  height="0.3923611111111111in"}                                                                                                      

  ![](media/image4.png){width="0.9993055555555556in"   **XCCDF**                     •                                •               •
  height="0.4548611111111111in"}                                                                                                      

  ![](media/image5.png){width="0.9027777777777778in"   **OVAL**                      •                                •               •
  height="0.41180555555555554in"}                                                                                                     

  ![](media/image6.png){width="0.725in"                **CVSS**                                       •                               •
  height="0.40347222222222223in"}                                                                                                     
  ---------------------------------------------------- ----------- ----------------- ---------------- --------------- --------------- -------------

Table 2: Purpose of each SCAP standard

**Common Vulnerabilities and Exposures (CVE®)**

Common Vulnerabilities and Exposures (CVE) is a list or dictionary that
provides common identifiers for publicly known information security
vulnerabilities and exposures. Using a common identifier makes it easier
to share data across separate databases and tools that until CVE were
not easily integrated. This makes CVE the key to information sharing. If
a report from a security tool incorporates CVE identifiers, then it may
quickly and accurately access fix information in one or more separate
CVE-compatible databases to remediate the problem. CVE is managed by The
MITRE Corporation and is sponsored by the U.S. Department of Homeland
Security. CVE and the CVE logo are trademarks of The MITRE Corporation.
NVD incorporates all CVEs.

Note that the NVD CVE data feeds contain additional information not
provided by the actual CVE enumeration (but do contain the core CVE
data).

CVE Homepage: [http://cve.mitre.org](http://cve.mitre.org/)/

CVE Compatibility: <http://cve.mitre.org/compatible/>

NVD CVE/CCE data feed: <http://nvd.nist.gov/download.cfm#CVE_FEED>

**Common Configuration Enumeration (CCE™)**

The Common Configuration Enumeration (CCE) provides common identifiers
to system configurations in order to facilitate fast and accurate
correlation of configuration data across multiple information sources
and tools. With respect to SCAP, CCE is primarily used to identify
security related configuration issues. For example, CCE Identifiers
could be used to associate checks in configuration assessment tools with
statements in configuration best-practice documents. CCE is managed by
The MITRE Corporation and is sponsored by the U.S. Department of
Defense. CCE and the CCE logo are trademarks of The MITRE Corporation.
NVD incorporates all CCEs.

CCE Homepage: [http://cce.mitre.org](http://cce.mitre.org/)/

NVD CVE/CCE data feed: <http://nvd.nist.gov/download.cfm> (UNDER
DEVELOPMENT)

**Common Platform Enumeration (CPE™)**

The Common Platform Enumeration (CPE) is a structured naming scheme for
information technology systems, software, and packages. CPE is simply a
standards based dictionary of software product names (e.g., vendor
names, product names, version numbers, and editions). Based upon the
generic syntax for Uniform Resource Identifiers (URI), CPE includes a
formal name format, a method for matching names against known entities,
and a description format for binding text and tests to a name. CPE is
managed by The MITRE Corporation and is sponsored by the U.S. Department
of Defense. CPE and the CPE logo are trademarks of The MITRE
Corporation. The National Vulnerability Database (NVD) fully implements,
and is based upon, CPE.

The power of CPE will be realized as industry products adopt this
standard and then become interoperable as a result. The vision for the
U.S. government (both Civilian and Defense Department) is to purchase
CPE compatible products to enable interoperability.

CPE Homepage: <http://cpe.mitre.org/>

NVD CPE data feed: <http://nvd.nist.gov/download.cfm#Dictionary>

**Common Vulnerability Scoring System**

The Common Vulnerability Scoring System (CVSS) is an open standard for
assigning scores to a vulnerability that indicates its relative severity
compared to other vulnerabilities. It offers visibility into how each
score was calculated by revealing the underlying vulnerability
characteristics that are inputs to the score calculation. NVD publishes
CVSS scores for all CVE and CCE vulnerabilities (software flaws and
configurations issues).

CVSS is under the custodial care of the Forum of Incident Response and
Security Teams (FIRST). However, it is a completely free and open
standard. No one company "owns" CVSS and membership is not required to
use or implement it.

One advantage to using CVSS is that when an organization normalizes
vulnerability scores across all their software and hardware platforms,
they can leverage a single vulnerability management policy. This policy
may be similar to a service level agreement (SLA) that states how
quickly a particular vulnerability must be validated and remediated.

CVSS Homepage: <http://www.first.org/cvss/index.html>

CVSS Specification: <http://www.first.org/cvss/cvss-guide.html>

NVD CVSS data feed: <http://nvd.nist.gov/cvss.cfm>

**Extensible Configuration Checklist Description Format (XCCDF)**

The Extensible Configuration Checklist Description Format (XCCDF) is a
specification language for writing security checklists, benchmarks, and
related kinds of documents.  An XCCDF document represents a structured
collection of security configuration rules for some set of target
systems. The specification is designed to support information
interchange, document generation, organizational and situational
tailoring, automated compliance testing, and compliance scoring. The
specification also defines a data model and format for storing results
of benchmark compliance testing. The intent of XCCDF is to provide a
uniform foundation for expression of security checklists, benchmarks,
and other configuration guidance, and thereby foster more widespread
application of good security practices. XCCDF documents are expressed in
XML, and may be validated with an XML Schema-validating parser.
Development of the XCCDF specification is being led by the U.S. National
Security Agency, published by the U.S. National Institute of Standards
and Technology (NIST), and developed with contributions from the
security community.

For a checklist to be considered an SCAP checklist, it must conform to
the SCAP XCCDF template and style guide. This requires, among other
things, inclusion of relevant SCAP enumerations and mappings (CVE, CCE,
CPE, and CVSS) in the XCCDF file. In addition, the checklist must be
submitted to, and accepted by, the NIST National Checklist Program.

XCCDF was designed to support integration with multiple underlying
configuration checking \'engines\'.  The expected or default checking
technology is MITRE\'s Open Vulnerability and Assessment Language
(OVAL). In cases where the OVAL language does not support certain low
level checks, it is expected that an XCCDF check will be written that
will interface with vendor proprietary check engines.

XCCDF Standard: <http://nvd.nist.gov/xccdf.cfm>

NVD XCCDF/OVAL data feed: <http://nvd.nist.gov/scapchecklists.cfm>

NIST National Checklist Program: <http://nvd.nist.gov/ncp.cfm>

SCAP XCCDF style guide:

SCAP XCCDF template:

**Open Vulnerability and Assessment Language (OVAL™)**

The Open Vulnerability and Assessment Language (OVAL) is an open
standard XML language to promote open and publicly available security
content, and to standardize the transfer of this information across the
entire spectrum of security tools and services. OVAL includes a language
used to encode system details and an assortment of content repositories
held throughout the community. The language standardizes the three main
steps of the assessment process: representing configuration information
of systems for testing; analyzing the system for the presence of the
specified machine state (vulnerability, configuration, patch state,
etc.); and reporting the results of this assessment. OVAL is managed by
The MITRE Corporation and is sponsored by the U.S. Department of
Homeland Security. OVAL and the OVAL logo are trademarks of The MITRE
Corporation. OVAL is used within SCAP to automate performing low-level
security checks.

OVAL Homepage: [http://oval.mitre.org](http://oval.mitre.org/)/

OVAL Compatibility: <http://oval.mitre.org/compatible/>

NVD XCCDF/OVAL data feed: <http://nvd.nist.gov/scapchecklists.cfm>

\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--

Note: Some of the description text of the SCAP standards in this
document were copied, with permission from the various standards groups
that make up SCAP.