Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

Configuration (FDCC)52 and profiles created under the United States Government Configuration
Baseline (USGCB)53
How to Implement SCAP
initiative.
To implement SCAP for ISCM, SCAP-validated54
To automate continuous monitoring of known software vulnerabilities, SCAP-expressed
checklists and SCAP-validated tools can be used to assess the software assets installed and derive
a mitigation strategy for known vulnerabilities based on risk severity. By performing regularly
scheduled scans of the enterprise architecture with the latest available SCAP-expressed security-
related information, a security officer and/or system administrator can attain on-demand
situational awareness of the security of their networked systems in terms of configuration settings
and mitigation of known software vulnerabilities.
tools and SCAP-expressed checklists are used
to automate secure configuration management and produce assessment evidence for many NIST
SP 800-53 security controls. SCAP-expressed checklists can be customized as appropriate to
meet specific organizational requirements. SCAP-expressed checklists can also map individual
system security configuration settings to their corresponding security requirements. For example,
mappings are available between Windows XP secure baseline configurations and the security
controls in NIST SP 800-53. These mappings can help demonstrate that the implemented settings
provide adequate security and adhere to requirements. The mappings are embedded in SCAP-
expressed checklists which allow SCAP-validated tools to generate assessment and compliance
evidence automatically. This can provide a substantial savings in effort and cost of configuration
management. If SCAP-validated tools are not available or are not currently deployed within an
organization, organizations should consider implementing SCAP-expressed checklists for their
secure baseline configurations in order to be well-positioned when SCAP-validated tools become
available and/or are deployed.
Partially Automated Controls
The implementation, assessment, and monitoring of some security controls may not be automated
by existing tools; however, they may be partially automated using the Open Checklist Interactive
Language (OCIL). OCIL defines a framework for expressing a set of questions to be presented to
a user and corresponding procedures to interpret responses to these questions. OCIL may be used
in conjunction with other SCAP specifications such as eXtensible Configuration Checklist
Description Format (XCCDF) to help handle cases where lower-level checking languages such as
Open Vulnerability and Assessment Language (OVAL) are unable to automate a particular check.
OCIL provides a standardized approach to express and evaluate manual security checks. For
example, a system user may be asked, "Do you have a safe to store documents?" The OCIL
specification provides the ability to define questions, define possible answers to a question from
which the user can choose, define actions to be taken resulting from a user's answer, and
enumerate the result set. One of the benefits of OCIL is that the answers can be returned in a
standardized format, allowing statistical analysis and other calculations to be performed in an
automated manner.
For more information on the FDCC, please refer to http://fdcc.nist.gov.
For more information on the USGCB, please refer to http://usgcb.nist.gov.
54 For more information on SCAP-validated products, please refer to http://nvd.nist.gov/scapproducts.cfm.