- Home
- Infrastructure Testing Tools
- OpenSCAP
OpenSCAP
What it is
OpenSCAP is a collection of open-source tools for applying and enforcing the Security Content Automation Protocol (SCAP) standard. Its tools support security compliance and automated vulnerability checking through customizable policies. OpenSCAP Base includes a library and the oscap command-line tool for evaluating SCAP content, scanning systems, and producing documents. It works with XCCDF benchmarks and OVAL definitions, supports SCAP 1.2, and maintains backward compatibility with SCAP 1.1 and 1.0.
SCAP Workbench allows users to tailor content, scan local or remote systems, and export results. OpenSCAP Daemon schedules assessments of machines and containers. Users can adjust policy variables and rules, then save customized policies for reuse. Policies may include automated remediation, but the project warns that this can disrupt infrastructure and that some rules cannot be remediated automatically. The tools are free. OpenSCAP Base is available on Linux distributions including Red Hat Enterprise Linux, Fedora, and Ubuntu; the project also reports Windows support since version 1.3.0.
For and against
For
- Free and open-source tools.
- Supports XCCDF benchmarks and OVAL definitions.
- SCAP Workbench can run local or remote scans.
- OpenSCAP Daemon schedules machine and container assessments.
- Policies can be customized and saved for reuse.
Against
- Automated remediation can disrupt infrastructure functionality.
- Not all rules can be remediated automatically.
- Windows support is reported since version 1.3.0.
The verdict
OpenSCAP offers a free toolkit for SCAP-based scanning, policy customization, and scheduled assessment. Review remediation rules carefully because the project notes potential infrastructure disruption and gaps in automatic remediation.
Who it suits
OpenSCAP is aimed at government agencies and contractors, businesses, and the open-source community. It suits users who need configurable SCAP-based compliance checks or vulnerability assessments.
Plans and prices
OpenSCAP tools
All projects under the OpenSCAP umbrella are open source and can be downloaded and used for free.
Read 30 Sep 2026 · open-scap.org
On the record
- Automated remediation limit
- Security policies may include automated remediation, but the site warns that it can break infrastructure functionality and that not all rules can be remediated automatically.open-scap.org · read 30 Sep 2026
- Centralized management
- With Red Hat Satellite 6, the site describes centralized policy management, scheduled audits, and collection and search of audit results.open-scap.org · read 30 Sep 2026
- Certification
- The project says it was awarded SCAP 1.2 certification by NIST in 2014.open-scap.org · read 30 Sep 2026
- Compliance and vulnerability assessment
- The project provides tools and customizable policies for security compliance and automated vulnerability checking.open-scap.org · read 30 Sep 2026
- Container scanning
- Atomic Scan can scan containers for security vulnerabilities and compliance issues using the openscap Docker image in the official Red Hat registry.open-scap.org · read 30 Sep 2026
- Desktop scanning
- SCAP Workbench lets users tailor SCAP content, run local or remote scans, and export results.open-scap.org · read 30 Sep 2026
- Integrations
- The site lists integrations with Red Hat Satellite 6 (Foreman), Red Hat Satellite 5 (Spacewalk), RH Access Insights, Preupgrade Assistant, and orcharhino.open-scap.org · read 30 Sep 2026
- Intended users
- The site identifies government agencies and contractors, businesses, and the open source community as audiences for OpenSCAP.open-scap.org · read 30 Sep 2026
- OpenSCAP Base
- OpenSCAP Base provides a library and the oscap command-line tool to parse and evaluate SCAP content, scan systems, and format content into documents.open-scap.org · read 30 Sep 2026
- Policy customization
- Users can change policy variables, enable or disable rules, and save customized policies separately for reuse when the original content is updated.open-scap.org · read 30 Sep 2026
- Purpose
- OpenSCAP is a collection of open source tools for implementing and enforcing the Security Content Automation Protocol (SCAP) standard.open-scap.org · read 30 Sep 2026
- Scheduled assessment
- OpenSCAP Daemon evaluates machines and containers according to a schedule.open-scap.org · read 30 Sep 2026
- Supported content
- OpenSCAP Base supports XCCDF benchmarks and OVAL definitions and states support for SCAP 1.2 with backward compatibility for SCAP 1.1 and 1.0.open-scap.org · read 30 Sep 2026
- Supported operating systems
- OpenSCAP Base is available on Linux distributions including Red Hat Enterprise Linux, Fedora, and Ubuntu, and the site says it supports Microsoft Windows since version 1.3.0.open-scap.org · read 30 Sep 2026
