OpenSCAP

OpenSCAP is an open-source implementation of SCAP (the Security Content Automation Protocol), a suite of specifications from NIST — the US National Institute of Standards and Technology, the federal agency that publishes much of the country’s security guidance — for expressing security policy in a machine-readable form. In practice, OpenSCAP is the tool most often used on Linux to answer “does this system comply with that baseline?” — where the baseline is a CIS Benchmark, a DISA STIG, or a custom profile derived from one.

It does two distinct jobs:

• Evaluation. It runs a policy’s rules against a system and produces a report: a per-rule pass/fail and an overall compliance score.
• Remediation. It can generate and apply fixes for rules that failed, so hardening does not have to be hand-written.

The policy content itself usually comes from the SCAP Security Guide (SSG), an open-source project that maintains profiles for many operating systems. Content is OS-specific and version-specific: a RHEL 9 system must be evaluated against RHEL 9 content, and using the wrong profile produces a score that is meaningless rather than merely inaccurate.

Because it works against a filesystem as well as a running host, OpenSCAP fits naturally into an image build, where hardening can be applied and verified before anything is deployed.