# OpenSCAP

> An open-source scanner that evaluates a system against a SCAP security policy and can automatically remediate what fails.

**OpenSCAP** is an open-source implementation of **SCAP** (the Security Content Automation Protocol), a suite of specifications from **NIST** — the US National Institute of Standards and Technology, the federal agency that publishes much of the country's security guidance — for expressing security policy in a machine-readable form. In practice, OpenSCAP is the tool most often used on Linux to answer "does this system comply with that baseline?" — where the baseline is a [CIS Benchmark](https://primcoat.app/glossary/cis-benchmark), a [DISA STIG](https://primcoat.app/glossary/disa-stig), or a custom profile derived from one.

It does two distinct jobs:

- **Evaluation.** It runs a policy's rules against a system and produces a report: a per-rule pass/fail and an overall compliance score.
- **Remediation.** It can generate and apply fixes for rules that failed, so hardening does not have to be hand-written.

The policy content itself usually comes from the **SCAP Security Guide** (SSG), an open-source project that maintains profiles for many operating systems. Content is OS-specific and version-specific: a RHEL 9 system must be evaluated against RHEL 9 content, and using the wrong profile produces a score that is meaningless rather than merely inaccurate.

Because it works against a filesystem as well as a running host, OpenSCAP fits naturally into an image build, where hardening can be applied and verified before anything is deployed.

## Related

- https://primcoat.app/glossary/cis-benchmark.md
- https://primcoat.app/glossary/disa-stig.md
- https://primcoat.app/glossary/golden-image.md

---

Source: https://primcoat.app/glossary/openscap
Primcoat — a managed VM image factory. https://primcoat.app