OpenSCAP

What Is OpenSCAP?

OpenSCAP is an open source toolkit that automates checking a system's configuration against security hardening baselines, using the NIST Security Content Automation Protocol. It evaluates a target against machine-readable policy content and produces a report suitable for an assessor.

It answers a different question from a vulnerability scanner, and conflating the two is both common and expensive. A vulnerability scanner asks what software is installed and whether any of it is known to be vulnerable. OpenSCAP asks whether the system is configured the way a baseline says it should be.

For regulated environments that distinction is the whole point. A STIG or CIS benchmark is a configuration standard, and an assessor wants evidence the configuration was machine-checked.

How SCAP, XCCDF and OVAL Fit Together

OpenSCAP is the tool; SCAP is the family of specifications it implements. The pieces that matter in practice:

• SCAP is the overarching NIST protocol — a set of specifications for expressing security content in machine-readable form.
• XCCDF describes the checklist itself: the rules, their rationale, their severity and how results are scored.
• OVAL describes how to actually test a given rule against a system — the technical definition behind each check.
• CPE identifies the platform, so content applies only to systems it was written for.

OpenSCAP consumes content written in these formats, evaluates a target, and emits results that can be handed to an assessor or consumed by a pipeline.

What OpenSCAP Does Not Tell You

OpenSCAP reports configuration conformance. It does not report safety, and treating a passing scan as a security verdict is the most common way organisations misuse it.

The boundaries worth being explicit about:

• A system can pass a benchmark completely while running a component with an unpatched critical vulnerability.
• Benchmarks encode a baseline, not your threat model — conformance is a floor rather than a target.
• Content quality varies, since baselines are written for specific platform versions and age with them.
• A container is not a host, so host-oriented benchmark rules frequently do not apply cleanly to an image.

Configuration checking and vulnerability scanning are complementary, and neither substitutes for the other.

How to Use OpenSCAP in Production Environments

For container workloads specifically, the useful applications are narrower than the tool's full scope:

• Evaluate images against a container-appropriate profile, not a host baseline, since many host rules are meaningless inside an image.
• Run it in CI so a configuration regression fails a build rather than surfacing in an audit months later.
• Keep the generated reports as part of your evidence package; the artifact is what an assessor wants, not the assertion that you ran it.
• Track exceptions explicitly, with a justification per waived rule, because unexplained failures read far worse than documented ones.
• Refresh the content as new benchmark revisions are published, since stale policy content quietly stops testing what it claims to test.

How Hardened Container Images Support Configuration Evidence

A hardened image provider will typically claim conformance to a baseline. OpenSCAP is how a customer turns that claim into evidence rather than taking it on trust.

Echo lists STIG-compliant hardened configuration and FIPS-validated modules among its compliance claims (echo.ai/product). Machine-verifying such a claim against the relevant profile is precisely the job OpenSCAP does, and running it yourself is more persuasive to an assessor than a vendor attestation alone.

Worth noting that a minimal image can fail host-oriented rules simply because the components a rule inspects are absent by design. The assessor-facing detail is in STIG compliance for containers.

FAQs

Is OpenSCAP a vulnerability scanner?

No, and the distinction matters for compliance work. OpenSCAP evaluates whether a system's configuration matches a hardening baseline such as a STIG or CIS benchmark. A vulnerability scanner identifies installed software with known vulnerabilities. A system can pass an OpenSCAP scan completely while running components with unpatched critical vulnerabilities.

Can OpenSCAP evaluate container images?

Yes, with the caveat that the content must suit a container rather than a host. Many host-oriented benchmark rules — covering bootloaders, kernel parameters or system daemons — either do not apply inside an image or fail simply because the component they inspect was deliberately removed. Use container-appropriate profiles.

What is the difference between XCCDF and OVAL?

XCCDF describes the checklist: which rules exist, why they matter, their severity, and how results are scored. OVAL describes how to perform an individual check against a system. In practice XCCDF is the policy document and OVAL is the implementation detail behind each of its rules.

Does a passing OpenSCAP scan satisfy an auditor?

It contributes evidence rather than concluding the matter. Assessors generally want the generated report, the profile used, and a documented justification for any waived rules. A pass with unexplained exceptions, or against an outdated profile, tends to generate more questions than it answers. Retain the artifacts, not just the outcome.

How often should configuration scans run?

In CI on every build, so a configuration regression fails before it ships, plus periodically against running systems to catch drift. Benchmark content is revised over time, so refresh the policy content on a schedule too — stale content quietly stops testing what it claims to test while continuing to report passes.