Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4

Ziring, Neal; Quinn, Stephen

doi:https://doi.org/10.6028/NIST.IR.7275r3

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov. [12:20 pm ET - If you received "Page Not Found" errors recently, please retry accessing those files. File synchronization should now be complete.]

NIST IR 7275 Rev. 3

Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4

Documentation Topics

Date Published: January 2008

Author(s)

Neal Ziring (DoD), Stephen Quinn (NIST)

Abstract

This report specifies the data model and Extensible Markup Language (XML) representation for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4. An XCCDF document is a structured collection of security configuration rules for some set of target systems. The XCCDF specification is designed to support information interchange, document generation, organizational and situational tailoring, automated compliance testing, and compliance scoring. The specification also defines a data model and format for storing results of security guidance or checklist compliance testing. The intent of XCCDF is to provide a uniform foundation for expression of security checklists and other configuration guidance, and thereby foster more widespread application of good security practices.

Keywords

benchmarks; checklists; eXtensible Configuration Checklist Description Format; FISMA; security controls; vulnerabilities; XCCDF

Control Families

Audit and Accountability; Configuration Management; Maintenance

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.7275r3
Download URL

Supplemental Material:
None available

Related NIST Publications:
IR 7275 Rev. 4
IR 7275 Rev. 2
IR 7275
IR 7188

Document History:
01/01/08: IR 7275 Rev. 3 (Final)

Topics

Security and Privacy

audit & accountability, maintenance, security automation