The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3

Waltermire, David; Quinn, Stephen; Booth, Harold; Scarfone, Karen; Prisaca, Dragos

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov. [12:20 pm ET - If you received "Page Not Found" errors recently, please retry accessing those files. File synchronization should now be complete.]

NIST SP 800-126 Rev. 3 (Initial Public Draft)

Further development of this draft has ceased (February 14, 2018).

The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3

Documentation Topics

Date Published: July 2016
Comments Due: August 19, 2016 (public comment period is CLOSED)
Email Questions to: 800-126comments@nist.gov

Author(s)

David Waltermire (NIST), Stephen Quinn (NIST), Harold Booth (NIST), Karen Scarfone (Scarfone Cybersecurity), Dragos Prisaca (G2)

Announcement

NIST invites comments on two draft publications on the Security Content Automation Protocol (SCAP). The first is Special Publication (SP) 800-126 Revision 3, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3. The second is SP 800-126A, SCAP 1.3 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3.

SP 800-126 Revision 3 and SP 800-126A collectively define the proposed technical specification for SCAP version 1.3, which is based on enhancements and clarifications to the SCAP 1.2 specification. SP 800-126A is a new publication that allows SCAP 1.3 to take advantage of selected minor version updates of SCAP component specifications, as well as designated Open Vulnerability and Assessment Language (OVAL) platform schema versions.

Abstract

The Security Content Automation Protocol (SCAP) is a suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans. This publication defines the technical composition of SCAP version 1.3 in terms of its component specifications, their interrelationships and interoperation, and the requirements for SCAP content.

Keywords

patch verification; security automation; security checklists; security configuration; 112 Security Content Automation Protocol (SCAP); software flaws; checklists; vulnerabilities

Control Families

Audit and Accountability; Assessment, Authorization and Monitoring; Configuration Management; Incident Response; Maintenance; Risk Assessment; System and Services Acquisition; System and Communications Protection

Documentation

Publication:
Draft SP 800-126 Rev. 3 (pdf)

Supplemental Material:
Comment Template (docx)

Other Parts of this Publication:
SP 800-126A

Related NIST Publications:
IR 7511 Rev. 5 (Draft)

Document History:
07/18/16: SP 800-126 Rev. 3 (Draft)

Topics

Security and Privacy

acquisition, audit & accountability, digital signatures, incident response, maintenance, risk assessment, security automation, threats, vulnerability management

Laws and Regulations

Federal Information Security Modernization Act, OMB Circular A-130