SCAP packages (or checklists) are used to conduct security or configuration assessments of systems deployed in an organization. They make use of various standards:

• Dictionaries: Provides references to the CPE standard
• Checklists: Provides references to the XCCDF standard
• Checks: Provides references to OVAL or OCIL standards

SCAP packages are created when the downloaded security checklists are imported into Client Management.

Starting from SCAP version 1.2, the aforementioned components are organized in a data stream collection. Aim is to group all these external components into a single XML bundle, and to provide mapping capabilities between them. Notice that SCAP 1.2 packages and above can still make reference to external components, such as XCCDF tailoring documents. For information on how to import SCAP packages, see Importing new SCAP packages.

Security checklists of versions 1.0 and 1.1

The SCAP package must be imported using a ZIP archive including all the components, such as XCCDF benchmark, XCCDF tailoring document, CPE dictionaries, OVAL definitions and possibly other files. To provide a consistent user experience, SCAP 1.0 and 1.1 packages are imported as SCAP data stream collections. Therefore, some virtual items are automatically created to bind the standalone documents together. The data stream collection name and the data stream name are both derived from the benchmark’s identifier.

Security checklists of version 1.2 and 1.3

The SCAP packages can be imported directly or in batches using a ZIP archive with multiple SCAP 1.2 and SCAP 1.3 XML documents. If the SCAP packages have external references, then all the required files must be grouped in a ZIP archive to be imported. The SCAP packages name is derived from their data stream collection identifier.

General data of an SCAP package

This view displays the following data about a specific SCAP package:

• SCAP package Data Stream
• SCAP package Benchmarks