Skip to content
SPECIFICTION
Get listed

OpenSCAP

open-scap.org

Free plan WindowsmacOSLinuxSelf-hosted
Visit open-scap.org
Spec score 7.7 #13 of 29 in Security Configuration Management Software

What it is

OpenSCAP is a free collection of open-source tools for applying and enforcing the Security Content Automation Protocol (SCAP) standard. It provides customizable policies for security compliance and automated vulnerability assessment. OpenSCAP Base includes a library and the oscap command-line tool for parsing and evaluating SCAP content, scanning systems and producing documents. It supports XCCDF benchmarks and OVAL definitions, with SCAP 1.2 support and backward compatibility for SCAP 1.1 and 1.0. SCAP Workbench can tailor content, run local or remote scans, and export results; OpenSCAP Daemon schedules assessments of machines and containers. Policy variables and rules can be changed, and customized policies saved separately for reuse. Integrations listed include Red Hat Satellite, RH Access Insights, Preupgrade Assistant and orcharhino. With Red Hat Satellite 6, the site describes centralized policy management, scheduled audits and audit-result collection and search. OpenSCAP Base is available on Linux distributions including Red Hat Enterprise Linux, Fedora and Ubuntu; the project also reports Windows support since version 1.3.0. Policies may include automated remediation, but some rules cannot be remediated automatically, and remediation may disrupt infrastructure functionality.

Spec sheet

Purpose
OpenSCAP is a collection of open source tools for implementing and enforcing the Security Content Automation Protocol (SCAP) standard.Read 30 Sep 2026 · open-scap.org
Intended users
The site identifies government agencies and contractors, businesses, and the open source community as audiences for OpenSCAP.Read 30 Sep 2026 · open-scap.org
Integrations
The site lists integrations with Red Hat Satellite 6 (Foreman), Red Hat Satellite 5 (Spacewalk), RH Access Insights, Preupgrade Assistant, and orcharhino.Read 30 Sep 2026 · open-scap.org
Automated remediation limit
Security policies may include automated remediation, but the site warns that it can break infrastructure functionality and that not all rules can be remediated automatically.Read 30 Sep 2026 · open-scap.org
Centralized management
With Red Hat Satellite 6, the site describes centralized policy management, scheduled audits, and collection and search of audit results.Read 30 Sep 2026 · open-scap.org
Certification
The project says it was awarded SCAP 1.2 certification by NIST in 2014.Read 30 Sep 2026 · open-scap.org
Compliance and vulnerability assessment
The project provides tools and customizable policies for security compliance and automated vulnerability checking.Read 30 Sep 2026 · open-scap.org
Container scanning
Atomic Scan can scan containers for security vulnerabilities and compliance issues using the openscap Docker image in the official Red Hat registry.Read 30 Sep 2026 · open-scap.org
Desktop scanning
SCAP Workbench lets users tailor SCAP content, run local or remote scans, and export results.Read 30 Sep 2026 · open-scap.org
OpenSCAP Base
OpenSCAP Base provides a library and the oscap command-line tool to parse and evaluate SCAP content, scan systems, and format content into documents.Read 30 Sep 2026 · open-scap.org
Policy customization
Users can change policy variables, enable or disable rules, and save customized policies separately for reuse when the original content is updated.Read 30 Sep 2026 · open-scap.org
Scheduled assessment
OpenSCAP Daemon evaluates machines and containers according to a schedule.Read 30 Sep 2026 · open-scap.org
Supported content
OpenSCAP Base supports XCCDF benchmarks and OVAL definitions and states support for SCAP 1.2 with backward compatibility for SCAP 1.1 and 1.0.Read 30 Sep 2026 · open-scap.org
Supported operating systems
OpenSCAP Base is available on Linux distributions including Red Hat Enterprise Linux, Fedora, and Ubuntu, and the site says it supports Microsoft Windows since version 1.3.0.Read 30 Sep 2026 · open-scap.org

Plans and prices

OpenSCAP tools Free All projects under the OpenSCAP umbrella are open source and can be downloaded and used for free. Read 30 Sep 2026 · open-scap.org

Every OpenSCAP plan and price →

Strong points and limits

Strong points

  • Free and open source
  • Supports XCCDF benchmarks and OVAL definitions
  • Workbench runs local or remote scans
  • Daemon schedules machine and container assessments
  • Policies can be customized and saved for reuse

Limits

  • Automated remediation can disrupt infrastructure functionality
  • Not all rules can be remediated automatically
  • OpenSCAP Base availability varies by operating system

Who it suits

OpenSCAP suits government agencies and contractors, businesses, and open-source users who need SCAP-based compliance checks or vulnerability assessment. Its tools also support teams managing policy and scheduled audits through listed integrations.

Verdict

OpenSCAP provides a set of SCAP tools for scanning, policy customization and scheduled assessment. Review the target operating system and test remediation policies carefully, since automated fixes may be incomplete or disrupt infrastructure.

Where Specifiction places it

Alternatives to OpenSCAPAll alternatives →