var Component=(()=>{var p=Object.create;var a=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var y=Object.getOwnPropertyNames;var u=Object.getPrototypeOf,m=Object.prototype.hasOwnProperty;var g=(l,e)=>()=>(e||l((e={exports:{}}).exports,e),e.exports),f=(l,e)=>{for(var r in e)a(l,r,{get:e[r],enumerable:!0})},s=(l,e,r,c)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of y(e))!m.call(l,i)&&i!==r&&a(l,i,{get:()=>e[i],enumerable:!(c=E(e,i))||c.enumerable});return l};var C=(l,e,r)=>(r=l!=null?p(u(l)):{},s(e||!l||!l.__esModule?a(r,"default",{value:l,enumerable:!0}):r,l)),b=l=>s(a({},"__esModule",{value:!0}),l);var t=g((x,o)=>{o.exports=_jsx_runtime});var F={};f(F,{default:()=>h,frontmatter:()=>k});var n=C(t()),k={title:"XCCDF (Extensible Configuration Checklist Description Format)",description:"A standardized XML-based specification language for writing security checklists, benchmarks, and related documents that enable automated vulnerability management and security compliance testing.",tags:["Compliance","Security","Standards","Configuration Management"],letter:"X",relatedTerms:["SCAP","OVAL","CIS Benchmarks","Compliance Automation","Security Hardening"],date:"2023-06-29"};function d(l){let e={a:"a",code:"code",figure:"figure",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",span:"span",strong:"strong",ul:"ul",...l.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)(e.h2,{id:"what-is-xccdf",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#what-is-xccdf",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"What is XCCDF?"]}),` `,(0,n.jsx)(e.p,{children:"The Extensible Configuration Checklist Description Format (XCCDF) is a standardized XML-based specification language for writing security checklists, benchmarks, and related documents. Developed by the National Institute of Standards and Technology (NIST), XCCDF is a key component of the Security Content Automation Protocol (SCAP) and provides a structured way to express security configuration rules, evaluate compliance with these rules, and report results."}),` `,(0,n.jsx)(e.p,{children:"XCCDF enables organizations to automate security compliance testing across various platforms and applications, ensuring consistent security configurations and helping to identify vulnerabilities in system setups."}),` `,(0,n.jsxs)(e.h2,{id:"core-components-of-xccdf",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#core-components-of-xccdf",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Core Components of XCCDF"]}),` `,(0,n.jsxs)(e.h3,{id:"benchmark",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#benchmark",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Benchmark"]}),` `,(0,n.jsx)(e.p,{children:"The root element of an XCCDF document that contains the entire security checklist:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Benchmark"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_benchmark_example-benchmark"'})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" xmlns"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"http://checklists.nist.gov/xccdf/1.2"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"status"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" date"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"2023-06-29"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">draft"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"title"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Example Security Benchmark"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"description"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Security guidelines for Example System"})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:" "})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"profile",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#profile",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Profile"]}),` `,(0,n.jsx)(e.p,{children:"A named set of rules and values tailored for a specific use case or compliance requirement:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Profile"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_profile_high-security"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"title"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">High Security Profile"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"description"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Configuration settings for high-security environments"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"select"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" idref"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_require-complex-passwords"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" selected"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"true"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"/>"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"select"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" idref"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_enable-firewall"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" selected"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"true"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"/>"})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:" "})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"rule",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#rule",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Rule"]}),` `,(0,n.jsx)(e.p,{children:"A specific security configuration check that can be evaluated automatically:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Rule"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_require-complex-passwords"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" selected"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"false"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"title"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Require Complex Passwords"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"description"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Ensure that passwords meet complexity requirements"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"rationale"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Complex passwords are more resistant to brute-force attacks"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"fix"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Set the MinimumPasswordLength to 12 in the system configuration"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"check"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" system"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"http://oval.mitre.org/XMLSchema/oval-definitions-5"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"check-content-ref"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" href"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"example-oval.xml"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" name"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"oval:org.example:def:123"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"/>"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" "})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"value",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#value",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Value"]}),` `,(0,n.jsx)(e.p,{children:"Variables used in rules that may change based on the environment or profile:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Value"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_value_password-min-length"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" type"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"number"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"title"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Minimum Password Length"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"description"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">The minimum number of characters required for passwords"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"value"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">12"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"value"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" selector"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"high-security"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">16"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"value"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" selector"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"standard-security"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">8"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"group",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#group",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Group"]}),` `,(0,n.jsx)(e.p,{children:"A logical collection of rules, values, and other groups for organizational purposes:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Group"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_group_account-security"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"title"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Account Security"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"description"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Rules related to account and authentication security"})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:" "})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h2,{id:"xccdf-in-the-software-supply-chain",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#xccdf-in-the-software-supply-chain",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"XCCDF in the Software Supply Chain"]}),` `,(0,n.jsxs)(e.h3,{id:"configuration-security",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#configuration-security",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Configuration Security"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF helps ensure that software components are deployed with secure configurations:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Default Configuration Validation"}),": Verifying that default software configurations meet security requirements"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Third-Party Component Settings"}),": Ensuring that integrated components and dependencies are configured securely"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Runtime Environment Checks"}),": Validating that the operating environment for software is hardened appropriately"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"compliance-automation",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#compliance-automation",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Compliance Automation"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF enables automated verification of compliance with security policies and standards:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Continuous Compliance Checking"}),": Regular automated assessment of configuration compliance"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"DevSecOps Integration"}),": Building compliance checks into CI/CD pipelines"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Infrastructure as Code Validation"}),": Verifying secure configurations in infrastructure definitions"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"security-posture-management",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#security-posture-management",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Security Posture Management"]}),` `,(0,n.jsx)(e.p,{children:"Organizations use XCCDF to maintain and improve their security posture:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Baseline Configuration"}),": Establishing a secure baseline for systems and applications"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Drift Detection"}),": Identifying when configurations deviate from the secure baseline"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Remediation Guidance"}),": Providing standardized instructions for fixing security issues"]}),` `]}),` `,(0,n.jsxs)(e.h2,{id:"xccdf-in-security-standards-and-frameworks",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#xccdf-in-security-standards-and-frameworks",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"XCCDF in Security Standards and Frameworks"]}),` `,(0,n.jsxs)(e.h3,{id:"nist-security-content",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#nist-security-content",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"NIST Security Content"]}),` `,(0,n.jsx)(e.p,{children:"NIST publishes XCCDF-based security content for various platforms:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"NIST SP 800-53 Controls"}),": Security controls mapped to XCCDF checks"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"NIST National Checklist Program"}),": Repository of security configuration checklists"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"cis-benchmarks",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#cis-benchmarks",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"CIS Benchmarks"]}),` `,(0,n.jsx)(e.p,{children:"The Center for Internet Security (CIS) provides XCCDF-formatted benchmarks for:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Operating Systems"}),": Windows, Linux, macOS, etc."]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Cloud Platforms"}),": AWS, Azure, Google Cloud"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Applications"}),": Databases, web servers, containerization platforms"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"disa-stigs",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#disa-stigs",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"DISA STIGs"]}),` `,(0,n.jsx)(e.p,{children:"The Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) are available in XCCDF format for:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Military Systems"}),": Specialized configurations for defense systems"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Standard Software"}),": Common operating systems and applications used in defense contexts"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Network Devices"}),": Routers, switches, and other network infrastructure"]}),` `]}),` `,(0,n.jsxs)(e.h2,{id:"how-xccdf-works-with-other-scap-components",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#how-xccdf-works-with-other-scap-components",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"How XCCDF Works with Other SCAP Components"]}),` `,(0,n.jsxs)(e.h3,{id:"oval-open-vulnerability-and-assessment-language",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#oval-open-vulnerability-and-assessment-language",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"OVAL (Open Vulnerability and Assessment Language)"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF rules often reference OVAL definitions for the actual technical checks:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"check"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" system"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"http://oval.mitre.org/XMLSchema/oval-definitions-5"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"check-content-ref"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" href"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"oval-definitions.xml"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" name"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"oval:org.example:def:123"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"/>"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"cpe-common-platform-enumeration",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#cpe-common-platform-enumeration",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"CPE (Common Platform Enumeration)"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF can specify which platforms a benchmark applies to using CPE identifiers:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsx)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"platform"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" idref"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"cpe:/o:microsoft:windows_server:2019"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"/>"})]})})})}),` `,(0,n.jsxs)(e.h3,{id:"cce-common-configuration-enumeration",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#cce-common-configuration-enumeration",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"CCE (Common Configuration Enumeration)"]}),` `,(0,n.jsx)(e.p,{children:"Rules can reference CCE identifiers for specific configuration issues:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Rule"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_require-complex-passwords"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" selected"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"false"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"ident"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" system"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"https://nvd.nist.gov/cce/index.cfm"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">CCE-27345-6"})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:" "})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"cvss-common-vulnerability-scoring-system",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#cvss-common-vulnerability-scoring-system",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"CVSS (Common Vulnerability Scoring System)"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF can incorporate CVSS scores to prioritize security issues:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"Rule"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_fix-critical-vulnerability"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" severity"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"high"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"metadata"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"cvss:base"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">9.8"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"cvss:vector"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" "})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:" "})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h2,{id:"implementing-xccdf-in-security-workflows",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#implementing-xccdf-in-security-workflows",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Implementing XCCDF in Security Workflows"]}),` `,(0,n.jsxs)(e.h3,{id:"authoring-xccdf-content",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#authoring-xccdf-content",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Authoring XCCDF Content"]}),` `,(0,n.jsx)(e.p,{children:"Tools for creating XCCDF documents include:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"SCAP Workbench"}),": GUI tool for creating and editing SCAP content"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"OpenSCAP"}),": Command-line utilities for managing SCAP content"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"ComplianceAsCode"}),": Open-source project for building compliance content"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"evaluating-with-xccdf",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#evaluating-with-xccdf",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Evaluating with XCCDF"]}),` `,(0,n.jsx)(e.p,{children:"The evaluation process typically involves:"}),` `,(0,n.jsxs)(e.ol,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Selecting a Benchmark"}),": Choosing the appropriate security checklist"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Choosing a Profile"}),": Selecting the security profile that matches requirements"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Running an Assessment"}),": Executing the checks against target systems"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Reviewing Results"}),": Analyzing compliance status and failures"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Remediation"}),": Implementing fixes for non-compliant settings"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"example-xccdf-assessment-command",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#example-xccdf-assessment-command",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Example XCCDF Assessment Command"]}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"bash","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"bash","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:"# Using OpenSCAP to evaluate a system against the CIS Benchmark"})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:"oscap"}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:" xccdf eval --profile xccdf_org.cisecurity_profile_Level_1_Server "}),(0,n.jsx)(e.span,{style:{color:"#79B8FF"},children:"\\"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#79B8FF"},children:" --results"}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:" results.xml "}),(0,n.jsx)(e.span,{style:{color:"#79B8FF"},children:"\\"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#79B8FF"},children:" --report"}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:" report.html "}),(0,n.jsx)(e.span,{style:{color:"#79B8FF"},children:"\\"})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:" CIS_Benchmark.xml"})})]})})}),` `,(0,n.jsxs)(e.h2,{id:"xccdf-results-and-reporting",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#xccdf-results-and-reporting",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"XCCDF Results and Reporting"]}),` `,(0,n.jsxs)(e.h3,{id:"results-format",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#results-format",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Results Format"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF evaluation results are also XML-formatted:"}),` `,(0,n.jsx)(e.figure,{"data-rehype-pretty-code-figure":"",children:(0,n.jsx)(e.pre,{style:{backgroundColor:"#24292e",color:"#e1e4e8"},tabIndex:"0","data-language":"xml","data-theme":"github-dark",children:(0,n.jsxs)(e.code,{"data-language":"xml","data-theme":"github-dark",style:{display:"grid"},children:[(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"<"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"TestResult"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" id"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_testresult_1"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" start-time"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"2023-06-29T10:15:00Z"'}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" end-time"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"2023-06-29T10:20:00Z"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"rule-result"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" idref"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_require-complex-passwords"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"result"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">pass"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" "})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"rule-result"}),(0,n.jsx)(e.span,{style:{color:"#B392F0"},children:" idref"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:"="}),(0,n.jsx)(e.span,{style:{color:"#9ECBFF"},children:'"xccdf_org.example_rule_enable-firewall"'}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"result"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">fail"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" <"}),(0,n.jsx)(e.span,{style:{color:"#85E89D"},children:"message"}),(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:">Firewall service is not running"})]}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:" "})]}),` `,(0,n.jsx)(e.span,{"data-line":"",children:(0,n.jsx)(e.span,{style:{color:"#6A737D"},children:" "})}),` `,(0,n.jsxs)(e.span,{"data-line":"",children:[(0,n.jsx)(e.span,{style:{color:"#E1E4E8"},children:""})]})]})})}),` `,(0,n.jsxs)(e.h3,{id:"common-result-types",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#common-result-types",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Common Result Types"]}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"pass"}),": The target system complies with the rule"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"fail"}),": The target system does not comply with the rule"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"error"}),": An error occurred while checking the rule"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"unknown"}),": The rule checking system couldn't determine compliance"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"notapplicable"}),": The rule doesn't apply to the target system"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"notchecked"}),": The rule was not evaluated"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"informational"}),": The rule provides information but doesn't check compliance"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"fixed"}),": A remediation was applied, and the system now complies"]}),` `]}),` `,(0,n.jsxs)(e.h3,{id:"reporting-and-integration",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#reporting-and-integration",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Reporting and Integration"]}),` `,(0,n.jsx)(e.p,{children:"XCCDF results can be:"}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Transformed to HTML/PDF"}),": Human-readable compliance reports"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Integrated with GRC Platforms"}),": Governance, Risk, and Compliance systems"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Stored for Trend Analysis"}),": Tracking compliance improvements over time"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Exported to Dashboards"}),": Visualizing compliance status across the organization"]}),` `]}),` `,(0,n.jsxs)(e.h2,{id:"advantages-of-xccdf",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#advantages-of-xccdf",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Advantages of XCCDF"]}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Standardization"}),": Common format understood by multiple security tools"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Portability"}),": XCCDF content works across various platforms and vendors"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Automation"}),": Enables automated checks rather than manual inspection"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Scalability"}),": Same benchmarks can be applied to thousands of systems"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Customization"}),": Profiles allow tailoring security requirements to different contexts"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Separation of Concerns"}),": Distinct separation between policy (what to check) and mechanism (how to check)"]}),` `]}),` `,(0,n.jsxs)(e.h2,{id:"challenges-and-limitations",children:[(0,n.jsx)(e.a,{className:"subheading-anchor","aria-label":"Link to section",href:"#challenges-and-limitations",children:(0,n.jsx)(e.span,{className:"icon icon-link"})}),"Challenges and Limitations"]}),` `,(0,n.jsxs)(e.ul,{children:[` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Complexity"}),": Creating XCCDF content requires specialized knowledge"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Maintenance"}),": Security benchmarks need regular updates as technologies evolve"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Technical Depth"}),": Some security checks require complex OVAL definitions"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"Performance Impact"}),": Running comprehensive benchmarks can impact system performance"]}),` `,(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.strong,{children:"False Positives/Negatives"}),": Automated checks may miss context or report false issues"]}),` `]})]})}function h(l={}){let{wrapper:e}=l.components||{};return e?(0,n.jsx)(e,{...l,children:(0,n.jsx)(d,{...l})}):d(l)}return b(F);})(); ;return Component;

Policy as Code

See your software supply chain in full