OpenSCAP

OpenSCAP is a security compliance toolkit built around the oscap command-line tool. It loads, scans, validates, edits, and exports SCAP documents, letting administrators check systems against security baselines and turn the results into auditable reports.

It understands SCAP content such as XCCDF, OVAL, OCIL, and CPE data streams. Typical use validates a data stream, runs OVAL and XCCDF evaluations against a host, and renders the findings as HTML or other report formats for review and remediation tracking.

It pairs naturally with the ComplianceAsCode policy content, scanning Linux hosts against profiles like CIS, STIG, and PCI-DSS. It runs as a command-line program on Linux under the LGPL-2.1; official Windows support ended in 2022.