SCAP CompareSCAP Compare

See what changed between two release cycles

PairSelect Baseline and Compare
Baseline
Compare

Choose a benchmark, then pick two releases. Baseline is your reference; Compare is assessed against it. Click vs to swap.

Compare two release cycles

Select a benchmark and two versions above to see added, removed, and modified procedures.

About SCAP Compare

SCAP Compare shows what changed between two releases of a DISA SCAP benchmark, the automated XCCDF and OVAL content that SCAP Compliance Checker (SCC) and OpenSCAP run: rules added, rules removed, and rules whose title, severity, description, fix text or check logic changed. Pick a benchmark, set the Baseline to the release you're moving to and Compare to the one you scan with today.

What it compares

Rules are matched across the two releases by their STIG V-number, so a rule keeps its place even when its revision changes. Changed OVAL checks are shown as readable text (each test, the object it inspects and the state it expects), so you can see why a scan result might come out differently after an update.

When to use it

  • Explaining new scan results. A rule that starts failing after a benchmark update often has a changed check, not a changed system.
  • Rolling out a new benchmark. See which automated checks moved before switching your SCC or OpenSCAP scans to it.
  • Matching the STIG. A benchmark covers only the requirements a scanner can check, and DISA releases it on its own schedule; compare it with the STIG's own changes in STIG Compare.

Every benchmark's latest release has its own page of changes, linked from the benchmark and from the A–Z list of SCAP benchmarks.

Recent SCAP benchmark changes