How a DISA STIG and its SCAP benchmark relate: the STIG covers every requirement, the SCAP benchmark covers the automatable ones as XCCDF + OVAL for SCC and OpenSCAP, and rule IDs match between them.
Two views of the same requirements
A STIG is the complete configuration standard for a technology: every requirement, including the ones a person has to verify by reading a policy or inspecting a setting. A SCAP benchmark is the automatable subset of that STIG, packaged in the Security Content Automation Protocol (SCAP) formats — XCCDF for the rules and OVAL for the check logic — so a scanner can evaluate a system on its own.
DISA's SCAP Compliance Checker (SCC) and OpenSCAP both read SCAP benchmarks. The scan result maps straight back onto the STIG checklist because the two share rule IDs: SCAP rule SV-257777r1155676 and STIG finding V-257777 are the same requirement.
How much of a STIG is automated?
Usually most of it, but never all of it. For example, the Red Hat Enterprise Linux 9 STIG V2R9 has 445 requirements, and its SCAP benchmark automates 392 of them. The rest — policy, documentation, and judgment calls — stay manual.
Not every STIG has a SCAP benchmark. Benchmarks exist mainly for operating systems and common applications; many device and application STIGs are manual only. The SCAP benchmark index lists every current one.
When to use which
- Scan with the SCAP benchmark first to settle the automatable requirements across many systems quickly and repeatably.
- Finish with the STIG checklist for the manual requirements, and use it as the record of the full assessment.
- Track changes in both: STIG Compare and SCAP Compare show what changed between releases, so you only re-check what moved.
Reading a SCAP check
OVAL check logic is hard to read in raw XML. STIG Vault renders each benchmark rule's checks as readable criteria — the objects tested (files, packages, registry keys, settings) and the states they must be in — alongside the rule's fix text and CCIs, so you can see what the scanner is actually verifying.
Frequently asked questions
Does passing a SCAP scan mean my system meets the STIG?
Not by itself. The SCAP benchmark only covers the automatable requirements; the manual STIG requirements still need a review.
Do SCAP benchmarks and STIGs have the same rule IDs?
Yes. A SCAP benchmark rule carries the same SV- rule ID as the matching STIG requirement, so scan results map directly onto the checklist.
What tools run SCAP benchmarks?
DISA's SCAP Compliance Checker (SCC) and the open-source OpenSCAP are the most common.