NIST public full text Public Domain

NIST SP 800-126A: SCAP 1.3 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3

Harold Booth (NIST); David Waltermire (NIST); Mark Badger (NIST); Melanie Cook (NIST); Stephen Quinn (NIST); Karen Scarfone (Scarfone Cybersecurity) · National Institute of Standards and Technology (NIST)

NIST · Standards · License: Public Domain

Open Source ↗

access-control computer-security cryptography cybersecurity identity incident-response nist privacy

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

NIST Special Publication 800-126A

SCAP 1.3 Component Specification Version Updates An Annex to NIST Special Publication 800-126 Revision 3

Harold Booth David Waltermire Lee Badger Melanie Cook Stephen D. Quinn Karen Scarfone

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

C O M P U T E R

S E C U R I T Y

NIST Special Publication 800-126A

SCAP 1.3 Component Specification Version Updates An Annex to NIST Special Publication 800-126 Revision 3 Harold Booth David Waltermire Lee Badger Melanie Cook Stephen D. Quinn Computer Security Division Information Technology Laboratory Karen Scarfone Scarfone Cybersecurity Clifton, Virginia This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

February 2018

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-126A Natl. Inst. Stand. Technol. Spec. Publ. 800-126A, 21 pages (February 2018) CODEN: NSPUE2 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Comments on this publication may be submitted to: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: 800-126comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Reports on Computer Systems Technology

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Abstract The Security Content Automation Protocol (SCAP) is a multi-purpose framework of component specifications that support automated configuration, vulnerability, and patch checking, security measurement, and technical control compliance activities. The SCAP version 1.3 specification is defined by the combination of NIST Special Publication (SP) 800-126 Revision 3, a set of schemas, and this document. This document allows the use of particular minor version updates to SCAP 1.3 component specifications and the use of particular Open Vulnerability and Assessment Language (OVAL) core schema and platform schema versions. Allowing use of these updates and schemas provides additional functionality for SCAP 1.3 without causing any loss of existing functionality.

Keywords Open Vulnerability and Assessment Language (OVAL); security automation; security configuration; Security Content Automation Protocol (SCAP)

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Acknowledgements The authors, Harold Booth, David Waltermire, Lee Badger, Melanie Cook, and Stephen D. Quinn of the National Institute of Standards and Technology (NIST) and Karen Scarfone of Scarfone Cybersecurity wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content, particularly Stephen Banghart and Joshua Lubell of NIST, and Dragos Prisaca of G2, Inc.

Trademark Information This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

All trademarks and registered trademarks belong to their respective organizations.

iii

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Errata This table will contain changes that have been incorporated into NIST Special Publication 800126A after the publication is finalized. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Date

Type

Change

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Pages

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Table of Contents 1

Introduction ............................................................................................................ 1 1.1 Purpose and Scope ........................................................................................ 1 1.2 Document Structure ........................................................................................ 2

Minor Version Updates in SCAP 1.3 Component Specifications ....................... 3 2.1 Criteria for Potential Inclusion ......................................................................... 3 2.2 Approved Minor Version Updates and SCAP 1.3 Requirements .................... 3

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

2.3 XML Schema and Schematron Schema Locations ......................................... 4 3

OVAL Platform Schemas ....................................................................................... 6 3.1 Criteria for Potential Inclusion ......................................................................... 6 3.2 Approved OVAL Platform Schema Versions and SCAP 1.3 Requirements .... 7

Additional Information on OVAL Data Types..................................................... 11

Document Management ....................................................................................... 12 List of Appendices

Appendix A— Acronyms and Abbreviations ............................................................ 13 Appendix B— Glossary .............................................................................................. 14 List of Tables Table 1: SCAP XML Schema and Schematron Schema Locations ................................ 4 Table 2: Approved OVAL Platform Schema Versions ..................................................... 7

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Introduction

Specification versioning is the process of denoting a revision to a specification by changing its version number. For example, the Security Content Automation Protocol (SCAP) specification documents are updated from time to time, and these updates trigger an increase in the SCAP version number (1.0, 1.1, 1.2, etc.) What makes specification versioning challenging is that there is no standard convention or terminology for it; each specification imparts different meanings into its version numbers. For example, moving from version 3.4 to version 3.5 might break backward compatibility for one specification, add new functionality for another specification, and simply correct an error in a third specification. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

This document defines two key terms for SCAP 1.3 component specification versioning: major and minor version updates. A major version update is a revision of a specification that breaks backward compatibility with the previous revision of the specification in numerous significant ways. A minor version update is a revision of a specification that may add or enhance functionality, fix bugs, and make other changes from the previous revision, but the changes have minimal impact, if any, on backward compatibility. 1.1

Purpose and Scope

The purpose of this document is to extend the contents of NIST Special Publication (SP) 800126 Revision 3 1 so that SCAP 1.3 is defined by the combination of the two documents and the set of schemas. Readers should be familiar with NIST SP 800-126 Revision 3 before reading this document. This document can only be used to make minor version updates of component specifications already included in SCAP 1.3 by NIST SP 800-126 Revision 3. Major version updates to SCAP 1.3 component specifications, as well as new component specifications not included in NIST SP 800-126 Revision 3, can only be added to a future version of SCAP as documented in a future revision of NIST SP 800-126. Each SCAP 1.3 extension specified in this document takes one of two forms. First, it may allow the use of particular minor version updates to SCAP 1.3 component specifications, or the use of particular Open Vulnerability and Assessment Language (OVAL) platform schema versions that work in conjunction with the OVAL 5.11 core schema included in SCAP 1.3. Second, it may specify one or more requirements for using these updates or OVAL platform schemas in an SCAP 1.3-conformant manner. This document specifies exactly which component specification minor version updates and OVAL platform schema versions may be used as part of SCAP 1.3 for several reasons, including the following: •

To support the interoperability of SCAP 1.3 tools and content

1 https://doi.org/10.6028/NIST.SP.800-126r3

NIST SP 800-126A

• •

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

To provide a basis for testing tools to ensure they comply with SCAP 1.3 To reduce the burden on SCAP 1.3 tool and content developers by clearly defining all SCAP 1.3 extensions in a single place

While organizations are free to use SCAP 1.3 with any schema or specification that they choose in any manner they choose, such usage is not considered SCAP 1.3-conformant unless defined as such in this document or in NIST SP 800-126 Revision 3. The scope of this document is versioning for SCAP 1.3 component specifications only. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

1.2

Document Structure

The rest of this document consists of the following sections and appendices: •

•

• • • •

Section 2 presents all minor version updates in SCAP 1.3 component specifications that have been approved for inclusion in SCAP 1.3, along with any corresponding requirements to be added to SCAP 1.3. This section also lists the criteria used to evaluate a minor version update for potential inclusion in SCAP 1.3. Section 3 specifies all OVAL platform schemas that have been approved for inclusion in SCAP 1.3, along with any corresponding requirements to be added to SCAP 1.3. This section also lists the criteria used to evaluate an OVAL platform schema for potential inclusion in SCAP 1.3. Section 4 is a placeholder for adding information on OVAL data types in the future. Section 5 describes the management processes for the document. Appendix A contains a list of acronyms and abbreviations used in the document. Appendix B contains a glossary for selected terms defined in the document.

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Minor Version Updates in SCAP 1.3 Component Specifications

This section defines the criteria used to evaluate minor version updates in SCAP 1.3 component specifications for potential inclusion in SCAP 1.3, then lists all such updates that have been approved for inclusion in SCAP 1.3, along with any corresponding requirements added to SCAP 1.3. It also provides the current XML schema (XSD) and Schematron schema locations corresponding to all SCAP 1.3 component specifications. 2.1

Criteria for Potential Inclusion

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

The following defines the criteria that a minor version update to an SCAP 1.3 component specification and associated requirements must meet before being considered for potential inclusion in this document: 1. One or more of the following must be true: a. The component specification is being revised strictly for bug fix or errata purposes. In other words, the update does not add new functionality or enhance existing functionality. b. The new minor version of the component specification is already being used by tools and/or content. c. The platform schema revision or component specification revision provides significant benefits, such as offering a solution for an important use case that previously had no solution. 2. The minor version update and associated requirements must not conflict with any existing SCAP 1.3 requirements, including minimizing any negative impact on backward compatibility. 2.2

Approved Minor Version Updates and SCAP 1.3 Requirements

The following SCAP 1.3 component specification minor version updates have been approved for inclusion in SCAP 1.3: •

OVAL 5.11.2 2

See Table 1 for the schema location for the component specification listed above. For all other component specifications, the versions listed in NIST SP 800-126 Revision 3 are the approved versions. As of this writing, no requirements need to be added to SCAP 1.3 to support the approved component specification minor version updates.

For more information on the changes from OVAL 5.11 to OVAL 5.11.2, see the changelog at https://github.com/OVALProject/Language/wiki/Changelog.

NIST SP 800-126A

2.3

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

XML Schema and Schematron Schema Locations

Table 1 lists the XML schema (XSD) locations (and Schematron schema locations, when applicable) for the SCAP component specifications. Table 1: SCAP XML Schema and Schematron Schema Locations

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Prefix

XML Schema Location

https://scap.nist.gov/schema/asset-identification/1.1/assetidentification_1.1.0.xsd

ARF

https://scap.nist.gov/schema/asset-reportingformat/1.1/asset-reporting-format_1.1.0.xsd

CPE Applicability Language

https://scap.nist.gov/schema/cpe/2.3/cpe-language_2.3.xsd

CPE Dictionary

https://scap.nist.gov/schema/cpe/2.3/cpe-dictionary_2.3.xsd

CPE Dictionary Extension

https://scap.nist.gov/schema/cpe/2.3/cpe-dictionaryextension_2.3.xsd

CPE Naming

https://scap.nist.gov/schema/cpe/2.3/cpe-naming_2.3.xsd

OCIL

https://scap.nist.gov/schema/ocil/2.0/ocil-2.0.xsd

OVAL 5.11.2 Common

https://raw.githubusercontent.com/OVALProject/Language/f3 c1751b0ec9f77ca16137d7efcab43b7900242e/schemas/ovalcommon-schema.xsd

OVAL 5.11.2 Definitions

https://raw.githubusercontent.com/OVALProject/Language/f3 c1751b0ec9f77ca16137d7efcab43b7900242e/schemas/ovaldefinitions-schema.xsd

OVAL 5.11.2 Directives

https://raw.githubusercontent.com/OVALProject/Language/f3 c1751b0ec9f77ca16137d7efcab43b7900242e/schemas/ovaldirectives-schema.xsd

OVAL 5.11.2 Results

https://raw.githubusercontent.com/OVALProject/Language/f3 c1751b0ec9f77ca16137d7efcab43b7900242e/schemas/ovalresults-schema.xsd

OVAL 5.11.2 System Characteristics

https://raw.githubusercontent.com/OVALProject/Language/f3 c1751b0ec9f77ca16137d7efcab43b7900242e/schemas/ovalsystem-characteristics-schema.xsd

OVAL 5.11.2 Variables

https://raw.githubusercontent.com/OVALProject/Language/f3 c1751b0ec9f77ca16137d7efcab43b7900242e/schemas/ovalvariables-schema.xsd

SCAP constructs

https://scap.nist.gov/schema/scap/1.2/scapconstructs_1.2.xsd

SCAP source data stream

https://scap.nist.gov/schema/scap/1.3/scap-source-datastream_1.3.xsd

SWID

http://standards.iso.org/iso/19770/-2/2015current/schema.xsd

Schematron Schema Location (if applicable) 3

Embedded in the schema

https://scap.nist.gov/revision/1.3/ oval-schematron-rules.zip

https://scap.nist.gov/revision/1.3/ scap-schematron-rules.zip

A complete bundle of Schematron schemas for SCAP 1.3 can be found on the SCAP website at: https://scap.nist.gov/revision/1.3/#schematron.

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Prefix

XML Schema Location

Schematron Schema Location (if applicable) 3

TMSAD

https://scap.nist.gov/schema/tmsad/1.0/tmsad_1.0.xsd

https://scap.nist.gov/schema/tms ad/1.0/tmsad_1.0.sch

XCCDF

https://scap.nist.gov/schema/xccdf/1.2/xccdf_1.2.xsd (XSD 1.0, where xsd:import statements use absolute URLs), https://scap.nist.gov/schema/xccdf/1.2/xccdf_1.2.zip (complete schema bundle, where xsd:import statements use relative URLs)

https://scap.nist.gov/schema/xcc df/1.2/xccdf_1.2.sch

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

OVAL Platform Schemas

OVAL version 5.11 introduced a new versioning policy that was a significant change from previous OVAL versions. 4 OVAL is now divided into the Core and Platform Extension languages. The Core defines the general functionality for OVAL, while each Platform Extension defines functionality specific to a particular platform, such as an operating system or an application. The Core and Platform Extensions languages can be updated separately, which provides greater flexibility. Interoperability is supported by requiring each Platform Extension to be based on a particular version of the Core. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

SCAP 1.3 supports the version(s) of the OVAL core schemas listed in Section 2 of this document. As a result, SCAP 1.3 could be extended to support one or more OVAL platform schemas that are based on the specified version(s) of the OVAL core schemas. Each OVAL platform schema has a composite version number; the first half corresponds to the core schema version it is based on, and the second half corresponds to the version of the platform schema itself. For example, a platform schema with version 5.11.2:1.0 would be the original version (1.0) of a platform schema based on core schema version 5.11.2. Some platform schemas used in SCAP may be based on earlier OVAL core schema versions. This works because the constructs supported in older OVAL core schema versions are expected to be supported in newer 5.x releases. This section defines the criteria used to evaluate OVAL platform schema versions that work in conjunction with SCAP 1.3-conformant OVAL core schemas for potential inclusion in SCAP 1.3. It then lists all OVAL platform schema versions that have been approved for inclusion in SCAP 1.3, along with any corresponding requirements added to SCAP 1.3. 3.1

Criteria for Potential Inclusion

The following defines the criteria that an OVAL platform schema version and associated requirements must meet before being considered for potential inclusion in this document: 1. The OVAL platform schema version must correspond to an SCAP 1.3-conformant OVAL core schema version. 2. The OVAL platform schema version and associated requirements must not conflict with any existing SCAP 1.3 requirements. This includes preserving full backward compatibility. 3. One or more of the following must be true: a. One or more platform vendors are already making significant use of the platform schema version. b. One or more tool vendors are already making significant use of the platform schema version. c. Operational organizations that are using SCAP 1.3-conformant tools to consume SCAP 1.3-conformant content are already making significant use of the platform schema version. 4

https://ovalproject.github.io/documentation/policy/versioning/

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

d. The platform schema version provides significant benefits, such as offering a solution for an important use case that previously had no solution. e. SCAP content is available that makes significant use of the platform schema version. f. The OVAL Board has demonstrated that there are significant benefits to using the platform schema version in conjunction with the SCAP 1.3 component specifications. 3.2

Approved OVAL Platform Schema Versions and SCAP 1.3 Requirements

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Table 2 lists the OVAL platform schema versions 5 that have been approved for inclusion in SCAP 1.3. Note that it is not expected nor desired that all SCAP 1.3-conformant tools will implement all of these OVAL platform schema versions. Table 2 indicates which OVAL platform schema versions are in scope for SCAP 1.3. SCAP 1.3-conformant tools should only implement the ones that are relevant for the purposes of each tool. Table 2: Approved OVAL Platform Schema Versions Platform Name

Schema Version

Schema Locations

General Independent

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/independent-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/independent-system-characteristicsschema.xsd

Server/client operating system AIX (IBM)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/aix-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/aix-system-characteristicsschema.xsd

FreeBSD (The FreeBSD Project)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/freebsd-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/freebsd-system-characteristicsschema.xsd

HP-UX (HP Enterprise)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/hpux-definitions-schema.xsd System Characteristics Schema:

More information on some OVAL platform schema versions is available at https://github.com/OVALProject/Language/wiki/Latest.

NIST SP 800-126A

Platform Name

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES Schema Version

Schema Locations https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/hpux-system-characteristicsschema.xsd

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Linux

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/linux-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/linux-system-characteristicsschema.xsd

MacOS (Apple)

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/macos-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/macos-system-characteristicsschema.xsd

Solaris (Oracle Corporation)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/solaris-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/solaris-system-characteristicsschema.xsd

UNIX

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/unix-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/unix-system-characteristicsschema.xsd

Windows (Microsoft Corporation)

5.11.1:1.4

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/7fa7bba7b48f09d ecb732d00b2be032a487ff9fc/schemas/windows-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/7fa7bba7b48f09d ecb732d00b2be032a487ff9fc/schemas/windows-system-characteristicsschema.xsd

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/esx-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/esx-system-characteristicsschema.xsd

Hypervisor ESX (VMware)

Mobile operating system Android (Google)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/android-definitions-schema.xsd

NIST SP 800-126A

Platform Name

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES Schema Version

Schema Locations System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/android-system-characteristicsschema.xsd

iOS (Apple)

5.11.1:1.2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/apple-ios-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/apple-ios-system-characteristicsschema.xsd

Networking device operations and configuration ASA (Cisco Systems)

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/asa-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/asa-system-characteristicsschema.xsd

CatOS (Cisco Systems)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/catos-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/catos-system-characteristicsschema.xsd

IOS (Cisco Systems)

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/ios-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/ios-system-characteristicsschema.xsd

IOS-XE (Cisco Systems)

5.11.1:1.2

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/iosxe-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/iosxe-system-characteristicsschema.xsd

JunOS (Juniper Networks)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/junos-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/junos-system-characteristicsschema.xsd

NETCONF (Internet Engineering Task Force [IETF])

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/netconf-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c

NIST SP 800-126A

Platform Name

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES Schema Version

Schema Locations a16137d7efcab43b7900242e/schemas/netconf-system-characteristicsschema.xsd

PixOS (Cisco Systems)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/pixos-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/pixos-system-characteristicsschema.xsd

Apache (The Apache Software Foundation)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/apache-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/apache-system-characteristicsschema.xsd

SharePoint (Microsoft Corporation)

5.11.1:1.1

Definitions Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/sharepoint-definitions-schema.xsd System Characteristics Schema: https://raw.githubusercontent.com/OVALProject/Language/f3c1751b0ec9f77c a16137d7efcab43b7900242e/schemas/sharepoint-system-characteristicsschema.xsd

Application This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

As of this writing, no requirements need to be added to SCAP 1.3 to support the approved OVAL platform schema versions.

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Additional Information on OVAL Data Types

This section is reserved for future use in providing additional information on OVAL data types. As of this writing, no additional data types have yet been defined.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Document Management

As explained in Section 1, the combination of this document, NIST SP 800-126 Revision 3, and the set of schemas defines the SCAP 1.3 specification. Having two documents allows SCAP 1.3 extensions to be defined in a separate document without having to update and re-release NIST SP 800-126 Revision 3 itself each time. It is also more convenient for SCAP tool and content developers to have a separate document that lists only the extensions. The adoption of extensions will be driven by community needs and feedback, major changes to platforms, and other trends and events. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

It is reasonable to expect that this document will be updated more often than NIST SP 800-126 Revision 3, but frequent updates to either document are not anticipated. Each update to either document may necessitate corresponding changes to NIST IR 7511, which defines the SCAP Validation Program derived test requirements (DTR). It is expected that revisions to NIST IR 7511 will cite the specific version of this document from which the test requirements are derived.

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Appendix A—Acronyms and Abbreviations

Selected acronyms and abbreviations used in this document are defined below.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

DTR

Derived Test Requirements

FOIA

Freedom of Information Act

IETF

Internet Engineering Task Force

Internal Report

ITL

Information Technology Laboratory

NIST

National Institute of Standards and Technology

OVAL

Open Vulnerability and Assessment Language

SCAP

Security Content Automation Protocol

Special Publication

NIST SP 800-126A

SCAP 1.3 COMPONENT SPECIFICATION VERSION UPDATES

Appendix B—Glossary

Selected terms used in this document are defined below. See the glossary appendix in NIST SP 800-126 Revision 3 for additional definitions.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126A

Major version update

A revision of a specification that breaks backward compatibility with the previous revision of the specification in numerous significant ways.

Minor version update

A revision of a specification that may add or enhance functionality, fix bugs, and make other changes from the previous revision, but the changes have minimal impact, if any, on backward compatibility.

Specification versioning

The process of denoting a revision to a specification by changing its version number.

NIST SP 800-126A: SCAP 1.3 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3

Analyze & explore related research in Conceptio

Related documents