NIST SP 800-126Ar4 ipd: SCAP 1.4 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 4

Withdrawn Draft Warning Notice The attached draft document has been withdrawn and is provided solely for historical purposes. It has been followed by the document identified below. Withdrawal Date June 8, 2026 Original Release Date December 11, 2025

The attached draft document is followed by: Stage Final Series/Number NIST SP 800-126Ar4 Title SCAP 1.4 Component Specification Version Updates: An Annex to NIST SP 800-126r4 Publication Date June 2026 DOI https://doi.org/10.6028/NIST.SP.800-126Ar4 CSRC URL https://csrc.nist.gov/pubs/sp/800/126/a/r4/final Additional Information https://csrc.nist.gov/projects/security-content-automationprotocol

NIST Special Publication 800 NIST SP 800-126Ar4 ipd

SCAP 1.4 Component Specification Version Updates An Annex to NIST SP 800-126r4 Initial Public Draft Dragos Prisaca Stephen Quinn

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126Ar4.ipd

NIST Special Publication 800 NIST SP 800-126Ar4 ipd

SCAP 1.4 Component Specification Version Updates An Annex to NIST SP 800-126r4 Initial Public Draft Dragos Prisaca Stephen Quinn

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-126Ar4.ipd

December 2025

U.S. Department of Commerce Howard Lutnick, Secretary of Commerce National Institute of Standards and Technology Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax Publication History Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added to final publication.] Supersedes NIST Series XXX (Month Year) DOI [Will be added to final publication, if applicable.] How to Cite this NIST Technical Series Publication Prisaca D, Quinn SD (2025) SCAP 1.4 Component Specification Version Updates: An Annex to NIST SP 800-126r4. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800126Ar4 ipd. https://doi.org/10.6028/NIST.SP.800-126Ar4.ipd Author ORCID iDs Dragos Prisaca: 0009-0007-7361-8433 Stephen Quinn: 0000-0003-1436-684X

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

Public Comment Period December 11, 2025 – February 11, 2026 Submit Comments scap@nist.gov National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Additional Information Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/126/a/r4/ipd, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

1

Abstract

2 3 4 5 6 7 8 9

The Security Content Automation Protocol (SCAP) is a multi-purpose framework of component specifications that support automated configuration, vulnerability, patch checking, security measurement, and technical control compliance activities. The SCAP version 1.4 specification is defined by the combination of NIST SP 800-126r4, a set of schemas, and this document. This document allows the use of particular minor version updates to SCAP 1.4 component specifications and particular Open Vulnerability and Assessment Language (OVAL) schema versions to provide additional functionality for SCAP 1.4 without causing any loss of existing functionality.

10

Keywords

11 12

Open Vulnerability and Assessment Language (OVAL); security automation; security configuration; Security Content Automation Protocol (SCAP).

13

Reports on Computer Systems Technology

14 15 16 17 18 19 20 21 22 23

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

i

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

24

Call for Patent Claims

25 26 27 28 29 30 31

This public review includes a call for information on essential patent claims (claims whose use would be required for compliance with the guidance or requirements in this Information Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be directly stated in this ITL Publication or by reference to another publication. This call also includes disclosure, where known, of the existence of pending U.S. or foreign patent applications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.

32 33

ITL may require from the patent holder, or a party authorized to make assurances on its behalf, in written or electronic form, either:

34 35

a) assurance in the form of a general disclaimer to the effect that such party does not hold and does not currently intend holding any essential patent claim(s); or

36 37 38

b) assurance that a license to such essential patent claim(s) will be made available to applicants desiring to utilize the license for the purpose of complying with the guidance or requirements in this ITL draft publication either:

39 40

i.

under reasonable terms and conditions that are demonstrably free of any unfair discrimination; or

41 42

ii.

without compensation and under reasonable terms and conditions that are demonstrably free of any unfair discrimination.

43 44 45 46 47

Such assurance shall indicate that the patent holder (or third party authorized to make assurances on its behalf) will include in any documents transferring ownership of patents subject to the assurance, provisions sufficient to ensure that the commitments in the assurance are binding on the transferee, and that the transferee will similarly include appropriate provisions in the event of future transfers with the goal of binding each successor-in-interest.

48 49

The assurance shall also indicate that it is intended to be binding on successors-in-interest regardless of whether such provisions are included in the relevant transfer documents.

50

Such statements should be addressed to: scap@nist.gov

51

ii

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

52

Table of Contents

53

1. Introduction ...................................................................................................................................1

54 55 56

2. Minor Version Updates in SCAP 1.4-Component Specifications ........................................................3

57 58 59 60

3. Document Management .................................................................................................................5

61 62 63 64 65

Appendix A. List of Symbols, Abbreviations, and Acronyms .................................................................6

66

Appendix B. Glossary .........................................................................................................................7

67

Appendix C. Change Log .....................................................................................................................8

68

List of Tables

69

Table 1. SCAP XML Schema and Schematron Schema Locations ...........................................................4

70

iii

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

71

1. Introduction

72 73 74 75 76 77 78 79

Specification versioning is the process of denoting a revision to a specification by changing its version number. For example, the Security Content Automation Protocol (SCAP) specification documents are occasionally updated, and these updates trigger an increase in the SCAP version number (e.g., 1.2, 1.3, 1.4). This specification versioning is challenging because there is no standard convention or terminology for it; each specification imparts different meanings into its version numbers. For example, moving from version 3.4 to version 3.5 might break backward compatibility for one specification, add new functionality for another specification, and simply correct an error in a third specification.

80 81 82 83 84 85

This document defines two key terms for SCAP 1.4 component specification versioning: major and minor version updates. A major version update is a revision of a specification that breaks backward compatibility with the previous revision of the specification in numerous significant ways. A minor version update is a revision of a specification that may add or enhance functionality, fix bugs, and make other changes from the previous revision, but the changes have minimal impact, if any, on backward compatibility.

86

1.1. Purpose and Scope

87 88 89 90

The purpose of this document is to extend the contents of NIST Special Publication (SP) 800126r4 (Revision 4) so that SCAP 1.4 is defined by the combination of the two documents and the set of schemas. Readers should be familiar with SP 800-126r4 before reading this document.

91 92 93 94 95

This document can only be used to make minor version updates of component specifications that are already included in SCAP 1.4 by SP 800-126r4. Major version updates to SCAP 1.4 component specifications and new component specifications that are not included in SP 800126r4 can only be added to a future version of SCAP as documented in a future revision of SP 800-126.

96 97 98 99 100

Each SCAP 1.4 extension specified in this document takes one of two forms. First, it may allow the use of particular minor version updates to SCAP 1.4 component specifications or particular Open Vulnerability and Assessment Language (OVAL) versions included in SCAP 1.4. Second, it may specify one or more requirements for using these updates or OVAL schemas in an SCAP 1.4-conformant manner.

101 102

This document specifies exactly which component specification minor version updates and OVAL platform schema versions may be used as part of SCAP 1.4 for several reasons, including:

103

•

To support the interoperability of SCAP 1.4 tools and content

104

•

To provide a basis for testing tools to ensure that they comply with SCAP 1.4

105 106

•

To reduce the burden on SCAP 1.4 tool and content developers by clearly defining all SCAP 1.4 extensions in a single place

1

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

107 108 109

While organizations are free to use SCAP 1.4 with any schema or specification that they choose in any manner they choose, such usage is not considered to be SCAP 1.4-conformant unless defined as such in this document or in SP 800-126r4.

110

The scope of this document is versioning for SCAP 1.4 component specifications only.

111

1.2. Document Structure

112

The rest of this document consists of the following sections and appendices:

113 114 115 116

•

Section 2 presents all minor version updates in SCAP 1.4 component specifications that have been approved for inclusion in SCAP 1.4 along with any corresponding requirements to be added to SCAP 1.4. This section also lists the criteria used to evaluate a minor version update for potential inclusion in SCAP 1.4.

117

•

Section 3 describes the management processes for the document.

118

•

Appendix A lists the acronyms and abbreviations used in the document.

119

•

Appendix B provides a glossary of selected terms in this document.

120

•

Appendix C lists key changes made in this revision.

2

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

121

2. Minor Version Updates in SCAP 1.4-Component Specifications

122 123 124 125 126

This section defines the criteria used to evaluate minor version updates in SCAP 1.4 component specifications for potential inclusion in SCAP 1.4 and lists all such updates that have been approved for inclusion in SCAP 1.4 along with any additional corresponding requirements. It also provides the current XML schema (XSD) and Schematron schema locations that correspond to all SCAP 1.4 component specifications.

127

2.1. Criteria for Potential Inclusion

128 129 130

The following defines the criteria that a minor version update to an SCAP 1.4 component specification and associated requirements must meet before being considered for potential inclusion in this document:

131

1. One or more of the following must be true:

132 133 134 135 136 137 138 139

a. The component specification is being revised strictly for bug fixes or errata purposes. In other words, the update does not add new functionality or enhance existing functionality. b. The new minor version of the component specification is already being used by tools and/or content. c. The platform schema revision or component specification revision provides significant benefits, such as a solution for an important use case that previously had no solution.

140 141 142

2. The minor version update and associated requirements must not conflict with any existing SCAP 1.4 requirements, including minimizing any negative impact on backward compatibility.

143

2.2. Approved Minor Version Updates and SCAP 1.4 Requirements

144 145

The following SCAP 1.4 component specification minor version updates have been approved for inclusion in SCAP 1.4:

146

•

OVAL 5.12.x 1

147 148 149

For all other component specifications, the versions listed in SP 800-126r4 are the approved versions. As of this writing, no requirements need to be added to SCAP 1.4 to support the approved component specification minor version updates.

150

2.3. XML Schema and Schematron Schema Locations

151 152

Table 1 lists the XML schema (XSD) locations (and Schematron schema locations, when applicable) for the SCAP component specifications. 1 For more information on the changes from OVAL 5.11.2 to OVAL 5.12.2, see the changelogs at https://github.com/OVAL-

Community/OVAL/releases/tag/v5.12, https://github.com/OVAL-Community/OVAL/releases/tag/v5.12.1, and https://github.com/OVALCommunity/OVAL/releases/tag/v5.12.2.

3

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

153

Table 1. SCAP XML schema and Schematron schema locations Prefix

XML Schema Location

AI

https://csrc.nist.gov/schema/asset-identification/1.1/assetidentification_1.1.0.xsd https://csrc.nist.gov/schema/asset-reportingformat/1.1/asset-reporting-format_1.1.0.xsd https://csrc.nist.gov/schema/cpe/2.3/cpe-language_2.3.xsd

ARF CPE Applicability Language CPE Dictionary CPE Dictionary Extension CPE Naming OCIL OVAL 5.12.2 Schemas SCAP constructs SCAP source data stream TMSAD XCCDF

154

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

Schematron Schema Location (if applicable) 2

https://csrc.nist.gov/schema/cpe/2.3/cpedictionary_2.3.xsd https://csrc.nist.gov/schema/cpe/2.3/cpe-dictionaryextension_2.3.xsd https://csrc.nist.gov/schema/cpe/2.3/cpe-naming_2.3.xsd https://csrc.nist.gov/schema/ocil/2.0/ocil-2.0.xsd http://github.com/OVALCommunity/OVAL/tree/5.11.2_release/oval-schemas https://csrc.nist.gov/schema/scap/1.4/scapconstructs_1.4.xsd https://csrc.nist.gov/schema/scap/1.4/scap-source-datastream_1.4.xsd https://csrc.nist.gov/schema/tmsad/1.0/tmsad_1.0.xsd https://csrc.nist.gov/schema/xccdf/1.2/xccdf_1.2.xsd (XSD 1.0, where xsd:import statements use absolute URLs), https://csrc.nist.gov/schema/xccdf/1.2/xccdf_1.2.zip (complete schema bundle, where xsd:import statements use relative URLs)

Embedded in the schema

Embedded in the schema Embedded in the schema https://scap.nist.gov/revision/1. 3/scap-schematron-rules.zip https://csrc.nist.gov/schema/tm sad/1.0/tmsad_1.0.sch https://csrc.nist.gov/schema/xcc df/1.2/xccdf_1.2.sch

2 A complete bundle of Schematron schemas for SCAP 1.3 can be found on the SCAP website at https://scap.nist.gov/revision/1.3/#schematron.

4

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

155

3. Document Management

156

3.1. Composition

157 158 159

As stated in Sec. 1, the SCAP 1.4 specification comprises (a) SP 800‑126r4 (i.e., the core specification), (b) this annex (i.e., the extensions document), and (c) the normative component schemas referenced by these documents.

160

3.2. Rationale

161 162 163

Maintaining this extensions document separate from the core specification enables extensions to be published or revised without republishing SP 800‑126r4 and provides a single, consolidated catalogue of extensions for tool developers and content authors.

164

3.3. Update Cadence

165 166 167 168

The SCAP community’s adoption of extensions will be driven by community needs, feedback, major platform changes, and related trends. The extensions document MAY be updated more frequently than SP 800‑126r4, but the overall update cadence for both documents is expected to be infrequent.

169

3.4. Conformance and Assessment

170 171 172 173 174 175 176

NIST no longer operates the SCAP Validation Program. The National Voluntary Laboratory Accreditation Program (NVLAP) has terminated SCAP testing accreditation effective September 2, 2025. Accordingly, this specification does not anticipate revisions to NIST Interagency Report (IR) 7511 for SCAP 1.4. Organizations that develop independent conformance or interoperability assessments that are derived from this specification SHOULD cite the specific versions of SP 800‑126r4, this extensions document, and the referenced component schemas from which their test requirements are derived.

177

5

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

178

Appendix A. List of Symbols, Abbreviations, and Acronyms

179

Selected acronyms and abbreviations used in this document are defined below.

180 181

DTR Derived Test Requirements

182 183

FOIA Freedom of Information Act

184 185

IETF Internet Engineering Task Force

186 187

IR Interagency Report

188 189

ITL Information Technology Laboratory

190 191

NIST National Institute of Standards and Technology

192 193

OVAL Open Vulnerability and Assessment Language

194 195

SCAP Security Content Automation Protocol

196 197

SP Special Publication

198

6

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

199

Appendix B. Glossary

200 201

Selected terms used in this document are defined below. See the glossary in SP 800-126r4 for additional definitions.

202 203 204

major version update A revision of a specification that breaks backward compatibility with the previous revision of the specification in numerous significant ways.

205 206 207

minor version update A revision of a specification that may add or enhance functionality, fix bugs, and make other changes from the previous revision, but the changes have minimal impact, if any, on backward compatibility.

208 209

specification versioning The process of denoting a revision to a specification by changing its version number.

210

7

NIST SP 800-126Ar4 ipd (Initial Public Draft) December 2025

211

Appendix C. Change Log

212

Revision 4 Release 1 – TBD

213 214 215 216

• • • •

SCAP 1.4 Component Specification Version Updates: Annex to NIST SP 800-126r4

Updated all references of SCAP 1.3 to SCAP 1.4 Updated OVAL version to 5.12.2 Removed OVAL ‘core’ and ‘platform’ schema version information Removed SWID requirements

217

8

Related documents

• NIST SP 800-126Ar4: SCAP 1.4 Component Specification Version Updates: An Annex to NIST SP 800-126r4#269080
• NIST SP 800-85A-4: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)#3050
• NIST SP 800-70r5 ipd: National Checklist Program for IT Products: Guidelines for Checklist Users and Developers#3036
• Updated Specification of the IPv4 ID Field#144363
• Resolution 2745 (2024) / adopted by the Security Council at its 9695th meeting, on 30 July 2024#425938