Security Content Automation Protocol (SCAP) Compliance Checker

SCC is a SCAP Validated Authenticated Configuration Scanner, with support for SCAP versions 1.0, 1.1, 1.2, 1.3 and 1.4.

Primary Features

Performs authenticated configuration scanning using SCAP content
Supports local and remote scanning of Windows and Linux/Solaris
Supports Cisco IOS and IOS XE with offline configuration scanning and SSH based scanning
Has graphical and command line interfaces
Native executables per platform

Man looking over computer code on two monitors at a desk.

Latest Software Release

Version: 5.15
Release Date: 09/01/2026

Download SCC_5.15_Checksums.txt (3kb, txt)

SCAP Content Repository Tutorial Videos

End User License (2kb, txt)

Platforms Supported

Windows 10, 11
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025
Red Hat Enterprise Linux 7, 8, 9, 10 (x64 and aarch64)
Solaris 11 (x86 and SPARC)
Ubuntu 18.04, 20.04, 22.04, 24.04, 26.04 (amd64 and arm64)
SUSE Linux Enterprise 12, 15
Oracle Linux 7, 8, 9
Raspberry Pi OS (arm64)
Cisco IOS & IOS XE

Standards Supported

SCAP 1.0
- Validated February 25, 2009
SCAP 1.1
SCAP 1.2
- Validated August 26, 2016
SCAP 1.3
- Validated 11/04/2022
- View Validation

Obtaining the Software

Starting with version 5.4, SCC is publicly available and can be downloaded from Defense Information Systems Agency (DISA).

Credits

The development of SCC has been funded by several different agencies over the years:

2008 – 2010: Internal Revenue Service (IRS)
2010 – 2012: National Security Agency (NSA)
2013 – 2022: Defense Information Systems Agency (DISA)
FY23 – 24: Two groups of SCC end users

For FY25 and beyond, we are looking for additional groups/teams interested in funding SCC development and support.

References

SCAP: https://csrc.nist.gov/projects/security-content-automation-protocol
DISA: https://www.cyber.mil/stigs/

NIWC Atlantic Overhauls National SCAP Standards to Secure Defense Networks

Naval Information Warfare Center (NIWC) Atlantic spearheaded a two-year initiative to modernize national cybersecurity standards, directly shaping NIST’s Special Publication 800-126 Revision 4. Led by Jack Vander Pol, the team enhanced automation capabilities, increased DISA STIG compliance checks...