[Verse 1] STIGs were made for human eyes to read and understand But automation needs a way to scan across the land SCAP Protocol Suite steps in to bridge this growing gap Making security checklists run with just a single tap [Chorus] Six specifications working as one team XCCDF, OVAL, CPE - building the machine CCE, CVSS, OCIL too - each one plays its part SCAP automation flowing like a work of art [Verse 2] XCCDF speaks in XML to structure every test Extensible Configuration format does it best Publishing STIGs in schemas machines can comprehend While keeping all the guidance that administrators depend [Chorus] Six specifications working as one team XCCDF, OVAL, CPE - building the machine CCE, CVSS, OCIL too - each one plays its part SCAP automation flowing like a work of art [Verse 3] OVAL dives deep with technical checks so precise "Is minimum length fifteen?" - it runs the test twice Open Vulnerability Assessment Language knows the way To verify configurations every single day [Bridge] CPE identifies the platform where tests should run CCE gives standard names when configuration's done CVSS scores the severity from low risk up to ten OCIL asks the questions that need human review again [Chorus] Six specifications working as one team XCCDF, OVAL, CPE - building the machine CCE, CVSS, OCIL too - each one plays its part SCAP automation flowing like a work of art [Verse 4] Common Platform Enumeration maps the systems right Common Configuration names keep standards burning bright When humans need to answer what machines cannot decide OCIL Interactive Language keeps reviewers as your guide [Outro] From manual checklists to automated scans SCAP Protocol Suite executes your plans Six components unified in automation's embrace Security compliance running at machine-driven pace
← Key Talking Points | 17a: When Business Leadership Values the Credential, Not the Security →