SCAP-NG is a pre-alpha successor to SCAP 1.4 focused on preserving supported assessment meaning while making security content easier to author, review, implement, execute, package, and consume.
- Preserve meaning through migration.
- Make authoring and review substantially simpler.
- Make semantics explicit and predictable.
- Scale through safe reuse of content and collected facts.
- Produce smaller, more useful results.
- Cover the complete policy lifecycle.
- Be trustworthy, interoperable, and governable.
- Reduce implementation complexity and enable efficient execution.
See the full objectives and objective-to-issue traceability.
- Specification: specification/README.md
- Real-world examples: Benchmark and Rule policy · technical Assessments · result fixtures
- Current review: review/current/README.md
- 0.3.0 schema: schema/v0.3.0/
- Six complete STIG conversions (ZIP): Direct six-STIG source ZIP · individual ZIPs
- Open issues / 0.3 work: GitHub issues
- Governance and published votes: board/README.md
Current source-derived six-STIG preview (October 9, 2026). These ZIPs are attached to a durable GitHub prerelease, not transient GitHub Actions artifacts. Select a benchmark for its complete candidate-authoring/ and faithful-authoring/ trees and SCORECARD.md.
| Benchmark | Direct ZIP download |
|---|---|
| Red Hat Enterprise Linux 9 | Download RHEL 9 |
| Oracle Linux 9 | Download Oracle Linux 9 |
| Windows 11 | Download Windows 11 |
| Windows Server 2025 | Download Windows Server 2025 |
| Windows Server DNS | Download Windows Server DNS |
| Apache HTTP Server 2.4 (UNIX) | Download Apache 2.4 |
All six in one: Download the combined six-STIG source ZIP · SHA-256 checksums · source SHA and embedded-Filter counts.
Built from SCAP-NG commit 324b6d4802c2961a774912291fb86138eb7d122b and pinned NIWC SCAP 1.4 source revision 8c8e5dff860af6b1290ee9273a282db24278f8d5. The six conversions contain 222 embedded Filter predicates, counted in candidate YAML by the published build manifest. Native authoring uses direct embedded Test and Filter predicates; the older faithful conversion remains in each archive for comparison. The six-source build and validation passed.
Status: These are pre-alpha, source-only authoring/design previews of DISA STIG-based NIWC-enhanced SCAP 1.4 content. They are not official DISA SCAP-NG benchmarks, compiled .scapng scanner packages, observed scan results, verified runtime equivalence, or an invitation to review/freeze SCAP-NG 0.3.0. The current review guide explains what to inspect; the Board's current A/B/C/D vocabulary Discussion is separate from release acceptance.
SCAP-NG uses Benchmark → Rule → Assessment. Native automated Assessments retain useful OVAL concepts such as Test, Object, local typed State predicates, Variable, and Item while removing legacy serialization and packaging machinery where it is not semantically required. Distribution uses modular source compiled into a self-contained manifest-based package.
Status: pre-alpha. Green CI, schema validation, conversion evidence, human acceptance, and Board ratification are distinct states.