OpenSCAP is a collection of open-source tools that implement the Security Content Automation Protocol (SCAP), a NIST standard for describing and checking security configurations and vulnerabilities. It includes a scanner, a library and command-line utilities that check systems against security baselines such as hardening and compliance requirements. Administrators run the tools on their own Linux systems and servers. It is intended for repeatable, verifiable configuration checks.
OpenSCAP was started by Red Hat as an open-source community project. Red Hat is headquartered in Raleigh, North Carolina, and is a subsidiary of IBM. The project is licensed under LGPL-2.1, is developed on GitHub and has a public mailing list for contributors. Because there is no vendor cloud service, scan results stay on the organisation's own systems. A European organisation can inspect and run the tools without depending on a US-hosted service, although development and support remain tied to a US sponsor.