Browse Definitions :
Definition

XCCDF (Extensible Configuration Checklist Description Format)

XCCDF (Extensible Configuration Checklist Description Format) is a specification language for writing security checklists, benchmarks and related types of documents. XCCDF is supported by the US National Security Agency’s Information Assurance Directorate, the Center for Internet Security and MITRE.

The specification is designed to support information interchange, document generation, organizational and situational tailoring, automated compliance testing and compliance scoring. It also defines a data model and format for storing results of benchmark compliance testing. XCCDF documents are expressed in XML and can be validated with an XML validating parser.

According to Chris Calabrese from the Center for Internet Security:

Every system administrator has local policies and standards that their systems are supposed to comply with, and there are many security-audit tools to check compliance. However, many of these tools don’t allow easy customization to local policy, or to drop in new third-party policy definitions. XCCDF is an XML-based format that addresses these problems by providing a unified way to describe:

- System configuration policies/benchmarks/standards such those from the Center for Internet Security or the NSA’s Security Configuration Guides.

- How software can evaluate systems for policy compliance using Mitre’s Open Vulnerability Assessment Language or similar schemes.

- How people and/or software can fix systems that don’t comply.

- How well a particular system conforms to a policy for reporting purposes.

 

Learn more:

NIST provides the lastest XCCDF specifications and related resources.

Benchmark Editor is a Java-based tool for XCCDF benchmark documents.

This was last updated in February 2012
SearchNetworking
SearchSecurity
  • man in the browser (MitB)

    Man in the browser (MitB) is a security attack where the perpetrator installs a Trojan horse on the victim's computer that is ...

  • Patch Tuesday

    Patch Tuesday is the unofficial name of Microsoft's monthly scheduled release of security fixes for the Windows operating system ...

  • parameter tampering

    Parameter tampering is a type of web-based cyber attack in which certain parameters in a URL are changed without a user's ...

SearchCIO
  • e-business (electronic business)

    E-business (electronic business) is the conduct of business processes on the internet.

  • business resilience

    Business resilience is the ability an organization has to quickly adapt to disruptions while maintaining continuous business ...

  • chief procurement officer (CPO)

    The chief procurement officer, or CPO, leads an organization's procurement department and oversees the acquisitions of goods and ...

SearchHRSoftware
SearchCustomerExperience
  • clickstream data (clickstream analytics)

    Clickstream data and clickstream analytics are the processes involved in collecting, analyzing and reporting aggregate data about...

  • neuromarketing

    Neuromarketing is the study of how people's brains respond to advertising and other brand-related messages by scientifically ...

  • contextual marketing

    Contextual marketing is an online marketing strategy model in which people are served with targeted advertising based on their ...

Close