Compliance benchmarks

A compliance benchmark is a file that defines the checks used to assess whether a system meets a security standard such as SCAP or STIG.

A benchmark file follows the Security Content Automation Protocol (SCAP) standard and is written in Extensible Configuration Checklist Description Format (XCCDF) format. You obtain benchmarks from an issuing body, such as DISA for Security Technical Implementation Guide (STIG) benchmarks, rather than authoring your own.

Benchmarks come from two sources:

  • DISA-provided (DISA): These benchmarks sync automatically on a nightly basis. They are read-only and cannot be deleted.
  • User-uploaded (Users): The user uploads these benchmarks. An uploaded benchmark file must be an eXtensible Markup Language (XML) file, in XCCDF format, and no larger than the maximum file size shown in the upload dialog. You can only delete a user-uploaded benchmark if no policy references it.

When you upload a benchmark, it is validated against the expected format, and non-conforming files are rejected. Benchmarks are deduplicated by file content, not by filename: uploading a file whose content is identical to an existing benchmark refreshes that existing entry rather than creating a new one. Uploading a file with the same parsed benchmark name and version but different content replaces the content of the existing entry. A policy cannot include two benchmarks with the same SCAP benchmark identifier (ID) and version.

Note:
On Arc, the Benchmark management page is read-only: you cannot upload or delete benchmarks from Arc. Benchmarks are managed from the upstream system, and you can upload them only from Vantage.