No. 7 of 27 ·Infrastructure Testing Tools

OpenSCAP

Windows · Mac · Linux · Self-hosted

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

OpenSCAP is ranked #7 of 27 in infrastructure testing tools on Freedom251. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OpenSCAP plans and pricing

All plans

OpenSCAP tools Free All projects under the OpenSCAP umbrella are open source and can be downloaded and used for free. open-scap.org · 30 Sept 2026

Compared on infrastructure testing tools

Free plan: Yes
Policy as code: Yes

Best OpenSCAP alternatives

See all 12

Two bars AWS CloudFormation Free tier No. 1Free6.6 Two bars Conftest Free tier No. 2Free6.6 Two bars cfn-lint Free tier No. 3Free6.5 Two bars Chef InSpec Free tier No. 4Free6.5 Two bars Cinc Auditor Free tier No. 5Free6.5 Two bars KICS Free tier No. 6Free6.5

The record

Purpose: OpenSCAP is a collection of open source tools for implementing and enforcing the Security Content Automation Protocol (SCAP) standard.
Compliance and vulnerability assessment: The project provides tools and customizable policies for security compliance and automated vulnerability checking.
OpenSCAP Base: OpenSCAP Base provides a library and the oscap command-line tool to parse and evaluate SCAP content, scan systems, and format content into documents.
Supported content: OpenSCAP Base supports XCCDF benchmarks and OVAL definitions and states support for SCAP 1.2 with backward compatibility for SCAP 1.1 and 1.0.
Desktop scanning: SCAP Workbench lets users tailor SCAP content, run local or remote scans, and export results.
Scheduled assessment: OpenSCAP Daemon evaluates machines and containers according to a schedule.
Policy customization: Users can change policy variables, enable or disable rules, and save customized policies separately for reuse when the original content is updated.
Automated remediation limit: Security policies may include automated remediation, but the site warns that it can break infrastructure functionality and that not all rules can be remediated automatically.
Integrations: The site lists integrations with Red Hat Satellite 6 (Foreman), Red Hat Satellite 5 (Spacewalk), RH Access Insights, Preupgrade Assistant, and orcharhino.
Centralized management: With Red Hat Satellite 6, the site describes centralized policy management, scheduled audits, and collection and search of audit results.
Container scanning: Atomic Scan can scan containers for security vulnerabilities and compliance issues using the openscap Docker image in the official Red Hat registry.
Supported operating systems: OpenSCAP Base is available on Linux distributions including Red Hat Enterprise Linux, Fedora, and Ubuntu, and the site says it supports Microsoft Windows since version 1.3.0.
Certification: The project says it was awarded SCAP 1.2 certification by NIST in 2014.
Intended users: The site identifies government agencies and contractors, businesses, and the open source community as audiences for OpenSCAP.
Price from: Free

Where it ranks on Freedom251

Best Infrastructure Testing Tools in 2026#7 of 27
Best Security Configuration Management Software in 2026#5 of 25

Is OpenSCAP yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenSCAP

Sources

open-scap.org· checked 30 Sept 2026
open-scap.org/features/· checked 30 Sept 2026
open-scap.org/tools/openscap-base/· checked 30 Sept 2026
open-scap.org/download/· checked 30 Sept 2026
open-scap.org/security-policies/· checked 30 Sept 2026
open-scap.org/tools/systems-management/· checked 30 Sept 2026
open-scap.org/tools/· checked 30 Sept 2026