The manual STIG is meant to be read, the Benchmarks seem to be automated implementations of the STIG. Not everything that can be automated is in the benchmark, though I think that's the general direction. The benchmarks are used by tools like the SCC tool and StigViewer. 

On Thu, Jul 14, 2016 at 9:31 AM, Chun Tat David Chu <> wrote:
Hi all,

Why there is a need of a manual STIG and a benchmark STIG?  Both STIGs are in SCAP XCDDF format.  Can't both be combined?



SCAP Security Guide mailing list

Mind on a Mission