The manual STIG is meant to be read, the Benchmarks seem to be automated
implementations of the STIG. Not everything that can be automated is in the
benchmark, though I think that's the general direction. The benchmarks are
used by tools like the SCC tool and StigViewer.
On Thu, Jul 14, 2016 at 9:31 AM, Chun Tat David Chu <
Why there is a need of a manual STIG and a benchmark STIG? Both STIGs are
in SCAP XCDDF format. Can't both be combined?
SCAP Security Guide mailing list
Mind on a Mission <http://leamhall.blogspot.com/>