Installation guide

Running and Enforcing Compliance
11
Running and Enforcing Compliance
Using the Compliance module, you define a standard configuration for all machines or multiple standards
for different machine groups. Then, you compare machines against these configuration rules to see if the
machines are in compliance. In some cases, you can enforce certain settings on the machines that are not in
compliance.
Preset rules and templates are available that enable you to begin monitoring system compliance to
regulatory (Sarbanes-Oxley, HIPAA, GLBA and FISMA) industry and Microsoft standards. You can create
and manage rules and rule groups based on Active Directory (AD) objects and configuration data, or on
machine data.
IMPORTANT Compliance does not query individual systems; it only queries the database. If a machine has
not been included in a Collection, or the necessary information has not been included in a Collection, or
the last Collection is outdated, the Compliance Monitor will measure incorrect or out-of-date data.
Therefore, for accurate Compliance monitoring, you must first collect the necessary data.
Getting Started with SCAP Compliance
Security Content Automation Protocol (SCAP) is a suite of standards that enable automated vulnerability
management, measurement, and policy compliance evaluation. The VCM SCAP implementation employs
or references six open standards that SCAP uses to enumerate, evaluate, and measure the impact of
software problems and to report results.
n
Common Configuration Enumeration (CCE). A standard of unique identifiers for common system
configuration issues
n
Common Vulnerabilities and Exposures (CVE). A dictionary of standard identifiers for security
vulnerabilities related to software flaws
n
Open Vulnerability and Assessment Language (OVAL). An XML standard for security testing
procedures and reporting
n
Common Platform Enumeration (CPE). Standard identifiers and a dictionary for platform and product
naming
n
Extensible Configuration Checklist Description Format (XCCDF). A standard for specifying
checklists and reporting results
n
Common Vulnerability Scoring System (CVSS). A standard for conveying and scoring the impact of
VMware, Inc.
153