Compliance tools and benchmark content do not always update together. In a disconnected environment, an engineering team needs to know which scanner version produced a result and which benchmark release it evaluated.
Treat scanner software and scan content as separate controlled artifacts.
1. Record the baseline#
Before changing anything, record the current scanner package, content release, benchmark identifier, and last known successful scan. Preserve reports from the existing version for comparison.
On RHEL, inspect the installed RPM and system version:
rpm -qa | grep -Ei 'scap|openscap|scc'
cat /etc/redhat-releaseAn RPM name alone may not identify the exact benchmark content. Capture the scanner's own reported content version when available.
2. Validate the incoming artifact#
Check the vendor's published checksum and signing requirements. An RPM can have an embedded signature while the machine lacks the corresponding trusted public key.
sha256sum incoming-package.rpm
rpm -Kv incoming-package.rpmAn NOKEY result means the RPM verification process does not have the required public key. Obtain the signing key from a trusted channel and verify its fingerprint through the publisher's documented process before importing it. Follow the approved software intake process.
3. Test on a representative host#
Use a nonproduction host with the same major RHEL version, scanner dependencies, and benchmark scope. Capture the baseline scan, update the scanner and content using the vendor procedure, and repeat the scan.
Review changes to benchmark identifiers, rule counts, severity, applicability, and evaluated results. A change in compliance score may come from content changes even when the system configuration has not changed.
4. Publish the result as a change record#
A useful release record contains:
- Scanner version and build identifier
- Benchmark content version and release date
- Accepted hash and signing-key identity
- Tested RHEL versions and dependencies
- Results that changed because of benchmark updates
- Rollback and re-run instructions
5. Distribute repeatably#
Keep the approved RPM, content bundle, validation output, and release record in your internal repository. Automate rollout only after the lab checks pass. Retain enough history to reproduce an earlier audit result.
Reference: OpenSCAP documentation and the applicable scanner vendor's release notes.