specific vulnerability is present or how to check whether a system is configured in a
particular manner. In conjunction with XML Configuration Checklist Data Format
(XCCDF), OVAL can be used to describe low-level system configuration policy.
DoD has formally adopted both OVAL and CVE, and has mandated that