| ComplianceAsCode / SCAP Security Guide | Rego Policy Libraries | |
|---|---|---|
| Size | 2,574 OS rules, 391 profiles, 39 products | 13,775 control-level checks, 740 policy files |
| Scope | operating-system settings only | hosts (CIS, STIG), cloud, SaaS, Kubernetes, IaC, AI governance, 54 regulatory and management standards |
| Language | XCCDF / OVAL + Ansible / Bash | OPA Rego v1, Apache 2.0 |
The reference for SCAP on Linux. Our host benchmarks cover the same CIS and STIG baselines in Rego; a SCAP/XCCDF generator is on the converters roadmap so OpenSCAP users can consume them.
Counts were taken from each project's public repository on 2026-10-12; ours is make count, re-verified by CI.
Method and the full table: docs/COMPARISON.md.
Is one a replacement for the other? Usually not: ComplianceAsCode / SCAP Security Guide is operating-system settings only; this library is the layer that evaluates every framework a regulator or auditor names, and runs inside the same OPA, Conftest, Gatekeeper and Kubewarden that the others plug into.