I work in an industry that uses manufacturing equipment that typically run on Windows or unix-like OS.
An industry body is developing security standards and plans to require the use of Security Content Automation Protocol so I was wondering about implementation of SCAP in other industries.
The proposed requirements will require a SCAP scan be run
a) On every machine prior to leaving the supplier factory. b) On every installed machine after any software upgrade on that machine. (including the OS or applications)
I am new to SCAP and quite new to information security in general. I am wondering if SCAP implementation like this is normal in an industrial or any other setting?