content

# Welcome!

[![Docs](https://img.shields.io/readthedocs/complianceascode)](https://complianceascode.readthedocs.io/en/latest/)
[![Release](https://img.shields.io/github/release/ComplianceAsCode/content.svg)](https://github.com/ComplianceAsCode/content/releases/latest)
[![Nightly ZIP Status](https://github.com/ComplianceAsCode/content/actions/workflows/nightly_build.yml/badge.svg)](https://nightly.link/ComplianceAsCode/content/workflows/nightly_build/master/Nightly%20Build.zip)
[![Stats, Guides, Tables](https://github.com/ComplianceAsCode/content/actions/workflows/gh-pages.yaml/badge.svg)](https://complianceascode.github.io/content-pages/)
[![Join the chat at https://gitter.im/Compliance-As-Code-The/content](https://badges.gitter.im/Compliance-As-Code-The/content.svg)](https://gitter.im/Compliance-As-Code-The/content?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)


The purpose of this project is to create *security policy content* for various
platforms — *Red Hat Enterprise Linux*, *Fedora*, *Ubuntu*, *Debian*, *SUSE Linux Enterprise Server (SLES)*,... —
as well as products — *Firefox*,...
We aim to make it as easy as possible to write new and maintain existing
security content in all the commonly used formats.

* [ComplianceAsCode Documentation](https://complianceascode.readthedocs.io/)
* [ComplianceAsCode Blog](https://complianceascode.github.io/)
* [Online Workshops](docs/workshop/README.adoc) - Perfect as a starting point
* [Profiles in ComplianceAsCode](https://complianceascode.github.io/content-pages/guides/index.html) - online HTML guides for each profile


## We build security content in various formats

![NIST logo](docs/readme_images/nist_logo.svg "NIST logo")     ![Ansible logo](docs/readme_images/ansible_logo.svg "Ansible logo")     ![Bash logo](docs/readme_images/bash_logo.png "Bash logo")

*"SCAP content"* refers to documents  in the *XCCDF*, *OVAL* and
*SCAP source data stream* formats.  These documents can be presented
in different forms and by different organizations to meet their security
automation and technical implementation needs.  For general use, we
recommend *SCAP source data streams* because they contain all the data you
need to evaluate and put machines into compliance. The data streams are
part of our release ZIP archives.

*"Ansible content"* refers to Ansible playbooks generated from security
profiles.  These can be used both in check-mode to evaluate compliance,
as well as run-mode to put machines into compliance.  We publish these
on *Ansible Galaxy* as well as in release ZIP archives.

*"Bash fix files"* refers to *Bash* scripts generated from security
profiles.  These are meant to be run on machines to put them into
compliance.  We recommend using other formats but understand that for
some deployment scenarios bash is the only option.

*"CEL content"* refers to compliance content using the Common Expression Language (CEL)
for Kubernetes and OpenShif