Standards-Based Automated Remediation: A Remediation Manager Reference Implementation
• SEI Report
Publisher
Software Engineering Institute
CMU/SEI Report Number
CMU/SEI-2011-SR-007DOI (Digital Object Identifier)
10.1184/R1/6584369.v1Topic or Tag
Abstract
This report describes the Software Engineering Institute's work in calendar year 2010 for the National Security Agency Computer Network Defense Research and Technology Program Management Office to develop standards for remediation of vulnerabilities and compliance issues on Department of Defense (DoD) networked systems. The overall goals are to assist in the development of remediation standards, demonstrate the functionality DoD would like in a remediation manager, and increase efficiency and effectiveness of remediation by automating the remediation process. The 2010 Remediation Manager reference implementation demonstrates the following potential applications of remediation and other security automation standards: (1) Ingest scan findings in Security Content Automation Protocol (SCAP) format, extracting host compliance issues (in Common Configuration Enumeration [CCE] format) and vulnerabilities (in Common Vulnerability Enumerations [CVE] format). (2) Map CCE and CVE to remediation actions (in Common Remediation Enumeration [CRE] format). (3) Build remediation tasks in Remediation Tasking Language (RTL), based on CRE. (4) Transmit remediation tasks to a Remediation Tool on a host system. (5) Receive remediation task execution status, in RTL Results Format, from the Remediation Tool. This report identifies capabilities considered for future versions of the reference implementation and the operational system as well as challenges for future work.
Related Reading
Standards-Based Automated Remediation: A Remediation Manager Reference Implementation, 2011 Update
Cite This SEI Report
Chaki, S., Creel, R., Davenport, J., Kinney, M., McCormick, B., & Popeck, M. (2011, July 1). Standards-Based Automated Remediation: A Remediation Manager Reference Implementation. (SEI Report CMU/SEI-2011-SR-007). Retrieved September 12, 2026, from https://doi.org/10.1184/R1/6584369.v1.
@techreport{chaki_2011,
author={Chaki, Sagar and Creel, Rita and Davenport, Jeff and Kinney, Mike and McCormick, Benjamin and Popeck, Mary},
title={Standards-Based Automated Remediation: A Remediation Manager Reference Implementation},
month={Jul},
year={2011},
number={{CMU/SEI-2011-SR-007},
institution={Software Engineering Institute, Carnegie Mellon University},
doi={10.1184/R1/6584369.v1},
url={https://doi.org/10.1184/R1/6584369.v1},
note={Accessed: 2026-Sep-12}
}
Chaki, Sagar, Rita Creel, Jeff Davenport, Mike Kinney, Benjamin McCormick, and Mary Popeck. "Standards-Based Automated Remediation: A Remediation Manager Reference Implementation." (CMU/SEI-2011-SR-007). Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, July 1, 2011. https://doi.org/10.1184/R1/6584369.v1.
S. Chaki, R. Creel, J. Davenport, M. Kinney, B. McCormick, and M. Popeck, "Standards-Based Automated Remediation: A Remediation Manager Reference Implementation," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, SEI Report CMU/SEI-2011-SR-007, 1-Jul-2011 [Online]. Available: https://doi.org/10.1184/R1/6584369.v1. [Accessed: 12-Sep-2026].
Chaki, Sagar, Rita Creel, Jeff Davenport, Mike Kinney, Benjamin McCormick, and Mary Popeck. "Standards-Based Automated Remediation: A Remediation Manager Reference Implementation." (SEI Report CMU/SEI-2011-SR-007). Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 1 Jul. 2011. https://doi.org/10.1184/R1/6584369.v1. Accessed 12 Sep. 2026.
Chaki, Sagar; Creel, Rita; Davenport, Jeff; Kinney, Mike; McCormick, Benjamin; & Popeck, Mary. Standards-Based Automated Remediation: A Remediation Manager Reference Implementation. CMU/SEI-2011-SR-007. Software Engineering Institute. 2011. DOI: 10.1184/R1/6584369.v1. https://doi.org/10.1184/R1/6584369.v1