Managing the security of IT systems is becoming increasingly complex. As the number and variety of devices and their functionalities grows, so does the opportunities for attackers to successfully exploit vulnerabilities and infiltrate a system. Thus the need for the introduction of automatic processes and tools that can help security administrators in evaluating and maintaining the desired level of security. SCAP is a framework that provides a standard for the format and nomenclature of security-related information, and its components and reference data can be used to ensure consistency and interoperability between security automation tools. The objective of the thesis is to analyze SCAP both from a theoretical perspective, referencing the official documentation of the various standards, and from its actual implementations, presenting and testing the functionalities provided by the OpenSCAP suite of tools, referring in particular to the most relevant fields such as virtualized environments.