Security guidance and baselines in SCAP formats