What Is ACAS (Assured Compliance Assessment Solution)?

ACAS — the Assured Compliance Assessment Solution — is the vulnerability-scanning and compliance-assessment capability that the United States Department of Defense has mandated for measuring the security posture of its networks. Its purpose is straightforward: continuously find the assets on a network, scan them for known vulnerabilities and misconfigurations, and report the results so risk can be seen, prioritised and fixed. This article is general information; authoritative requirements come from current DoD guidance.

What ACAS is

At heart, ACAS answers a question every large organisation has to answer and the DoD has to answer at enormous scale: what are the known weaknesses on our systems right now, and which matter most? It does this by discovering the devices connected to a network, scanning them against a continually updated catalogue of known vulnerabilities and configuration checks, and centralising the findings into dashboards and reports. The point of mandating a single, defined solution across the Department is consistency — vulnerability data produced the same way everywhere can be aggregated and compared, so leaders get a coherent picture rather than a patchwork of incompatible tools and reports.

Crucially, ACAS is not a product the DoD wrote from scratch. It is a defined solution built on a suite of commercial vulnerability-management tools from the Tenable product family, selected and packaged for Department use. That distinction matters: ACAS is the mandated capability and the way it is deployed, implemented using proven commercial tooling.

What an ACAS deployment includes

A typical ACAS deployment brings together several complementary pieces so that coverage is continuous rather than a periodic snapshot:

• Active scanning. A network vulnerability scanner that reaches out to assets and checks them against known vulnerabilities and configuration baselines.
• Centralised management and reporting. A console that aggregates results from across the environment, analyses them, and produces the dashboards, trends and reports that risk owners actually use.
• Passive and agent-based monitoring. Because active scans run at intervals, passive network monitoring and endpoint agents help catch assets, changes and exposures that would otherwise be invisible between scan windows.

The specific components and their names have changed over time as the underlying products have evolved, so the authoritative current list should be confirmed against DoD and vendor documentation rather than assumed from any one point in time.

Who has to use it

ACAS use is generally required across the Department of Defense — the military services, DoD agencies and components, and the systems and contractors operating on DoD networks are expected to carry out vulnerability assessment using ACAS. The driving idea is standardisation: when every organisation produces vulnerability data the same way, that data can be rolled up, compared and acted on at higher levels of command. Exactly which systems and environments are in scope, and any exceptions, are set by DoD policy and by the officials responsible for authorising a given system, so an organisation should confirm its specific obligation against the governing guidance rather than generalising.

How ACAS fits DoD compliance: STIGs and RMF

ACAS does not stand alone. It is one of three complementary pillars that together define much of how the DoD secures and authorises systems.

• STIGs — Security Technical Implementation Guides. These define how a system must be securely configured: the hardened baseline, down to specific settings for operating systems, applications and devices. STIGs set the standard.
• ACAS. This measures adherence and exposure. It scans for known vulnerabilities and checks configuration against expected baselines, producing the evidence of whether systems are genuinely patched and correctly set up.
• RMF — the Risk Management Framework. This is the overarching governance process by which systems are categorised, have security controls selected and implemented, are assessed, and are authorised to operate with a known level of residual risk.

Read together, the relationship is clean: STIGs set the secure baseline, ACAS provides the continuous evidence of how well systems meet it and where they are exposed, and RMF is the process that consumes that evidence to make authorisation and risk-acceptance decisions. Vulnerability data without a governance process is just noise; a governance process without data is guesswork. The three close that loop.

Where ACAS sits in good security practice

Although ACAS is a DoD-specific mandate, the thinking behind it is universal. Every mature security program needs continuous asset discovery and vulnerability assessment feeding a risk-management process — the same instinct captured, in the commercial world, by frameworks like the NIST Cybersecurity Framework under its Identify and Protect functions. ACAS is also an expression of defense in depth: scanning and configuration assurance are one layer among many, valuable precisely because they catch the exposures that other controls do not. And because ACAS deals in continuous assessment rather than one-off checks, it reflects the reality that a system's security posture drifts the moment it is left alone — a new vulnerability is disclosed, a configuration changes, a patch is missed. Teams building their own assessment and reporting pipelines around similar data can explore programmatic integration through the PlayCISO security APIs.

The takeaway

ACAS is the DoD's standardised way of knowing, continuously, where its systems are vulnerable and whether they meet their configuration baselines. Built on commercial Tenable-based tooling, mandated across the Department, and wired into STIGs and RMF, it turns scattered scan output into organised risk information that authorising officials can act on. For anyone outside the DoD, it is a clear case study in a principle that applies everywhere: you cannot manage the risk you cannot see, so measure your exposure continuously and feed it into a process that makes decisions.

Frequently asked questions

What is ACAS? The Assured Compliance Assessment Solution — the DoD-mandated vulnerability-scanning and compliance-assessment capability that discovers assets, scans for vulnerabilities and misconfigurations, and centralises the results.

What is it built on? A suite of commercial vulnerability-management tools from the Tenable product family, selected and packaged for DoD use, combining active scanning, centralised reporting and passive or agent-based monitoring.

Who must use it? Generally the military services, DoD agencies and components, and systems and contractors on DoD networks, with specific scope set by DoD policy and authorising officials.

How does it relate to STIGs and RMF? STIGs set the secure configuration baseline, ACAS measures adherence and exposure, and RMF is the governance process that consumes that evidence to authorise systems and accept risk.

Is ACAS just a vulnerability scanner? It includes scanning but is better described as a packaged vulnerability-management and compliance solution, adding centralised management, reporting and monitoring on top of raw scanning.