An organization wants to perform a scan of all its systems against best practice security configurations. Which of the following SCAP standards, when combined, ...

An organization wants to perform a scan of all its systems against best practice security configurations.
Which of the following SCAP standards, when combined, will enable the organization to view each of the configuration checks in a machine-readable checklist format for full automation? (Choose two.)