A quick (though quite late) note about SCM as this blog post is viewed from time to time.
Last summer a new version of SCM (4.0) was released. Someone (me as well) might have thought that the product is alive and developing.
No, it is not. SCM could still have some value for old products/baseline, but it’s increasingly less useful for newer products/baselines. SCM won’t be updated to be aligned with the tool’s initial purposes and intents. In other words, SCM is dead.
Security baselines are different, no changes here, Microsoft will continue publishing baselines.
As not-quite-close alternative to SCM you might want to have a look on Policy Analyzer