1. A method, comprising: receiving network scan results from information sources in heterogeneous formats; converting the network scan results into structurally normalized scan results using a plurality of first tags and a second tag nested in the first tags, the first tags indicating a test, the second tag indicating a result of the test; identifying semantically equivalent network scan results in the structurally normalized scan results; and comparing at least a portion of the semantically equivalent network scan results with a network policy to determine a compliance with the network policy.