DISA STIG

A Security Technical Implementation Guide (STIG) is a hardening standard published by the Defense Information Systems Agency. STIGs exist for operating systems, databases, browsers, network devices, and applications, and they specify — in enforceable detail — how each must be configured for use on Department of Defense networks.

STIGs are distinguished from other baselines less by their content than by their status. A CIS Benchmark is a widely respected recommendation. A STIG is a requirement: systems operating on DoD networks are expected to comply, compliance is assessed, and findings are tracked. Each rule carries a severity category, from CAT I (a finding that directly and immediately permits compromise) down to CAT III (a finding that degrades security measures).

Rules are distributed in XCCDF (the Extensible Configuration Checklist Description Format), an XML format for expressing a security checklist in machine-readable form. It is one of the component standards of SCAP (the Security Content Automation Protocol, a suite of specifications from the US National Institute of Standards and Technology for automating security policy checks). The practical consequence is that a STIG can be evaluated automatically against a running system or an image by a SCAP-capable scanner such as OpenSCAP, rather than checked by hand against a document.

STIG compliance is a common procurement gate for federal and defense contracts, so organizations selling into those markets frequently need STIG-hardened images regardless of what their own risk assessment would otherwise call for.