# DISA STIG (Defense Information Systems Agency Security Technical Implementation Guide)

> The hardening standard required for information systems operated by or for the US Department of Defense.

A **Security Technical Implementation Guide (STIG)** is a hardening standard published by the Defense Information Systems Agency. STIGs exist for operating systems, databases, browsers, network devices, and applications, and they specify — in enforceable detail — how each must be configured for use on Department of Defense networks.

STIGs are distinguished from other baselines less by their content than by their status. A [CIS Benchmark](https://primcoat.app/glossary/cis-benchmark) is a widely respected recommendation. A STIG is a requirement: systems operating on DoD networks are expected to comply, compliance is assessed, and findings are tracked. Each rule carries a severity category, from CAT I (a finding that directly and immediately permits compromise) down to CAT III (a finding that degrades security measures).

Rules are distributed in **XCCDF** (the Extensible Configuration Checklist Description Format), an XML format for expressing a security checklist in machine-readable form. It is one of the component standards of **SCAP** (the Security Content Automation Protocol, a suite of specifications from the US National Institute of Standards and Technology for automating security policy checks). The practical consequence is that a STIG can be evaluated automatically against a running system or an image by a SCAP-capable scanner such as [OpenSCAP](https://primcoat.app/glossary/openscap), rather than checked by hand against a document.

STIG compliance is a common procurement gate for federal and defense contracts, so organizations selling into those markets frequently need STIG-hardened images regardless of what their own risk assessment would otherwise call for.

## Related

- https://primcoat.app/glossary/cis-benchmark.md
- https://primcoat.app/glossary/openscap.md
- https://primcoat.app/glossary/fips-140-3.md

---

Source: https://primcoat.app/glossary/disa-stig
Primcoat — a managed VM image factory. https://primcoat.app