# Security & compliance

> CIS Level 1 and 2, DISA STIG, OpenSCAP auto-remediation, CVE scanning, CycloneDX and SPDX SBOMs, Cosign signatures, and SLSA provenance — produced automatically on every Primcoat image.

Every Primcoat image ships with the evidence that describes it: a compliance score, a vulnerability report, a bill of materials, a signature, and provenance.

### Hardening policies

- **CIS Level 1.** The baseline benchmark. Practical hardening that does not usually break a general-purpose server.
- **CIS Level 2.** Defense-in-depth for environments where security outranks convenience.
- **DISA STIG.** The Security Technical Implementation Guides required across US federal and defense programs.
- **Custom.** Start from a benchmark and record explicit, documented exceptions where a control genuinely does not apply.

Hardening is applied and auto-remediated with OpenSCAP, against the SCAP Security Guide content matching the image's OS family.

### The evidence produced on every build

- **Compliance report.** The post-hardening OpenSCAP evaluation, with a score and a per-rule result for the profile selected.
- **CVE scan report.** Known vulnerabilities in the packages present in the finished image, with severity counts a build can be gated on.
- **SBOM.** A complete software bill of materials, emitted in both CycloneDX and SPDX.
- **Signature & provenance.** A Cosign signature over the artifact, plus SLSA build provenance describing how and from what the image was produced.

A build that falls below the configured compliance threshold fails rather than publishing.

---

Source: https://primcoat.app/platform/security
Primcoat — a managed VM image factory. https://primcoat.app