Skip to Content
Admin GuidesLockdown Playbooks GuideOverview

Lockdown Playbooks Guide

Overview

The CIQ Lockdown Wrapper applies DISA STIG, CIS Benchmark, and CUI/OSPP security hardening to Rocky Linux 9 systems, converting them to RLC Pro Hardened. It ships as an RPM (ciq-lockdown-wrapper) from CIQ Depot with Ansible playbooks and bundled roles.

Use the Lockdown Wrapper to harden existing systems that are already in production. For new deployments, pre-hardened RLC Pro Hardened images are available through CIQ Depot - see the installation guides.

Installing via Ansible Galaxy

The lockdown playbooks are also available as an Ansible collection you can install directly from CIQ Depot with ansible-galaxy, using your existing Depot entitlement. See Installing Ansible Collections from Depot.

Hardening profiles

ProfilePlaybookDescription
RLC-H onlyrlch9_hardenedLKRG, hardened_malloc, control - no STIG/CIS
CISrlch9_cisFull CIS Level 1 + Level 2 rule set
DISA STIGrlch9_stigDISA STIG only
CIS + STIGrlch9_combinedFull compliance - recommended for production
CUI/OSPPrlch9_cuiNIST SP 800-171 / CMMC

All playbooks install to /usr/share/ansible/collections/ansible_collections/ctrliq/rlch9_lockdown/playbooks/ and are invoked by FQCN (e.g. ctrliq.rlch9_lockdown.rlch9_stig) - see Quick Start.

Idempotent by design

The lockdown playbooks are idempotent: If there are no new changes, repeatedly running the playbooks against already-hardened systems reports zero changes. This makes the playbooks safe for repeated runs, configuration-drift remediation, and scheduled compliance enforcement. See Idempotency for verification steps and the drift audit/remediation workflow.

In this guide