Compliance Scores

Why reported scores are below 100%

The lockdown playbooks intentionally disable a small set of compliance rules for operational safety and environment compatibility. Scanners (OpenSCAP, GOSS) count those rules as failures, so the reported percentage understates the hardening actually applied. Disabling these rules is a deliberate configuration choice, not a gap in the hardening itself - the categories are:

Lockout prevention - a subset of SSH and PAM faillock rules that could lock operators out of remote systems.
Environment compatibility - partition-separation rules on cloud VMs (single root partition), USBGuard on virtual hardware without USB, smart card requirements without PIV/CAC infrastructure, and GUI rules on headless servers.

Expected scores

Production (cloud VM)

Framework	Reported score	Primary limiter
STIG (GOSS)	91–93%	Partition rules disabled on single-partition VMs
STIG (OSCAP)	90–92%	Same
CIS (GOSS)	94–96%	Same
CIS (OSCAP)	96–98%	Near maximum for cloud

Production (full partitioning)

Framework	Expected score
STIG	96%+
CIS	98–99%

Testing environment

The testing environment disables additional SSH, PAM, and FIPS rules to prevent lockout during iterative work, so scores run roughly 5–10 points below production. Testing scores are not representative of a production hardening run.

Achieving maximum scores

To reach the highest reported compliance:

Provision with separate partitions before hardening: /tmp (mount options - nodev, nosuid, noexec), /var, /var/log, /var/log/audit, and /home (mount options - nodev, nosuid).
Create a non-root admin account with sudo before hardening - PermitRootLogin no is enforced afterward.
Enable the bootloader password - see Configuration.
For DoD environments, enable smart card rules if PIV/CAC is in use and install the required CA certificates.

Validating compliance

Use the ssg-rlch9-ds.xml datastream - it's the one built for RLC Pro Hardened. Other datastreams on the system target different platforms and produce misleading results if used here:

Datastream file	Target platform	Use it for
`ssg-rlch9-ds.xml`	RLC Pro Hardened 9	This collection. Includes the DISA STIG for Rocky Linux Hardened 9 profile.
`ssg-rlc9-ds.xml`	RLC Pro 9 (non-hardened)	Scanning RLC Pro 9
`ssg-rl9-ds.xml`	Rocky Linux 9 (community/stock)	Stock Rocky 9 - not CIQ-tuned; do not use against a lockdown-hardened system
`ssg-rhel9-ds.xml`	Red Hat Enterprise Linux 9	RHEL 9, not Rocky/CIQ

Warning

Each datastream bundles many profiles (STIG, CIS L1/L2, CUI, HIPAA, ANSSI, etc.) - selecting the right datastream is not enough on its own; also pick the matching --profile.


# STIG scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --results /tmp/oscap-stig.xml \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

# CIS scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results /tmp/oscap-cis.xml \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

# Generate an HTML report
oscap xccdf generate report /tmp/oscap-stig.xml > /tmp/stig-report.html

Note

Some PAM-related rules report as failed in OpenSCAP even when the controls are active. OpenSCAP checks PAM files directly, while the playbooks manage authentication through authselect profiles - the security controls are enforced via faillock.conf regardless of the scanner result.

For questions about a specific rule result, contact CIQ Support.

Idempotency Troubleshooting