NIST 800-171 Profile

NIST Special Publication 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) on nonfederal systems, and it is the control baseline underlying the Cybersecurity Maturity Model Certification (CMMC) used across the US defense supply chain. RLC Pro Hardened ships a CUI profile in its OpenSCAP content so you can scan for compliance, apply the controls, and produce an audit report.

The CUI profile is delivered as part of the hardened SCAP data stream, not as a separate image. See Profiles for how compliance frameworks are delivered and for the full profile list.

Profile details

Prerequisites

The scanner and content are preinstalled on RLC Pro Hardened. If they are missing:

sudo dnf install -y openscap-scanner ciq-scap-security-guide

Scan for compliance

Run an evaluation and write both machine-readable results and an HTML report:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cui \
  --results /tmp/cui-results.xml \
  --report /tmp/cui-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

Open /tmp/cui-report.html in a browser to review each rule with its pass or fail status and remediation guidance.

Apply CUI remediation

Choose one of the following approaches. Test in a non-production environment first: remediation changes system configuration and can affect access and running services.

Option 1: OpenSCAP online remediation

Add --remediate to the evaluation to apply fixes in the same run:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cui \
  --remediate \
  --results /tmp/cui-results.xml \
  --report /tmp/cui-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

Option 2: Ansible playbook

CIQ ships a per-profile Ansible playbook. Ansible is preinstalled on the standard hardened image; on a minimal install, add it first with sudo dnf install -y ansible-core. Apply the playbook to the local host:

sudo ansible-playbook -i "localhost," -c local \
  /usr/share/scap-security-guide/ansible/rlch9-playbook-cui.yml

Option 3: Generate a remediation script

Generate a Bash script from the profile, review it, then run it:

sudo oscap xccdf generate fix \
  --profile xccdf_org.ssgproject.content_profile_cui \
  --fix-type bash \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml > cui-remediate.sh

After remediation, reboot if kernel or boot parameters changed, then re-run the scan to confirm the failing rules now pass.

FIPS mode and CUI

NIST 800-171 requires FIPS 140-3 validated cryptography, so RLC Pro Hardened must be running in full FIPS mode, not only the CUI profile's crypto policy setting.

As part of the remediation options above, the CUI profile sets the system crypto policy to FIPS:

sudo update-crypto-policies --set FIPS

This command alone does not enable FIPS mode: it only switches the crypto policy. Full FIPS mode also requires the kernel FIPS flag and initramfs integrity module, which the crypto policy setting does not provide. Enable FIPS mode separately using Enabling FIPS Mode (fips-mode-setup --enable on an existing system, or at install time for new deployments), then apply the CUI profile.

For regulated systems that must operate in FIPS mode from first boot, enable FIPS at install time rather than after remediation. See Enabling FIPS Mode.

Verify

• Re-run the scan (above) and confirm the target rules report pass in the HTML report.
• Confirm full FIPS mode, not only the crypto policy, is enabled: sudo fips-mode-setup --check should report FIPS mode is enabled.
• Check FIPS, crypto policy, and SELinux status with the compliance check script.