Security and Compliance

This section describes how RLC Pro Hardened addresses security requirements and compliance obligations: the compliance frameworks it supports, how that compliance is delivered, how to verify it, and where to obtain reports and evidence.

RLC Pro Hardened builds on RLC Pro and inherits its FIPS 140-3 validated cryptographic modules. For the full FIPS compliance model, certification status, and FAQ, see the canonical RLC Pro FIPS 140-3 Compliance page; this section covers what is specific to RLC Pro Hardened.

Compliance Frameworks

FIPS 140-3: CIQ's validated cryptographic modules and compliance model (RLC Pro canonical reference).
- Enabling FIPS Mode: enable FIPS at install or on an existing RLC Pro Hardened system.
- Switching FIPS Modes: the rlc-fips (Compliant) and rlc-fips-certified (Certified) meta packages.
- Module certification status: certified and in-process modules by version (shared across the RLC Pro family).
DISA STIG: DoD Security Technical Implementation Guide compliance.
CIS Benchmarks: Center for Internet Security configuration baselines.

Compliance Delivery

RLC Pro Hardened delivers compliance through several complementary mechanisms:

Pre-hardened images: RLC Pro Hardened images are available through CIQ Depot, hardened out of the box (SELinux enforcing, hardened glibc and OpenSSH). Use them to deploy a hardened baseline without manual configuration. See Obtaining a hardened image.
FIPS 140-3 validated modules: delivered through the CIQ FIPS repositories. Pin to FIPS Certified versions where a certificate must be cited, or run FIPS Compliant packages to receive ongoing CVE patches while preserving the certified cryptographic code. See the FIPS compliance model.
Security profiles: compliance frameworks such as DISA STIG and CIS Benchmarks are delivered as OpenSCAP profiles in the hardened image's SCAP content, applied and validated with OpenSCAP. There is one hardened image family; you apply the profile for the framework you need rather than downloading a separate image per framework.
Runtime and integrity protections: the Linux Kernel Runtime Guard (LKRG) and hardened memory allocator provide defense-in-depth beyond configuration hardening.
Hardened package enforcement: the rlc-h meta package keeps the system on CIQ's hardened builds of glibc and openssh.

Info

FIPS mode is enabled by default on the STIG and CUI compliance builds. On the base RLC Pro Hardened image and the CIS build, FIPS mode is off by default; enable it using the Enabling FIPS Mode guide. For the compliance frameworks available on the hardened image and how to apply them, see Profiles.

Obtaining a hardened image

RLC Pro Hardened images are distributed through CIQ Depot. A single hardened image family covers all supported compliance frameworks; you select a framework by applying its profile after deployment, not by choosing a different image.

Images are published for each supported release (for example, RLC Pro Hardened 9 and 10) in the formats CIQ Depot offers: installer ISO, cloud disk (qcow2), and OCI container images. Installer media includes a compliance-focused build that pre-applies STIG partitioning, the OpenSCAP add-on, and FIPS cryptographic packages. Cloud marketplace images are also available for supported providers.

To obtain an image:

Sign in to CIQ Portal and generate an access token for your organization.
Install and authenticate the depot client on a host, then log in with your token:
```
sudo depot login -u <username> -t <token>
```

List the products your account is entitled to and download the image file:


sudo depot list
sudo depot download -p <product> -r <repo> -f <image-file>

Downloaded and cloud RLC Pro Hardened images come pre-enrolled with the CIQ Depot repositories, so package updates and support content are available immediately. The depot.ciq.com web interface is deprecated for customer use; follow CIQ Portal and this documentation instead. For entitlement and access to a specific image, contact CIQ Support.

CVE remediation

CIQ remediates CVEs in FIPS deployments through the FIPS Compliant repositories, which deliver security patches to non-cryptographic components while keeping the certified cryptographic code unchanged (see the FIPS compliance model). Runtime kernel protection against exploitation is provided by LKRG.

Verification Scripts

Scripts: check FIPS mode, crypto policy, and SELinux status on deployed systems.

Reports

Compliance reports and audit evidence for RLC Pro Hardened:

OpenSCAP scan reports: the oscap xccdf eval --report command produces a self-contained HTML report for the DISA STIG or CIS Benchmarks profile, listing each rule with its pass or fail status and remediation guidance. See those profile pages for the exact commands.
Audit evidence and Security Policies: for FIPS 140-3 module Security Policy documents and audit-ready evidence packages (for example, to support an ATO), contact CIQ Support.

Linux Kernel Runtime Guard (LKRG) Guide for RLC Pro Hardened Hardened Package Enforcement (rlc-h)