Profiles
RLC Pro Hardened delivers compliance frameworks as OpenSCAP profiles, not as a separate image per framework. There is one hardened image family. You apply the profile for the framework you need (for example, DISA STIG or a CIS Benchmark) on top of that image, then verify the result with OpenSCAP.
How compliance profiles are delivered
The RLC Pro Hardened image is a hardened baseline: SELinux runs in enforcing mode, the system is built on CIQ's hardened glibc and OpenSSH, and defense-in-depth components such as LKRG and the hardened memory allocator are available. The baseline is not, by itself, remediated to any single framework.
To meet a specific framework, apply its profile. CIQ ships a SCAP data stream tailored for RLC Pro Hardened in the ciq-scap-security-guide package, alongside the OpenSCAP scanner (oscap) in the openscap-scanner package. Both are preinstalled on the hardened image. If they are missing, install them from the Depot repositories:
sudo dnf install -y openscap-scanner ciq-scap-security-guide
Install ciq-scap-security-guide, not the stock scap-security-guide package. Both can be present on the system, but only ciq-scap-security-guide provides the RLC Pro Hardened data stream (ssg-rlch9-ds.xml) and the rlch9-playbook-*.yml remediation playbooks that the rest of this section relies on.
The RLC Pro Hardened data stream is installed at:
/usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml
Its profiles are authored specifically for RLC Pro Hardened (each profile title reads "for Rocky Linux Hardened 9"), so scan and remediation content matches the hardened baseline rather than stock Rocky Linux.
The paths and filenames throughout this section are for RLC Pro Hardened 9 (ssg-rlch9-ds.xml, rlch9-playbook-*.yml). SCAP profile content for RLC Pro Hardened 10 is not yet available. Run oscap info and list /usr/share/scap-security-guide/ansible/ on your own system to confirm the exact data stream and playbook names installed for your release.
Available profiles
Production-ready
These profiles are validated against the RLC Pro Hardened baseline. Use the profile ID with oscap to scan or remediate.
| Framework | Profile ID |
|---|---|
| DISA STIG | xccdf_org.ssgproject.content_profile_stig |
| CIS Level 2 (Server) | xccdf_org.ssgproject.content_profile_cis |
| CUI (NIST 800-171) | xccdf_org.ssgproject.content_profile_cui |
Roadmap (proof of concept)
The data stream also carries profiles for additional frameworks that are proof-of-concept and not yet production-ready on RLC Pro Hardened:
- CIS Level 1 (Server), and CIS Level 1 and Level 2 (Workstation)
- ANSSI-BP-028 (minimal, intermediary, enhanced, high)
- PCI-DSS v4.0.1, HIPAA, and Protection Profile for General Purpose OS (OSPP)
- BSI (SYS.1.6 and SYS.1.1/SYS.1.3), CCN-STIC (basic, intermediate, advanced), ACSC Essential Eight, and ACSC ISM Official
Do not rely on the roadmap profiles for compliance without confirming their status with CIQ Support. To list the exact profile IDs installed on your system, run:
oscap info /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml
Profile availability tracks the CIQ hardened SCAP content and can change between releases; oscap info always reflects what is installed on your system.
The DISA STIG and CIS Benchmarks pages cover the production-ready framework families in detail.
Detailed guides
- DISA STIG: scan, remediate, and verify against the DoD Security Technical Implementation Guide.
- CIS Benchmarks: apply CIS Level 1 and Level 2 Server or Workstation baselines.
For FIPS 140-3, see Enabling FIPS Mode; several frameworks (including DISA STIG) also require FIPS mode.