DISA STIG Profile

The Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) provide configuration standards for DoD information systems. RLC Pro Hardened ships a DISA STIG profile in its OpenSCAP content so you can scan for compliance, apply the STIG controls, and produce an audit report.

The STIG profile is delivered as part of the hardened SCAP data stream, not as a separate image. See Profiles for how compliance frameworks are delivered and for the full profile list.

Profile details

Item	Value
Profile title	DISA STIG for Rocky Linux Hardened 9
Profile ID	`xccdf_org.ssgproject.content_profile_stig`
Data stream	`/usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml`
Ansible playbook	`/usr/share/scap-security-guide/ansible/rlch9-playbook-stig.yml`

Warning

The RLC Pro Hardened baseline is hardened but is not fully STIG-remediated out of the box. A baseline scan reports both passing and failing rules; you reach STIG compliance by applying the profile with a remediation step and then re-scanning.

Prerequisites

The scanner and content are preinstalled on RLC Pro Hardened. If they are missing:


sudo dnf install -y openscap-scanner ciq-scap-security-guide

Scan for compliance

Run an evaluation and write both machine-readable results and an HTML report:


sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --results /tmp/stig-results.xml \
  --report /tmp/stig-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

Open /tmp/stig-report.html in a browser to review each rule with its pass or fail status and remediation guidance.

Note

oscap returns exit code 0 when every rule passes and exit code 2 when one or more rules fail. A 2 from a scan is an expected result for a system that has not yet been remediated, not a tool error.

Apply STIG remediation

Choose one of the following approaches. Test in a non-production environment first: STIG remediation changes system configuration and can affect access and running services.

Option 1: OpenSCAP online remediation

Add --remediate to the evaluation to apply fixes in the same run:


sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --remediate \
  --results /tmp/stig-results.xml \
  --report /tmp/stig-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

Option 2: Ansible playbook

CIQ ships a per-profile Ansible playbook. Ansible is preinstalled on the standard hardened image; on a minimal install, add it first with sudo dnf install -y ansible-core. Apply the playbook to the local host:


sudo ansible-playbook -i "localhost," -c local \
  /usr/share/scap-security-guide/ansible/rlch9-playbook-stig.yml

Option 3: Generate a remediation script

Generate a Bash script from the profile, review it, then run it:


sudo oscap xccdf generate fix \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --fix-type bash \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml > stig-remediate.sh

After remediation, reboot if kernel or boot parameters changed, then re-run the scan to confirm the failing rules now pass.

FIPS mode and STIG

The DISA STIG requires FIPS 140-3 validated cryptography. Enable FIPS mode in addition to applying the STIG profile. The STIG uses the FIPS:STIG system crypto policy rather than the base FIPS policy; the STIG sub-policy adds restrictions such as disabling SHA-1 and CBC ciphers:


sudo update-crypto-policies --set FIPS:STIG

The compliance check script treats both FIPS and FIPS:STIG as a passing crypto policy, so a STIG system reports as compliant.

For regulated systems that must operate in FIPS mode from first boot, enable FIPS at install time rather than after remediation. See Enabling FIPS Mode.

Verify

Re-run the scan (above) and confirm the target rules report pass in the HTML report.
Check FIPS, crypto policy, and SELinux status with the compliance check script.

CIS Benchmarks Profile Verification Scripts