Security and Compliance

This section is the central location for security and compliance information that applies across CIQ products. Instead of searching each product's documentation for common material, use this section for the shared topics: how CIQ publishes CVE and security advisories, the advisory and errata types CIQ produces, where to consume machine-readable feeds, and general FIPS compliance information. Details that are specific to one product stay in that product's documentation and are linked from here.

In this section

• CVE and Security Advisories: where CIQ publishes advisories and how to track CVE remediation.
• Advisory Types: the advisory identifiers CIQ issues (CRLSA, CRXSA, CRLBA, CRLEA, CIQSA) and what each one means.
• Errata: how CIQ distributes errata (CSAF and VEX documents, and package-manager metadata) for scanners and package managers.
• FIPS 140-3: general FIPS compliance information and where to find product-specific guidance.

Where CIQ publishes advisories

CIQ publishes security advisories through the CIQ Security Advisories Portal at portal.ciq.com/cve, a public tool for browsing, searching, and exporting advisories and the CVEs they resolve. For automation, the underlying CSAF 2.0 and VEX documents are published to the public ctrliq/advisories repository. See CVE and Security Advisories for how to consume them.

Security and compliance by product

Each product documents the specifics that apply to it and links back to this section for the shared material:

• RLC Pro: FIPS documentation.
• RLC Pro Hardened: Security and Compliance, covering security profiles, LKRG, hardened components, and FIPS enablement.
• RLC Pro AI: FIPS documentation.
• CIQ Bridge: Security and Errata, covering signed CVE remediation and errata for CentOS 7.9.
• Ascender Ledger Pro: Errata, which tracks CVE exposure across Enterprise Linux hosts.