STIG compliance
Security > STIG measures machines against the DISA STIG (Security Technical Implementation Guide), the configuration standard the US Department of Defense requires.
Gardience uses two free, open-source tools on each machine:
- OpenSCAP (
openscap-scanner), the scanner. - SCAP Security Guide (
scap-security-guide), the rules. It includes a DISA STIG profile for each supported system; DISA builds its own RHEL STIG content from this project.
Nothing has to be bought. Ubuntu ships no current STIG content, so Gardience delivers the SCAP Security Guide's Ubuntu 22.04 and 24.04 content to Ubuntu machines itself (about 1 MB each, included in Gardience).
Install the scanner
Installing software is a change, so it goes through a runbook (change windows, locks and approvals apply):
- Open Automation > Runbooks.
- On Install the STIG scanner, choose Run…, pick the node group and choose Run now.
On RHEL-family machines it installs both packages from the machine's own repositories. On Ubuntu it installs the scanner from Ubuntu (libopenscap8 on 22.04, openscap-scanner on 24.04, from universe) and copies the content from Gardience to /var/lib/gardience/scap.
Run a scan
Only admins start scans.
- Open Security > STIG.
- Pick the Node group. Leave Profile empty for the DISA STIG profile, or give another profile id from the SCAP Security Guide.
- Choose Run STIG scan.
A scan takes a few minutes per machine and changes nothing. Groups that were scanned are scanned again every week with the same profile.
Read the results
Machines with CAT I findings come first, then other failed rules, then machines with none, and machines not scanned; search by machine name or rule (id or title). Each machine shows its score, the number of passed rules, and the failed rules by severity. In STIG terms, high is CAT I, medium is CAT II and low is CAT III. Open the row to see every failed rule with its title. Download CSV exports the results.
The results show how a machine measures against the profile's automated checks. They are not a DISA certification.
Checklists for eMASS and STIG Viewer
Download checklists (.zip) on the STIG page gives one STIG Viewer checklist (.ckl) per scanned machine. Open them in DISA STIG Viewer 2 or 3, or upload them to eMASS. The checklist link next to a machine gives just that one.
Each checklist lists every requirement in DISA's STIG, including the ones that need a person to check them:
| Scan result | Checklist status |
|---|---|
| Passed | Not a Finding |
| Failed | Open |
| Not applicable | Not Applicable |
| Not checked automatically | Not Reviewed, for you to complete by hand |
Automated results say so in Finding Details, with the date and the content that checked them, so an assessor can tell them apart from your own entries. The asset section is filled in with the machine's host name, IP address, MAC address and FQDN.
DISA's STIG files
A checklist is built from DISA's own STIG file, so the rule numbers, check text and CCIs are exactly DISA's. You don't need to find them yourself:
- After a scan, Gardience downloads the STIGs your machines need from DISA (RHEL 8 and 9, which also cover Rocky Linux, AlmaLinux and CentOS Stream, and Oracle Linux 8 and 9). It checks for a newer release once a week and keeps the newest.
- Get the newest from DISA checks right away (admins).
- On a network without internet, download the STIG zip from DISA's STIG downloads elsewhere and choose Add DISA STIG files. A single STIG zip, a zip that holds several, or the
*_Manual-xccdf.xmlall work.
Results are matched to DISA's requirements by DISA's rule number (RHEL family) or by DISA's STIG ID (Ubuntu). An automated check that could not run on a machine is left Not Reviewed with a note, never reported as a finding or as passing.
Remove next to a stored STIG deletes it (Gardience gets it again if scanned machines still need it).
Machines scanned before 1.21 need one more scan before they get a checklist. Every checklist download is in the audit log.
POA&M for eMASS
Download POA&M (.xlsx) writes the plan of action and milestones in the layout of eMASS's POA&M import workbook: a header block, then one row per open finding with every machine it is on.
- Each STIG requirement that failed its automated check, under the NIST SP 800-53 control DISA maps its CCI to (from DISA's CCI list), with DISA's rule number, Vuln ID and STIG ID, and DISA's fix text as the recommendation.
- Each CVE Gardience's own check found, under SI-2 (flaw remediation), marked when CISA lists it as actively exploited.
Severity is CAT I / High, CAT II / Moderate or CAT III / Low (an exploited CVE is CAT I). Scheduled completion is 30, 90 or 180 days by severity, or CISA's due date for an exploited CVE. The risk fields (relevance of threat, likelihood, impact, residual risk) start at the finding's severity: review them before you submit. Fill in the header (DoD component, system name, POC) in Excel. Every download is in the audit log.
People limited to some machines (a team scope) see, and download checklists and POA&Ms for, only those machines.
Supported systems
RHEL, Rocky Linux, AlmaLinux, Oracle Linux and CentOS Stream 8 or later, and Ubuntu 22.04 and 24.04. Other systems show why they were not scanned.
| System | DISA STIG used | Fetched by itself |
|---|---|---|
| RHEL, Rocky, AlmaLinux, CentOS Stream 8 / 9 | Red Hat Enterprise Linux 8 / 9 | Yes |
| Oracle Linux 8 / 9 | Oracle Linux 8 / 9 | Yes |
| Ubuntu 22.04 / 24.04 | Canonical Ubuntu 22.04 / 24.04 LTS | Yes |
Windows checklists are not made yet: DISA's Windows checks run only in DISA's own SCAP Compliance Checker.