Gardience · Government · Updated 2026-11-07 · Gardience Engineering · How we test

STIG automation for Linux and Windows servers

• WeeklyDISA STIG scans with OpenSCAP; a scan changes nothing
• 1 .cklper scanned machine, built from DISA's own STIG file
• 30, 90, 180days to fix in the POA&M, by CAT severity
• $6,000a year, Starter, up to 250 machines

A Security Technical Implementation Guide (STIG) is the configuration standard the Defense Information Systems Agency (DISA) publishes for each operating system the Department of Defense runs. Keeping a fleet on its STIG means three jobs that repeat every quarter: scan every machine, fill in a STIG Viewer checklist for each one, and track every open finding on a plan of action (POA&M) for eMASS. Gardience does all three from one console on your own server.

The scanner and its rules are free, open-source tools: OpenSCAP and the SCAP Security Guide, the project DISA builds its own RHEL STIG content from. Nothing has to be bought. Ubuntu ships no current STIG content, so Gardience delivers the SCAP Security Guide's Ubuntu content itself.

Automated results say so in Finding Details, with the date and the content that checked them, so an assessor can tell them apart from your own entries. An automated check that could not run on a machine is left Not Reviewed with a note, never reported as passing. Open the checklists in DISA's STIG Viewer 2 or 3, or upload them to eMASS.

• Each STIG requirement that failed its automated check, under the NIST SP 800-53 control DISA maps its CCI to, with DISA's rule number, Vuln ID, STIG ID, and fix text.
• Each CVE Gardience found, under SI-2 (flaw remediation), marked when CISA lists it as actively exploited.

Scheduled completion is 30, 90, or 180 days by severity (CAT I, II, or III), or CISA's due date for an exploited CVE. The risk fields start at the finding's severity for you to review before you submit.

Windows servers and desktops get the Gardience baseline, a set of STIG- and CIS-aligned controls checked on every machine and fixed with one approved click: SMBv1 off, the firewall on for every profile, the Guest account disabled, a 14-character minimum password, lockout after 3 bad sign-ins, Network Level Authentication for Remote Desktop, AutoPlay off, Defender real-time protection on, and Windows Update enabled. Drift repair, patching, BitLocker, and CVE checks run in the same console and land in the same evidence pack.

Yes. Gardience installs from a signed offline bundle. On a network without internet, download the STIG zip from DISA's STIG downloads elsewhere and add it in one step: a single STIG zip, a zip that holds several, or the *_Manual-xccdf.xml all work. See deployment options.

Configuration baselines and security settings are CMMC Level 2 requirements 3.4.1 and 3.4.2, each worth 5 SPRS points and never allowed on a POA&M. The same scans and baseline results feed the CMMC Level 2 assessment, the System Security Plan, and the signed evidence pack. See how patch management for defense contractors fits the same evidence.

STIG scans, checklists, and the eMASS POA&M are part of every paid plan: Starter is $6,000 a year for up to 250 machines and Team is $15,000 a year for up to 1,000, Windows and Linux. All of it is in the free 90-day trial on up to 25 machines. Start a trial or book a 15-minute demo.

Yes, for Windows Server 2016 to 2025, Windows 10 and 11, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream, SLES 15, and Ubuntu 22.04 and 24.04: one checklist per scanned machine, built from DISA's own STIG file, ready for STIG Viewer or an eMASS upload.

Yes. Windows Server 2016, 2019, 2022, and 2025 (member servers and domain controllers) and Windows 10 and 11 are checked against DISA's own Windows SCAP benchmark, with nothing to install on the machine. On real Windows Server machines, Gardience matched DISA's SCAP Compliance Checker on every rule both decided. Already run SCC? Add its results and the checklist says they came from SCC.

No. A scan reads settings and changes nothing. Fixes are separate runs that go through your change windows, locks, and approvals.

No. Gardience downloads the STIGs your machines need from DISA and checks for a newer release every week. On a network without internet, you add the STIG zip yourself in one step.

No. Results show how each machine measures against the STIG's automated checks, and the rules a person must check are left Not Reviewed. Your assessor still reviews the checklist.

Checked November 7, 2026.

• DISA STIGs and DISA STIG downloads.
• DISA STIG Viewer and SRG/STIG tools.
• OpenSCAP and the SCAP Security Guide (ComplianceAsCode).
• Gardience STIG documentation and security baseline controls.

Read more

• STIG and CIS evidence for assessors: Windows and Linux
• SaltStack SecOps is gone: STIG and CIS compliance on Salt now
• Air-gapped patch management for Windows and Linux
• CMMC Phase 2 is paused: what defense suppliers still owe