| Both sides previous revision Previous revision | |
| public:99_annexes:annex-b-terms-and-definitions:s:stig [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:s:stig to public:99_annexes:annex-b-terms-and-definitions:s:stig nick_dido | public:99_annexes:annex-b-terms-and-definitions:s:stig [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido |
|---|
| ====== Security Technical Implementation Guide (STIG) ====== | ====== Security Technical Implementation Guide (STIG) ====== |
| |
| [[private:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] | [[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] |
| |
| ===== Discussion ===== | ===== Discussion ===== |
| STIGs may be distributed in human-readable and machine-processable forms. Machine-processable content may support automated assessment through technologies such as the Security Content Automation Protocol (SCAP) and tools such as OpenSCAP. | STIGs may be distributed in human-readable and machine-processable forms. Machine-processable content may support automated assessment through technologies such as the Security Content Automation Protocol (SCAP) and tools such as OpenSCAP. |
| |
| Within Crucible, a STIG may form part of a [[private:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] or [[private:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]]. Crucible may apply STIG remediation during an [[private:99_annexes:annex-b-terms-and-definitions:i:image_build|Image Build]], assess the resulting [[private:99_annexes:annex-b-terms-and-definitions:h:hardened_image|Hardened Image]], and preserve the findings and evidence associated with the assessment. | Within Crucible, a STIG may form part of a [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] or [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]]. Crucible may apply STIG remediation during an [[public:99_annexes:annex-b-terms-and-definitions:i:image_build|Image Build]], assess the resulting [[public:99_annexes:annex-b-terms-and-definitions:h:hardened_image|Hardened Image]], and preserve the findings and evidence associated with the assessment. |
| |
| ===== Definition ===== | ===== Definition ===== |
| A STIG applies to a defined product, technology, version, or operating context. The applicable STIG and release should therefore be identified explicitly. | A STIG applies to a defined product, technology, version, or operating context. The applicable STIG and release should therefore be identified explicitly. |
| |
| For example, a STIG for [[private:99_annexes:annex-b-terms-and-definitions:r:rhel|RHEL 9]] applies to the Red Hat Enterprise Linux major version 9 family. The exact STIG release, selected profile, tailoring decisions, and applicable exceptions may affect the assessment result. | For example, a STIG for [[public:99_annexes:annex-b-terms-and-definitions:r:rhel|RHEL 9]] applies to the Red Hat Enterprise Linux major version 9 family. The exact STIG release, selected profile, tailoring decisions, and applicable exceptions may affect the assessment result. |
| |
| Applying a STIG does not by itself grant accreditation or an [[private:99_annexes:annex-b-terms-and-definitions:o:operational_approval|Operational Approval]]. The responsible authority evaluates the resulting configuration, findings, risks, and supporting [[private:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] within the applicable operating context. | Applying a STIG does not by itself grant accreditation or an [[public:99_annexes:annex-b-terms-and-definitions:o:operational_approval|Operational Approval]]. The responsible authority evaluates the resulting configuration, findings, risks, and supporting [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] within the applicable operating context. |
| |
| ===== Example ===== | ===== Example ===== |
| |
| A Crucible Image Baseline identifies a DISA STIG for [[private:99_annexes:annex-b-terms-and-definitions:r:rhel|RHEL 9]]. During the Image Build, Crucible applies the selected remediation settings, runs a compliance assessment, records the findings, and associates the resulting evidence with the Hardened Image. | A Crucible Image Baseline identifies a DISA STIG for [[public:99_annexes:annex-b-terms-and-definitions:r:rhel|RHEL 9]]. During the Image Build, Crucible applies the selected remediation settings, runs a compliance assessment, records the findings, and associates the resulting evidence with the Hardened Image. |
| |
| ---- | ---- |