Our branch is part of the Cyber Standards and Analysis Division under DISA's Risk Management Executive. We develop and provide operationally implementable secure configuration guidance for use throughout the DoD
We are not the:
• DoD approver for the procurement or use of a product or technology
• National Information Assurance Partnership (NIAP)
• National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP)
• DoD Unified Capabilities (UC) Approved Products List (APL)
No. DISA certifies Information Systems for use in DISA. DISA not does certify products for DoD use. SRGs/STIGs are designed to assist in implementing the secure deployment of products.
Security Content Automation Protocol (SCAP) is a collection of specifications
• Specifications originally developed by the government which are now being adopted as the industry standard
• Supports a standards based approach to develop and publish IA configuration guidance, assess assets, and report compliance
Save the STIG zip file package to your local PC drive and extract it to a folder. Extract the files from the zip package that ends with MANUAL_STIG into a new folder. Open the folder with the extracted files, locate and open the .xml file using a web browser. For requestors who want PDF interactive checkboxes, etc.
PDF formats have been an interim step for STIG publication, and are being phased out. There is currently no plan to develop updatable PDF formats for STIGs. The future format for STIG publication is XCCDF output. The conversion process has begun for XCCDF, to enable STIG consumption by tools where both compliance and configuration remediation can be automated with the addition of OVAL code. Several operating system STIGs appear on the DoD Cyber Exchange web site today in the XCCDF format.
The XCCDF format of STIG is made human readable by using a style sheet, which will be bundled with each STIG. It is not in our current plan to create interactive checkbox functionality for XCCDF format STIGs.
Determine if a STIG has been published for an earlier version of the same product. Many checks and fixes in earlier versions of STIGs can be applied to the new version of the product. If a STIG for an older version of the product is available, review the check and fix procedures to determine which of these work with the new product version. Where possible, use the checks and fixes that work directly with the new version. The remainder of checks and fixes that no longer work with the new product version will need to be evaluated and proper check and fix procedures will need to be determined for each requirement. New product features and configuration settings must also be accounted for based on the relevant SRG.
If there is no related STIG, the most relevant SRG can be used to determine compliance with DoD policies. If assistance is needed in determining which SRG applies to the product, please open a ticket with the STIG Customer Support Helpdesk at disa.stig_spt@mail.mil
In fulfilling a requirement, be it from an SRG or an earlier version of a STIG, vendor documentation may be followed for configuration guidance.
To download all SRG/STIG tools and viewing guidance, please go to https://public.cyber.mil/stigs/srg-stig-tools/.
SCAP 1.2 benchmarks are published using the data stream XML format. The traditional XCCDF, OVAL, CPE-OVAL, and CPE-Dictionary components of a DISA Benchmark are bundled together as a single data stream file, which is then ZIPped for delivery. The data stream format adds the capability to sign SCAP content, which may be utilized in future releases of DISA Benchmarks.
Although the SCC tool does support Debian SCAP benchmarks DISA will not be releasing a benchmark for Debian.