# DISA STIGs (Security Technical Implementation Guides)

Gold standard for DoD configuration compliance. Machine-readable (SCAP/XCCDF format).

## Downloads

- STIG Portal: https://public.cyber.mil/stigs/downloads/ (no CAC required)
- STIG Viewer: download from same portal to read .xccdf files
- User Guide (v1r5, Feb 2025): https://dl.dod.cyber.mil/wp-content/uploads/stigs/pdf/U_STIG_Viewer_3-x_User_Guide_V1R5.pdf

## Key STIGs for Network Security

| STIG | Covers |
|------|--------|
| Network Infrastructure Router | Cisco IOS/IOS XE/IOS XR, Juniper router hardening |
| Network Infrastructure L2 Switch | Port security, VLAN config, DHCP snooping, dynamic ARP inspection |
| Network Firewall | Firewall rule design, policy management, logging |
| Network WLAN | WPA2/WPA3 Enterprise, rogue AP detection |
| Network VPN | VPN gateway config, cipher requirements |
| Network IDS/IPS | IDS/IPS deployment and tuning |
| Network DNS | DNS server hardening, DNSSEC |
| General Purpose OS (GPOS) | Linux/Unix baseline (RHEL, Ubuntu, SUSE, Oracle) |
| Canonical Ubuntu 24.04 | Latest Ubuntu LTS hardening |
| Cisco ASA | ASA firewall-specific config |

## Automation

- OpenSCAP: automated STIG compliance checking
- SCAP Compliance Checker: DISA's own scanning tool
- Ansible STIG roles: community-maintained automation for applying STIGs