CIS Benchmarks & DISA STIGs Overview

#CIS and STIG Are Not Just Checklists—They're Your Minimum Security Contract#link

The Center for Internet Security (CIS) publishes benchmarks for every major OS, and DISA releases Security Technical Implementation Guides (STIGs) for US DoD systems. These frameworks provide thousands of configuration recommendations. This lesson shows you how to navigate the CIS PDF and STIG XML, prioritize Level 1 settings, and map them to your existing GPOs and automation—so you're not just compliant but actually secure.

CIS Benchmarks: Structure and Profiles

A CIS Benchmark is organized by control area (e.g., Account Policies, Network Configuration). Each recommendation has a profile (Level 1 – basic security, Level 2 – defense-in-depth), a description, rationale, audit, and remediation steps. Level 1 should be implemented everywhere without breaking functionality. Level 2 may impact performance or compatibility. Use the CIS-CAT tool to assess compliance against a benchmark.

The download includes ready-to-import GPO backups that apply the Level 1 settings. Always review the PDF to understand the security impact.

DISA STIGs: Military-Grade Hardening

STIGs are far more prescriptive and stringent than CIS. They are delivered as XML (xccdf) files and can be ingested by SCAP scanners. Each STIG rule has a severity (CAT I, II, III), a vulnerability discussion, and a fix text. STIGs enforce settings like FIPS 140-2 cryptography, strict audit policies, and removal of GUI on servers. Even if you're not a DoD contractor, STIGs provide an excellent high-security baseline.

# Use OpenSCAP to scan a system against a STIG profile
sudo oscap xccdf eval --profile stig --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Prioritizing and Tailoring Recommendations

Don't blindly apply all settings. Map CIS/STIG controls to your organization's risk assessment. Focus on settings that mitigate the most likely threats: account lockout, audit logging, service minimization. For each setting you choose not to implement, document the risk acceptance and compensating control. Use a compliance tracking spreadsheet or GRC tool to manage this.

• ▪Download the CIS Benchmark for each OS in use; start with Level 1.
• ▪Use CIS-CAT or OpenSCAP to measure current compliance and identify gaps.
• ▪For high-security environments, review the STIG and adopt the most impactful CAT I settings.
• ▪Document all deviations and compensating controls in a risk register.