A defence contractor is told its systems must meet DISA STIGs — how do STIGs differ from CIS Benchmarks, and who must follow each?

## Two sources of hardening guidance NIST SP 800-53 Rev. 5 control **`CM-6` Configuration Settings** requires an organization to establish and document settings that reflect the **most restrictive mode consistent with operational requirements**, using organization-defined **common secure configurations**. Its discussion describes those as recognized, standardized benchmarks - also called security configuration checklists, lockdown and hardening guides, and security reference guides - and names **security technical implementation guides (STIGs)** among them. The 800-53 reference list identifies the STIGs as published by the **Defense Information Systems Agency (DISA)**. So STIGs and CIS Benchmarks are the same *kind* of artefact. They differ in who writes them, who must use them and how they are organized. ## How they differ | Aspect | DISA STIG | CIS Benchmark | |---|---|---| | Publisher | Defense Information Systems Agency, part of the US Department of Defense | Center for Internet Security, an independent nonprofit | | How it is made | Written for DoD's own environments and requirements | Consensus-based effort of practitioners | | Who follows it | DoD systems, and contractors or others whose contract or customer requires it | Anyone who chooses to adopt it | | Structure | Rules for a specific product and version | Recommendations grouped into profiles such as Level 1 and Level 2 | | Basis for use | Mandate | Voluntary adoption, unless a customer or policy names it | `CM-6` captures the mandate point directly: implementation of a common secure configuration may be mandated at the organization, mission, system or a higher level, including by a regulatory agency. A STIG requirement in a defence contract is exactly that kind of mandate. ## Applying it to the defence contractor 1. **Identify the scope.** Which systems does the contract cover - those that process the customer's information, or the whole estate? Hardening to STIGs is expensive, so scope matters. 2. **Map each in-scope product to its STIG.** STIGs are per product and version, like Benchmarks; an unlisted product needs a documented approach agreed with the customer. 3. **Do not substitute a CIS Benchmark on your own authority.** The requirement names STIGs. A CIS Level 2 profile may be close on many settings, but "close" is not what the customer asked for. 4. **Use CIS's STIG-aligned content where it helps.** CIS publishes Benchmarks aligned to specific DISA STIGs for a range of platforms, which can ease the work for a team used to CIS format - while the STIG remains the requirement. 5. **Document and approve deviations.** Some STIG settings will break a business function. `CM-6` requires deviations to be identified, documented and approved based on operational requirements; the customer may need to agree to them. 6. **Keep current.** STIGs and Benchmarks are revised; the configuration baseline must be updated when they change or when components are upgraded. ## What the assessor will ask for Whether the customer checks STIG conformance itself or relies on the contractor's evidence, the same records answer the questions: which STIG and version applies to each in-scope product, the settings applied, the list of deviations with the operational reason and the customer's approval, and when the baseline was last reviewed. A contractor that keeps those records can show its position quickly; one that only has a hardened server and no documentation cannot, even if most settings are correct. This documented baseline is the same artefact CM-2 asks for as the system's baseline configuration, so the STIG work and the configuration management work are one effort, not two. ## Common misconceptions - **"CIS Level 2 equals STIG."** They share many settings but come from different authorities with different scopes. - **"STIGs are law for every US company."** They bind DoD systems and whoever is contractually required to use them. - **"A STIG removes the need for judgment."** Operational conflicts still arise, and `CM-6` expects documented, approved deviations rather than silent non-compliance. - **"CIS Benchmarks are only for small firms."** They are widely used as the default hardening reference where no mandate names something else. A strong answer names DISA as the STIG publisher, explains that STIGs are mandated for DoD environments while Benchmarks are adopted by choice, places both as common secure configurations under `CM-6`, and insists on documented deviations whichever is used.