Today we dive into a critical framework, the Department of Defense Information Assurance (DISA) Security Technical Implementation Guide (STIG). These guidelines serve as a cornerstone for ensuring the robust security posture of information systems within the defense sector and beyond. DISA STIG compliance is not only a regulatory obligation; it represents a proactive approach to fortifying IT infrastructure against a spectrum of cyber threats and potential attacks. The implementation and maintenance of DISA STIG standards emerge as a challenge for many defense organizations and federal agencies, especially on the daily operational level. In this context, solutions that automate and streamline the compliance process play an important role in empowering organizations to stay resilient in the face of cybersecurity challenges. In this article, we're going to explain how Runecast helps with Continuous DISA STIG Compliance automation for VMware environments, Windows Server and Linux. 

Continuous DISA STIG Compliance Checks

For both online and air-gapped environments, Runecast automates not only continuous STIG compliance monitoring but also reporting, remediation, and historical analysis for vSphere, Windows Server and Linux environments. It includes exports in CKL, PDF & CSV format, and auto-populating remediation scripts for many STIG controls.

vSphere Compliance Automation Against “Draft” STIGs

With DISA typically releasing official STIGs late in a vSphere version’s lifecycle, Runecast supports the VMware vSphere STIG Readiness Guides (commonly referred to as “draft” STIGs) for customers running the latest versions of vSphere. As of the time of writing, this means Runecast now automates compliance against the VMware vSphere 8 STIG Readiness Guide in addition to covering all 12 check groups for the vSphere 7 DISA STIGs.

Key Aspects of the DISA STIG Automation

Importantly, Runecast automates more processes for STIG compliance than any other product on the market. It includes CKL-format exports for reporting directly in STIG Viewer without any additional manual effort. The fast-growing volume of auto-populating remediation scripts enables mass remediation of STIG non-compliances to further reduce manual workloads and compliance-related IT-hours.

Historical Data Retention

Runecast’s retention of all historical data enables users to export historical evidence of their security compliance posture for any user-defined period, as well as quickly analyze any changes in security compliance posture within any specific time period.

‍

Continuous Audit-Readiness

With Runecast automating continuous STIG compliance, our users no longer need to prepare for STIG audits in vSphere, Windows Server and Linux environments as they can easily achieve continuous “audit-readiness” and export reports or historical data at any time with a single click. 

Custom Security Standards for Non-US Defense-Sector Customers

Most non-US defense-sector customers have developed their own security standards based upon DISA’s STIGs and Runecast caters for them by enabling user-defined “custom” security standards. This feature allows users to quickly modify the checks in any published security standard (including DISA STIG) to create their own user-defined security standard which they can store and scan against. 

‍

Automating DISA STIG Compliance for VMware Workloads. Featuring 'Draft' STIGs.

Discover the latest in automated compliance management: This webinar offers a deep-dive on automating continuous DISA STIG compliance monitoring, reporting and remediation for VMware, Windows Server and Linux with Runecast.

Register Now

‍