DISA Security Technical Implementation Guides (STIGs) SRG-2: SRG-2 Four core SRGs, technology SRGs beneath them, product STIGs beneath those

There are four core SRGs, Application, Network, Operating System and Policy, each addressing the applicable CCIs in the context of its technology family; technology SRGs subordinate to a core SRG address technologies at a more granular level (the Database SRG under the Application SRG, with a product STIG such as a SQL Server STIG under the Database SRG); requirements not applicable to a technology family are identified and justified once at the SRG level and propagate down with any variations in specific values, so each product STIG need not address them, and a technology SRG's general check and fix content applies to products for which no STIG exists.