Back to Frameworks

DISA Security Technical Implementation Guides (STIGs)

Self-Assess
United States (Department of Defense; used by other federal agencies and adopters)
vProgram as documented in the Vendor STIG Process Guide V4R1 (15 August 2022), SRG-STIG Library README V2R1 (6 August 2024), STIG Viewer 3.x User Guide V1R5 (11 February 2025), ASD STIG Overview V6R4 (1 October 2025) and NDM SRG Overview V5R4 (28 October 2025)
5 domains
44 controls

DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs), published by the Defense Information Systems Agency via the DoD Cyber Exchange. SRGs are technology-family security-requirement sets derived from NIST SP 800-53 (via Control Correlation Identifiers); STIGs are product-specific hardening guides implementing the applicable SRG, each comprising findings categorised CAT I/II/III, assessed using STIG Viewer and SCAP-validated tools and tracked in eMASS. This node represents the STIG/SRG program structure (technology families, severity categories, assessment tooling and governance lifecycle); the per-product STIG findings are a catalog (hundreds of STIGs) and are not enumerated here.

Verified

DISA Security Technical Implementation Guides (STIGs) is a compliance framework from United States (Department of Defense; used by other federal agencies and adopters) with 5 domains and 44 controls that map to 3 other frameworks. The largest domains are The STIG requirement record: identifiers, wording, status, severity, Check, Fix, mitigation and evidence – DISA Security Technical Implementation Guides (STIGs) (11 controls), Vendor STIG development, validation, approval and publication – DISA Security Technical Implementation Guides (STIGs) (10 controls), Program authority, applicability, distribution and release cycle – DISA Security Technical Implementation Guides (STIGs) (9 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

Assessment with STIG Viewer checklists, automated results and the Applicability Guide – DISA Security Technical Implementation Guides (STIGs)

5 controls
Controls in the Assessment with STIG Viewer checklists, automated results and the Applicability Guide – DISA Security Technical Implementation Guides (STIGs) domain of DISA Security Technical Implementation Guides (STIGs): 5 controls
CodeTitle
disa-security-technical-implementation-guides-stigs::ASSESS-1ASSESS-1 STIGs are consumed as XCCDF; STIG Viewer loads, searches, compares and exports them
disa-security-technical-implementation-guides-stigs::ASSESS-2ASSESS-2 A checklist per target with each rule set to Not a Finding, Open, Not Applicable or Not Reviewed
disa-security-technical-implementation-guides-stigs::ASSESS-3ASSESS-3 Severity overrides require a recorded reason and are marked
disa-security-technical-implementation-guides-stigs::ASSESS-4ASSESS-4 Import automated SCAP or XCCDF results, matched on Rule ID and revision, then complete the manual portion
disa-security-technical-implementation-guides-stigs::ASSESS-5ASSESS-5 The SRG/STIG Applicability Guide: an asset collection that determines the SRGs, STIGs and policy documents to apply

Program authority, applicability, distribution and release cycle – DISA Security Technical Implementation Guides (STIGs)

9 controls
Controls in the Program authority, applicability, distribution and release cycle – DISA Security Technical Implementation Guides (STIGs) domain of DISA Security Technical Implementation Guides (STIGs): 9 controls
CodeTitle
disa-security-technical-implementation-guides-stigs::PGM-1PGM-1 Authority: DODI 8500.01 tasks DISA to develop SRGs, STIGs and CCIs and components to comply
disa-security-technical-implementation-guides-stigs::PGM-2PGM-2 NIST SP 800-53 controls per CNSSI 1253 apply beside the STIGs
disa-security-technical-implementation-guides-stigs::PGM-3PGM-3 All applicable SRGs and STIGs apply to a system, and product STIGs take precedence over the SRG
disa-security-technical-implementation-guides-stigs::PGM-4PGM-4 Test in a representative environment before production; unapplied settings need AO approval
disa-security-technical-implementation-guides-stigs::PGM-5PGM-5 The existence of a STIG is not DOD approval of the product
disa-security-technical-implementation-guides-stigs::PGM-6PGM-6 Distribution: unclassified content on public.cyber.mil, CUI content on cyber.mil with a CAC
disa-security-technical-implementation-guides-stigs::PGM-7PGM-7 Quarterly maintenance releases, out-of-cycle changes and the STIG Summary
disa-security-technical-implementation-guides-stigs::PGM-8PGM-8 The library compilation excludes drafts and sunset STIGs; mid-cycle releases are downloaded individually
disa-security-technical-implementation-guides-stigs::PGM-9PGM-9 Signed release memorandum for each STIG version

Security Requirements Guides: the CCI to SRG to STIG hierarchy and the general requirements of a technology SRG – DISA Security Technical Implementation Guides (STIGs)

9 controls
Controls in the Security Requirements Guides: the CCI to SRG to STIG hierarchy and the general requirements of a technology SRG – DISA Security Technical Implementation Guides (STIGs) domain of DISA Security Technical Implementation Guides (STIGs): 9 controls
CodeTitle
disa-security-technical-implementation-guides-stigs::SRG-1SRG-1 CCIs are the discrete, measurable items sourced from NIST SP 800-53; SRGs sit between CCIs and STIGs
disa-security-technical-implementation-guides-stigs::SRG-2SRG-2 Four core SRGs, technology SRGs beneath them, product STIGs beneath those
disa-security-technical-implementation-guides-stigs::SRG-3SRG-3 SRG naming standard: core SRG, technology SRG and a five- or six-digit sequence
disa-security-technical-implementation-guides-stigs::SRG-4SRG-4 SRG compliance reporting: requirements a product cannot meet go to AOs as a CUI report
disa-security-technical-implementation-guides-stigs::SRG-5SRG-5 NDM SRG scope: the management plane of every network device, applied with the device's function SRG
disa-security-technical-implementation-guides-stigs::SRG-6SRG-6 NDM general requirements: out-of-band or leak-free management network, SNMPv3, logging to syslog, AAA, authenticated NTP, secure image and configuration storage
disa-security-technical-implementation-guides-stigs::SRG-7SRG-7 ASD STIG scope: all networked enterprise applications, DOD-developed and third-party, with the companion STIGs
disa-security-technical-implementation-guides-stigs::SRG-8SRG-8 ASD assessment inputs: application and system documentation, the SSP and the functionality review
disa-security-technical-implementation-guides-stigs::SRG-9SRG-9 ASD general requirements: code scanners whenever possible, application scanners regularly, mobile code by category

The STIG requirement record: identifiers, wording, status, severity, Check, Fix, mitigation and evidence – DISA Security Technical Implementation Guides (STIGs)

11 controls
Controls in the The STIG requirement record: identifiers, wording, status, severity, Check, Fix, mitigation and evidence – DISA Security Technical Implementation Guides (STIGs) domain of DISA Security Technical Implementation Guides (STIGs): 11 controls
CodeTitle
disa-security-technical-implementation-guides-stigs::REQ-1REQ-1 Every STIG requirement carries its IA control, CCI, SRG ID and, once finalised, its STIG ID
disa-security-technical-implementation-guides-stigs::REQ-10REQ-10 Status justification for Not Applicable, Does Not Meet and Inherently Meets rows
disa-security-technical-implementation-guides-stigs::REQ-11REQ-11 Additional rows: one row per setting or attack vector, and CCI-000366 for best practice
disa-security-technical-implementation-guides-stigs::REQ-2REQ-2 Requirement wording: must, the product's name, and 'must be configured to'
disa-security-technical-implementation-guides-stigs::REQ-3REQ-3 Vulnerability discussion: the risk of the requirement unmet, adapted to the product
disa-security-technical-implementation-guides-stigs::REQ-4REQ-4 Status: Applicable-Configurable, Applicable-Inherently Meets, Applicable-Does Not Meet or Not Applicable
disa-security-technical-implementation-guides-stigs::REQ-5REQ-5 Check text: exact validation steps ending in 'If ..., this is a finding'
disa-security-technical-implementation-guides-stigs::REQ-6REQ-6 Fix text: complete, specific, idempotent configuration steps with no finding statement
disa-security-technical-implementation-guides-stigs::REQ-7REQ-7 Severity: CAT I, II or III by the DISA category code definitions, verified by DOD SMEs
disa-security-technical-implementation-guides-stigs::REQ-8REQ-8 Mitigation for Does-Not-Meet requirements, with a residual-risk summary
disa-security-technical-implementation-guides-stigs::REQ-9REQ-9 Artifact description and evidence for Inherently-Meets claims

Vendor STIG development, validation, approval and publication – DISA Security Technical Implementation Guides (STIGs)

10 controls
Controls in the Vendor STIG development, validation, approval and publication – DISA Security Technical Implementation Guides (STIGs) domain of DISA Security Technical Implementation Guides (STIGs): 10 controls
CodeTitle
disa-security-technical-implementation-guides-stigs::DEV-1DEV-1 Vendor STIG intent form, introductory meeting and DISA's decision point
disa-security-technical-implementation-guides-stigs::DEV-10DEV-10 The STIG overview document: executive summary, authority, severity codes, distribution, revisions, considerations, disclaimer, assessment considerations, terminology and general requirements
disa-security-technical-implementation-guides-stigs::DEV-2DEV-2 Orientation: resources, applicable SRGs and the requirements cheat sheet; six-month deferral if resources are unavailable
disa-security-technical-implementation-guides-stigs::DEV-3DEV-3 Stage 1: ten requirements across all four statuses within two weeks
disa-security-technical-implementation-guides-stigs::DEV-4DEV-4 Stages 2 and 3: work-in-progress submissions at 30 and 60 days
disa-security-technical-implementation-guides-stigs::DEV-5DEV-5 Stage 4: the completed initial draft within 90 days and DISA's four possible actions
disa-security-technical-implementation-guides-stigs::DEV-6DEV-6 Validation: DISA SME review, transition to a technology SME, and STIG simulation on the product
disa-security-technical-implementation-guides-stigs::DEV-7DEV-7 Access to the product for simulation and the product loan agreement
disa-security-technical-implementation-guides-stigs::DEV-8DEV-8 Review and approval: internal reviews, style guide, decision brief and DISA AO approval with any use restrictions
disa-security-technical-implementation-guides-stigs::DEV-9DEV-9 Publication: Configurable requirements published with an overview; the other statuses and the compliance report go to AOs as CUI

Your Compliance Coverage

If you comply with DISA Security Technical Implementation Guides (STIGs), you already cover:

NIST SP 800-53 Rev 5

8%

5 controls mapped

Compare →

CMMC 2.0

5%

3 controls mapped

Compare →

CIS Controls v8

2%

1 controls mapped

Compare →
See all 3 mapped frameworks ↓

Maps to 3 other frameworks

66 total controls
NIST SP 800-53 Rev 5
5 source controls mapped|5 target controls covered
8%
CMMC 2.0
3 source controls mapped|3 target controls covered
5%
CIS Controls v8
1 source controls mapped|1 target controls covered
2%
Compare DISA Security Technical Implementation Guides (STIGs) with NIST SP 800-53 Rev 5

Coverage is not the same as your position

This page shows what DISA Security Technical Implementation Guides (STIGs) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is DISA Security Technical Implementation Guides (STIGs) and who does it apply to?

DISA Security Technical Implementation Guides (STIGs) is a compliance framework from United States (Department of Defense; used by other federal agencies and adopters) with 5 domains and 44 controls. DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs), published by the Defense Information Systems Agency via the DoD Cyber Exchange. SRGs are technology-family security-requirement sets derived from NIST SP 800-53 (via Control Correlation Identifiers); STIGs are product-specific hardening guides implementing the applicable SRG, each comprising findings categorised CAT I/II/III, assessed using STIG Viewer and SCAP-validated tools and tracked in eMASS. This node represents the STIG/SRG program structure (technology families, severity categories, assessment tooling and governance lifecycle); the per-product STIG findings are a catalog (hundreds of STIGs) and are not enumerated here. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does DISA Security Technical Implementation Guides (STIGs) actually require?

DISA Security Technical Implementation Guides (STIGs) has 44 controls organised across 5 domains. The largest domains are The STIG requirement record: identifiers, wording, status, severity, Check, Fix, mitigation and evidence – DISA Security Technical Implementation Guides (STIGs) (11 controls), Vendor STIG development, validation, approval and publication – DISA Security Technical Implementation Guides (STIGs) (10 controls), Program authority, applicability, distribution and release cycle – DISA Security Technical Implementation Guides (STIGs) (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of DISA Security Technical Implementation Guides (STIGs) do I already cover?

DISA Security Technical Implementation Guides (STIGs) maps to 3 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (8% coverage), CMMC 2.0 (5% coverage), CIS Controls v8 (2% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement DISA Security Technical Implementation Guides (STIGs)?

Start your DISA Security Technical Implementation Guides (STIGs) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about DISA Security Technical Implementation Guides (STIGs) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 44 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required