scap-security-guide(8)
💖 SCAP-SECURITY-GUIDE 💖
okay bestie, welcome to scap-security-guide(8) — that's the System Manager's Manual, and yes we're doing this, buckle up 🎀
✨ NAME ✨
SCAP-Security-Guide — Delivers security guidance, baselines, and associated validation mechanisms utilizing the Security Content Automation Protocol (SCAP). 🦋
🌸 DESCRIPTION 🌸
So like, the project hands you practical security hardening advice and also links it straight to compliance requirements, which makes deployment activities — think certification and accreditation — so much easier. no cap. 💅
And the requirements it covers? oh we're talking the U.S. government (Federal, Defense, and Intelligence Community) and the financial services and health care industries. iconic range honestly. 👑
Here's the vibe: high-level, widely-accepted policies like NIST 800-53 will just say, in prose, that System Administrators must audit "privileged user actions" — and then never define what "privileged actions" actually are. 😭 the audacity. The SSG bridges that gap between generalized policy requirements and specific implementation guidance, and it does it in SCAP formats so automation can happen whenever possible. slay. ✨
The project's homepage lives at: https://www.open-scap.org/security-policies/scap-security-guide
🦋 Profiles in Guide to the Secure Configuration of Amazon Linux 2023
Source data stream: ssg-al2023-ds.xml
The Guide to the Secure Configuration of Amazon Linux 2023 is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
💜 CIS Amazon Linux 2023 Benchmark for Level 2 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Amazon Linux 2023 Benchmark™, v1.0.0, released 2023-06-26.
This profile includes Center for Internet Security® Amazon Linux 2023 CIS Benchmarks™ content.
💜 CIS Amazon Linux 2023 Benchmark for Level 1 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Amazon Linux 2023 Benchmark™, v1.0.0, released 2023-06-26.
This profile includes Center for Internet Security® Amazon Linux 2023 CIS Benchmarks™ content.
🧚 Profiles in Guide to the Secure Configuration of Alibaba Cloud Linux 2
Source data stream: ssg-alinux2-ds.xml
The Guide to the Secure Configuration of Alibaba Cloud Linux 2 is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
🌈 PCI-DSS v4.0 Control Baseline for Alibaba Cloud Linux 2
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information. 💳🔒
🌈 Standard System Security Profile for Alibaba Cloud Linux 2
- Profile ID:
xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a Alibaba Cloud Linux 2 system. Regardless of your system's workload all of these checks should pass. ✅
🎀 Profiles in Guide to the Secure Configuration of Alibaba Cloud Linux 3
Source data stream: ssg-alinux3-ds.xml
The Guide to the Secure Configuration of Alibaba Cloud Linux 3 is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
⭐ PCI-DSS v4.0 Control Baseline for Alibaba Cloud Linux 3
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information. 💳🔒
⭐ Standard System Security Profile for Alibaba Cloud Linux 3
- Profile ID:
xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a Alibaba Cloud Linux 3 system. Regardless of your system's workload all of these checks should pass. ✅
🌈 Profiles in Guide to the Secure Configuration of AlmaLinux OS 9
Source data stream: ssg-almalinux9-ds.xml
okay so the Guide to the Secure Configuration of AlmaLinux OS 9 is split up into 'profiles', which are basically lil groupings of security settings that match up to a known policy. here's what's available bestie:
✨ ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile is packed with configs that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
✨ ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile is packed with configs that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
✨ ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile is packed with configs that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
✨ ANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile is packed with configs that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
💅 CIS AlmaLinux OS 9 Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® AlmaLinux OS 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® AlmaLinux OS 9 CIS Benchmarks™ content.
💅 CIS AlmaLinux OS 9 Benchmark for Level 1 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® AlmaLinux OS 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® AlmaLinux OS 9 CIS Benchmarks™ content.
💅 CIS AlmaLinux OS 9 Benchmark for Level 1 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® AlmaLinux OS 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® AlmaLinux OS 9 CIS Benchmarks™ content.
💅 CIS AlmaLinux OS 9 Benchmark for Level 2 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® AlmaLinux OS 9 Linux 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® AlmaLinux OS 9 CIS Benchmarks™ content.
🫶 Health Insurance Portability and Accountability Act (HIPAA)
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures AlmaLinux OS 9 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
ngl bestie, that last sentence is doing a LOT of legal heavy lifting. read it twice. 💀
🌸 PCI-DSS v4.0.1 Control Baseline for AlmaLinux OS 9
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
This profile ensures AlmaLinux OS 9 is configured in alignment with PCI-DSS v4.0.1 requirements.
🦋 Profiles in Guide to the Secure Configuration of Anolis OS 23
Source data stream: ssg-anolis23-ds.xml
The Guide to the Secure Configuration of Anolis OS 23 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
🌸 PCI-DSS v4.0 Control Baseline for Anolis OS 23
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
⭐ Standard System Security Profile for Anolis OS 23
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a Anolis OS 23 system.
🦋 Profiles in Guide to the Secure Configuration of Anolis OS 8
Source data stream: ssg-anolis8-ds.xml
The Guide to the Secure Configuration of Anolis OS 8 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
🌸 PCI-DSS v4.0 Control Baseline for Anolis OS 8
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
⭐ Standard System Security Profile for Anolis OS 8
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a Anolis OS 8 system.
💜 Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 8
Source data stream: ssg-centos8-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 8 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
✨ ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
✨ ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
✨ ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency — in French it's Agence nationale de la sécurité des systèmes d'information, and ANSSI-BP-028 is their configuration recommendation for GNU/Linux systems. 💜
A copy of the ANSSI-BP-028 lives on the ANSSI website:
And there's an English version of the ANSSI-BP-028 on the ANSSI website too, bestie:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (minimal) 🎀
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile is packed with configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level. Baby steps, but make them secure steps. ✨
ANSSI is the French National Information Security Agency, standing for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 is at the ANSSI website:
An English version of the ANSSI-BP-028 is also at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server 👑
Profile ID: xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content. iykyk 💅
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server 🔥
Profile ID: xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation 🖥️
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation 💻
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) 📋
Profile ID: xccdf_org.ssgproject.content_profile_cui
Straight from NIST 800-171, Section 2.2: security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure, and that structure is:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements come from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements — which supplement the basic ones — are taken from the security controls in NIST Special Publication 800-53.
This profile configures Red Hat Enterprise Linux 8 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
Australian Cyber Security Centre (ACSC) Essential Eight 🌏
Profile ID: xccdf_org.ssgproject.content_profile_e8
This profile has configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Essential Eight. Eight checks, zero chill. 💅
A copy of the Essential Eight in Linux Environments guide is at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA) 🏥
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 8 to the HIPAA Security Rule identified for securing of electronic protected health information.
Heads up bestie: use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). Secure ≠ legally certified, fr fr.
Australian Cyber Security Centre (ACSC) ISM Official 🦘
Profile ID: xccdf_org.ssgproject.content_profile_ism_o
This profile has configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL.
The ISM uses a risk-based approach to cyber security. This profile is your guide to aligning Red Hat Enterprise Linux security controls with the ISM, and you can use it to pick controls specific to an organisation's security posture and risk profile. Very main character of you. ✨
A copy of the ISM is at the ACSC website:
Protection Profile for General Purpose Operating Systems 🛡️
Profile ID: xccdf_org.ssgproject.content_profile_ospp
This profile reflects the mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. So accordingly, this configuration profile is suitable for use in U.S. National Security Systems. Slay. 🇺🇸
PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 8 💳
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
This profile makes sure Red Hat Enterprise Linux 8 is configured in alignment with PCI-DSS v4.0.1 requirements. No card data leaks on our watch. 💖
DISA STIG for Red Hat Enterprise Linux 8 🎖️
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile has configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 8 V2R8.
Besides being applicable to Red Hat Enterprise Linux 8, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 8 image
DISA STIG with GUI for Red Hat Enterprise Linux 8 🪟
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This profile has configuration checks that align to the DISA STIG with GUI for Red Hat Enterprise Linux 8 V2R8.
Besides being applicable to Red Hat Enterprise Linux 8, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 8 image
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 8 profile instead. Not me begging you to skip the GUI. 😭
🌈 Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 10 🌈
Source data stream: ssg-cs10-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 10 is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced) 💎
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (high) 🌸
ANSSI-BP-028 (high) 💜
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
Bestie, this one is locked all the way in — it contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (intermediary) 🦋
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
Okay so this is the middle setting of the trio — configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (minimal) 🌸
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
And the lightest of the three: configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
BSI SYS.1.1 and SYS.1.3 👑
- Profile ID:
xccdf_org.ssgproject.content_profile_bsi
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements OS-Level configuration requirements from the following sources:
- Building-Block SYS.1.1 General Server
- Building-Block SYS.1.3 Linux Server
CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server 🔥
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server ⭐
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation 🎀
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation 💅
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
Australian Cyber Security Centre (ACSC) Essential Eight 🌈
- Profile ID:
xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA) 🫶
- Profile ID:
xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals's electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 10 to the HIPAA Security Rule identified for securing of electronic protected health information.
Heads up bestie: use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). It's a config baseline, not a lawyer. 💀
Australian Cyber Security Centre (ACSC) ISM Official - Base 🧚
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Australian Cyber Security Centre (ACSC) ISM Official - Secret 🙈
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o_secret
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Australian Cyber Security Centre (ACSC) ISM Official - Top Secret 🤫
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o_top_secret
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Protection Profile for General Purpose Operating Systems 💜
- Profile ID:
xccdf_org.ssgproject.content_profile_ospp
This profile is based on the Red Hat Enterprise Linux 10 Common Criteria Guidance.
Where appropriate, CNSSI 1253 or DoD-specific values are used for configuration, based on Configuration Annex to the OSPP.
PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 10 💳
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
This profile ensures Red Hat Enterprise Linux 10 is configured in alignment with PCI-DSS v4.0.1 requirements.
DISA STIG for Red Hat Enterprise Linux 10 ⭐
- Profile ID:
xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 10 V1R2. In addition to being applicable to Red Hat Enterprise Linux 10, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10.
DISA STIG with GUI for Red Hat Enterprise Linux 10 🖥️
- Profile ID:
xccdf_org.ssgproject.content_profile_stig_gui
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 10 V1R2. In addition to being applicable to Red Hat Enterprise Linux 10, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10.
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 10 profile.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 9 ✨
- Source data stream:
ssg-cs9-ds.xml
ANSSI-BP-028 (enhanced) 🇫🇷✨
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (high) 🔥
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (intermediary) 💜
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (minimal) 🌸
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
BSI SYS.1.1 and SYS.1.3 🇩🇪🧚
- Profile ID:
xccdf_org.ssgproject.content_profile_bsi
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements OS-Level configuration requirements from the following sources:
- Building-Block SYS.1.1 General Server
- Building-Block SYS.1.3 Linux Server
Centro Criptológico Nacional (CCN) - STIC for Red Hat Enterprise Linux 9 - Advanced 🇪🇸👑
- Profile ID:
xccdf_org.ssgproject.content_profile_ccn_advanced
This profile defines a baseline that aligns with the "Advanced" configuration of the CCN-STIC-610A22 Guide issued by the National Cryptological Center of Spain in 2022-10.
The CCN-STIC-610A22 guide includes hardening settings for Red Hat Enterprise Linux 9 at basic, intermediate, and advanced levels.
Centro Criptológico Nacional (CCN) - STIC for Red Hat Enterprise Linux 9 - Basic 🎀
- Profile ID:
xccdf_org.ssgproject.content_profile_ccn_basic
This profile defines a baseline that aligns with the "Basic" configuration of the CCN-STIC-610A22 Guide issued by the National Cryptological Center of Spain in 2022-10.
The CCN-STIC-610A22 guide includes hardening settings for Red Hat Enterprise Linux 9 at basic, intermediate, and advanced levels.
Centro Criptológico Nacional (CCN) - STIC for Red Hat Enterprise Linux 9 - Intermediate 💅
- Profile ID:
xccdf_org.ssgproject.content_profile_ccn_intermediate
This profile defines a baseline that aligns with the "Intermediate" configuration of the CCN-STIC-610A22 Guide issued by the National Cryptological Center of Spain in 2022-10.
The CCN-STIC-610A22 guide includes hardening settings for Red Hat Enterprise Linux 9 at basic, intermediate, and advanced levels.
CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server 🛡️🔥
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Server ⭐
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Workstation 🖥️✨
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Workstation 💖
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
DRAFT - Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) 📝🦋
- Profile ID:
xccdf_org.ssgproject.content_profile_cui
From NIST 800-171, Section 2.2: Security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure that consists of:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.
This profile configures Red Hat Enterprise Linux 9 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
bestie it literally says DRAFT in the name, so like, don't treat this as final-final, okay? 💀
Australian Cyber Security Centre (ACSC) Essential Eight 🇦🇺🌊
- Profile ID:
xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Red Hat Enterprise Linux 9 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA) 🏥💜
- Profile ID:
xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 9 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
no cap, "no way guarantees or makes claims against legal compliance" is doing a LOT of heavy lifting here — this is a config profile, not a lawyer 🫶
Australian Cyber Security Centre (ACSC) ISM Official 🇦🇺📋
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o
This profile contains configuration checks for Red Hat Enterprise Linux 9 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL.
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Protection Profile for General Purpose Operating Systems 🧚♀️💫
- Profile ID:
xccdf_org.ssgproject.content_profile_ospp
This profile is part of Red Hat Enterprise Linux 9 Common Criteria Guidance documentation for Target of Evaluation based on Protection Profile for General Purpose Operating Systems (OSPP) version 4.3 and Functional Package for SSH version 1.0.
Where appropriate, CNSSI 1253 or DoD-specific values are used for configuration, based on Configuration Annex to the OSPP.
PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 9
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a whole set of security standards made to keep payment card data handled safely, bestie — the goal is literally stopping data breaches and protecting sensitive financial info. 💳✨
This profile makes sure Red Hat Enterprise Linux 9 is configured in alignment with PCI-DSS v4.0.1 requirements. Periodt.
DISA STIG for Red Hat Enterprise Linux 9
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 9 V2R9.
Not only is it applicable to Red Hat Enterprise Linux 9, this configuration baseline also applies to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 9, like:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 9 image
DISA STIG with GUI for Red Hat Enterprise Linux 9
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 9 V2R9.
Same deal as above — applicable to Red Hat Enterprise Linux 9, and also to the OS tier of Red Hat tech built on Red Hat Enterprise Linux 9, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 9 image
Warning: installing and using a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. 😭 If your Information Systems Security Officer (ISSO) doesn't have a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 9 profile instead. Fr fr, the GUI is not the vibe here. 💅
Profiles in Guide to the Secure Configuration of Debian 11
Source data stream: ssg-debian11-ds.xml
The Guide to the Secure Configuration of Debian 11 is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
Profile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_average
This profile contains items for GNU/Linux installations already protected by multiple higher level security stacks. 🛡️✨
Profile for ANSSI DAT-NT28 High (Enforced) Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_high
This profile contains items for GNU/Linux installations storing sensitive information that can be accessible from unauthenticated or uncontroled networks. 🫣
Profile for ANSSI DAT-NT28 Minimal Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal
This profile contains items to be applied systematically.
Profile for ANSSI DAT-NT28 Restrictive Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive
This profile contains items for GNU/Linux installations exposed to unauthenticated flows or multiple sources.
Standard System Security Profile for Debian 11
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a Debian 11 system. Regardless of your system's workload all of these checks should pass. No exceptions, no skipping. 💖
Profiles in Guide to the Secure Configuration of Debian 12
Source data stream: ssg-debian12-ds.xml
The Guide to the Secure Configuration of Debian 12 is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. 🇫🇷✨
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/Profile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_average
This profile contains items for GNU/Linux installations already protected by multiple higher level security stacks. 🛡️
Profile for ANSSI DAT-NT28 High (Enforced) Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_high
This profile contains items for GNU/Linux installations storing sensitive information that can be accessible from unauthenticated or uncontroled networks.
Profile for ANSSI DAT-NT28 Minimal Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal
This profile contains items to be applied systematically.
Profile for ANSSI DAT-NT28 Restrictive Level
Profile ID: xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive
This profile contains items for GNU/Linux installations exposed to unauthenticated flows or multiple sources.
CIS Debian Benchmark for Level 1 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_level1_server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Debian 12 Benchmark™, v1.1.0, released 2024-09-26.
This profile includes Center for Internet Security® Debian 12 Benchmark™ content.
CIS Debian Benchmark for Level 1 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_level1_workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Debian 12 Benchmark™, v1.1.0, released 2024-09-26.
This profile includes Center for Internet Security® Debian 12 Benchmark™ content.
CIS Debian Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_level2_server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Debian 12 Benchmark™, v1.1.0, released 2024-09-26.
This profile includes Center for Internet Security® Debian 12 Benchmark™ content.
CIS Debian Benchmark for Level 2 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_level2_workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Debian 12 Benchmark™, v1.1.0, released 2024-09-26.
This profile includes Center for Internet Security® Debian 12 Benchmark™ content.
Standard System Security Profile for Debian 12
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a Debian 12 system. Regardless of your system's workload all of these checks should pass. 💅✨
🌸 Profiles in Guide to the Secure Configuration of Debian 13 🌸
Source data stream: ssg-debian13-ds.xml
okay bestie so the Guide to the Secure Configuration of Debian 13 is broken into 'profiles', which are literally just groupings of security settings that correlate to a known policy. Available profiles are:
✨ ANSSI-BP-028 (enhanced)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency — the acronym stands for Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
🔥 ANSSI-BP-028 (high)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency — it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
🎀 ANSSI-BP-028 (intermediary)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, which stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
🦋 ANSSI-BP-028 (minimal)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, standing for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
👑 CIS Debian Benchmark for Level 1 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_level1_server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Debian 13 Benchmark™, v1.0.0, released 2025-12-16.
This profile includes Center for Internet Security® Debian 13 Benchmark™ content.
💖 CIS Debian Benchmark for Level 1 - Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_level1_workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Debian 13 Benchmark™, v1.0.0, released 2025-12-16.
This profile includes Center for Internet Security® Debian 13 Benchmark™ content.
💜 CIS Debian Benchmark for Level 2 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_level2_server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Debian 13 Benchmark™, v1.0.0, released 2025-12-16.
This profile includes Center for Internet Security® Debian 13 Benchmark™ content.
🌈 CIS Debian Benchmark for Level 2 - Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_level2_workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Debian 13 Benchmark™, v1.0.0, released 2025-12-16.
This profile includes Center for Internet Security® Debian 13 Benchmark™ content.
⭐ Standard System Security Profile for Debian 13
- Profile ID:
xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure the standard security baseline of a Debian 13 system. Regardless of your system's workload, all of these checks should pass. no skipping, bestie
🧚 Profiles in Guide to the Secure Configuration of Amazon Elastic Kubernetes Service 🧚
Source data stream: ssg-eks-ds.xml
The Guide to the Secure Configuration of Amazon Elastic Kubernetes Service is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
🌸 CIS Amazon Elastic Kubernetes Service (EKS) Benchmark - Node
- Profile ID:
xccdf_org.ssgproject.content_profile_cis-node
This profile defines a baseline that aligns to the Center for Internet Security® Amazon Elastic Kubernetes Service (EKS) Benchmark™, V1.0.1.
This profile includes Center for Internet Security® Amazon Elastic Kubernetes Service (EKS)™ content.
This profile is applicable to EKS 1.21 and greater.
🌟 CIS Amazon Elastic Kubernetes Service Benchmark - Platform
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the Center for Internet Security® Amazon Elastic Kubernetes Service (EKS) Benchmark™, V1.0.1.
This profile includes Center for Internet Security® Amazon Elastic Kubernetes Service (EKS)™ content.
This profile is applicable to EKS 1.21 and greater.
🍓 Profiles in Guide to the Secure Configuration of Fedora 🍓
Source data stream: ssg-fedora-ds.xml
The Guide to the Secure Configuration of Fedora is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
💀 DRAFT - CIS Fedora Benchmark for Level 2 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This is a draft profile for experimental purposes. It is based on the CIS Fedora 40 Branch Benchmark maintained by CIS Community. Although the CIS Fedora Benchmarks are used as upstream for CIS Red Hat Benchmarks, they are not released as often as Fedora releases, and therefore are expected to diverge along the time. This profile is currently maintained in best efforts for current Fedora releases.
💀 DRAFT - CIS Fedora Benchmark for Level 1 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This is a draft profile for experimental purposes. It is based on the CIS Fedora 40 Branch Benchmark maintained by CIS Community. Although the CIS Fedora Benchmarks are used as upstream for CIS Red Hat Benchmarks, they are not released as often as Fedora releases, and therefore are expected to diverge along the time. This profile is currently maintained in best efforts for current Fedora releases.
💀 DRAFT - CIS Fedora Benchmark for Level 1 - Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l1
This is a draft profile for experimental purposes. It is based on the CIS Fedora 40 Branch Benchmark maintained by CIS Community. Although the CIS Fedora Benchmarks are used as upstream for CIS Red Hat Benchmarks, they are not released as often as Fedora releases, and therefore are expected to diverge along the time. This profile is currently maintained in best efforts for current Fedora releases.
💀 DRAFT - CIS Fedora Benchmark for Level 2 - Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l2
This is a draft profile for experimental purposes. It is based on the CIS Fedora 40 Branch Benchmark maintained by CIS Community. Although the CIS Fedora Benchmarks are used as upstream for CIS Red Hat Benchmarks, they are not released as often as Fedora releases, and therefore are expected to diverge along the time. This profile is currently maintained in best efforts for current Fedora releases.
🫶 CUSP - Common User Security Profile for Fedora Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cusp_fedora
This profile contains rules to harden Fedora Linux according to the Common User Security Guide for Fedora Workstation.
🛡️ OSPP - Protection Profile for General Purpose Operating Systems
- Profile ID:
xccdf_org.ssgproject.content_profile_ospp
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2).
Heads up: as Fedora OS is a moving target, this profile does not guarantee to provide the security levels required from US National Security Systems. The main goal of the profile is to provide Fedora developers with a hardened environment similar to the one mandated by US National Security Systems.
💳 PCI-DSS v3.2.1 Control Baseline for Fedora
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Ensures PCI-DSS v3.2.1 related security configuration settings are applied. money stuff = locked down, periodt
⭐ Standard System Security Profile for Fedora
- Profile ID:
xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure the standard security baseline of a Fedora system. Regardless of your system's workload, all of these checks should pass.
🌸 Profiles in Guide to the Secure Configuration of Firefox 🌸
Source data stream: ssg-firefox-ds.xml
The Guide to the Secure Configuration of Firefox is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
🦊 CUSP - Common User Security Profile for Mozilla Firefox
Profile ID: xccdf_org.ssgproject.content_profile_cusp_firefox
This profile contains rules to harden Mozilla Firefox according to rule 6.1 in the Common User Security Guide for Fedora Workstation.
🦊 Mozilla Firefox STIG
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process, serving as the upstream development environment for the Firefox STIG.
As a result of the upstream/downstream relationship between the SCAP Security Guide project and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content. For official DISA FSO STIG content, refer to https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security%2Cbrowser-guidance.
While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note that commercial support of this SCAP content is NOT available. This profile is provided as example SCAP content with no endorsement for suitability or production readiness. Support for this profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The upstream project homepage is https://www.open-scap.org/security-policies/scap-security-guide/.
🐦 Profiles in Guide to the Secure Configuration of Hummingbird 🐦
Source data stream: ssg-hummingbird-ds.xml
The Guide to the Secure Configuration of Hummingbird is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
🐣 CIS Red Hat Hummingbird Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline inspired by the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30, modified and tailored to Hummingbird container images.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
🐣 Red Hat STIG for Red Hat Hummingbird
Profile ID: xccdf_org.ssgproject.content_profile_stig
This is a profile based on what is expected in the Hummingbird STIG. It is not based on the DISA STIG for Hummingbird, because it was not available at time of the release.
In addition to being applicable to Red Hat Hummingbird, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Hummingbird.
🐱 Profiles in Guide to the Secure Configuration of KylinSec Server 6 🐱
Source data stream: ssg-kylinsecserver6-ds.xml
The Guide to the Secure Configuration of KylinSec Server 6 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
✨ Standard System Security Profile for KylinSec Server 6
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of an KylinSec Server 6. Regardless of your system's workload all of these checks should pass.
🐱 Profiles in Guide to the Secure Configuration of Kylin Server 10 🐱
Source data stream: ssg-kylinserver10-ds.xml
The Guide to the Secure Configuration of Kylin Server 10 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
✨ Standard System Security Profile for Kylin Server V10
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of an Kylin Server V10. Regardless of your system's workload all of these checks should pass.
☸️ Profiles in Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4 ☸️
Source data stream: ssg-ocp4-ds.xml
The Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
🛡️ BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4
Profile ID: xccdf_org.ssgproject.content_profile_bsi-2022
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements configuration requirements from the following sources:
- Building-Block
SYS.1.6Containerisation - Building-BlockAPP.4.4Kubernetes
🛡️ BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4
Profile ID: xccdf_org.ssgproject.content_profile_bsi-node-2022
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements configuration requirements from the following sources:
- Building-Block
SYS.1.6Containerisation - Building-BlockAPP.4.4Kubernetes
🛡️ BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4
Profile ID: xccdf_org.ssgproject.content_profile_bsi-node
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements configuration requirements from the following sources:
- Building-Block
SYS.1.6Containerisation - Building-BlockAPP.4.4Kubernetes
🛡️ BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4
Profile ID: xccdf_org.ssgproject.content_profile_bsi
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements configuration requirements from the following sources:
- Building-Block
SYS.1.6Containerisation - Building-BlockAPP.4.4Kubernetes
👑 CIS Red Hat OpenShift Container Platform 4 Benchmark
Profile ID: xccdf_org.ssgproject.content_profile_cis-1-7
This profile defines a baseline that aligns to the Center for Internet Security® Red Hat OpenShift Container Platform 4 Benchmark™, V1.7.
This profile includes Center for Internet Security® Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
Note that this part of the profile is meant to run on the Platform that Red Hat OpenShift Container Platform 4 runs on top of.
This profile is applicable to OpenShift versions 4.12 and greater.
👑 CIS Red Hat OpenShift Container Platform 4 Benchmark
Profile ID: xccdf_org.ssgproject.content_profile_cis-1-9
This profile defines a baseline that aligns to the Center for Internet Security® Red Hat OpenShift Container Platform 4 Benchmark™, V1.9.0.
This profile includes Center for Internet Security® Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
Note that this part of the profile is meant to run on the Platform that Red Hat OpenShift Container Platform 4 runs on top of.
This profile is applicable to OpenShift versions 4.12 and greater.
👑 CIS Red Hat OpenShift Container Platform 4 Benchmark
Profile ID: xccdf_org.ssgproject.content_profile_cis-node-1-7
This profile defines a baseline that aligns to the Center for Internet Security® Red Hat OpenShift Container Platform 4 Benchmark™, V1.7.
This profile includes Center for Internet Security® Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
Note that this part of the profile is meant to run on the Operating System that Red Hat OpenShift Container Platform 4 runs on top of.
This profile is applicable to OpenShift versions 4.12 and greater.
👑 CIS Red Hat OpenShift Container Platform 4 Benchmark
Profile ID: xccdf_org.ssgproject.content_profile_cis-node-1-9
This profile defines a baseline that aligns to the Center for Internet Security® Red Hat OpenShift Container Platform 4 Benchmark™, V1.9.0.
This profile includes Center for Internet Security® Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
Note that this part of the profile is meant to run on the Operating System that Red Hat OpenShift Container Platform 4 runs on top of.
This profile is applicable to OpenShift versions 4.12 and greater.
👑 CIS Red Hat OpenShift Container Platform 4 Benchmark
Profile ID: xccdf_org.ssgproject.content_profile_cis-node
This profile defines a baseline that aligns to the Center for Internet Security® Red Hat OpenShift Container Platform 4 Benchmark™, V1.9.0.
This profile includes Center for Internet Security® Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
Note that this part of the profile is meant to run on the Operating System that Red Hat OpenShift Container Platform 4 runs on top of.
This profile is applicable to OpenShift versions 4.12 and greater.
🖥️ CIS Red Hat Openshift Virtual Machine Extension Benchmark (Node)
Profile ID: xccdf_org.ssgproject.content_profile_cis-vm-extension-node
This profile defines a baseline that aligns to the Center for Internet Security® Red Hat OpenShift Virtual Machine Extension Benchmark™, V1.0.0.
This profile includes Center for Internet Security® Red Hat OpenShift Virtual Machine Extension Benchmarks™ content.
Note that this part of the profile is meant to run on the Operating System that Red Hat OpenShift Container Platform 4 runs on top of, covering the benchmark's node-level controls (host file permissions, kernel and CPU configuration). The platform-level controls are covered by the companion cis-vm-extension profile.
👑 CIS Red Hat OpenShift Container Platform 4 Benchmark
Profile ID: xccdf_org.ssgproject.content_profile_cis
This profile is a whole baseline that aligns to the <b>CIS®</b> Red Hat OpenShift Container Platform 4 Benchmark™, V1.9.0. Periodt.
And bestie, it literally includes the <b>Center for Internet Security® Red Hat OpenShift Container Platform 4 CIS Benchmarks™</b> content. Full package. 💅
Heads up: this part of the profile is meant to run on the <b>Platform</b> that Red Hat OpenShift Container Platform 4 runs on top of. So like, underneath, not on the OpenShift bits themselves. 🫶
Also it's applicable to <b>OpenShift versions 4.12 and greater</b>. No going backwards, slay. ✨
🌸 Australian Cyber Security Centre (ACSC) Essential Eight 🌸
Profile ID: xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Red Hat OpenShift Container Platform that align to the <b>Australian Cyber Security Centre (ACSC) Essential Eight</b>. Iconic behaviour tbh.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website, no cap:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers🦋 NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Node level 🦋
Profile ID: xccdf_org.ssgproject.content_profile_high-node-rev-4
This compliance profile reflects the core set of <b>High-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat. Like, the whole squad. 👑
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for High-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the <b>stricter security setting was chosen</b>. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package. So if you need the receipts, they're right there. 📦
This profile reflects U.S. Government consensus content and is developed through the <b>ComplianceAsCode</b> initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. Fr fr, it's giving transparency. ✨
🎀 NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Node level 🎀
Profile ID: xccdf_org.ssgproject.content_profile_high-node
This compliance profile reflects the core set of <b>High-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat. Same dream team, different profile ID. 💖
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for High-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the <b>stricter security setting was chosen</b>. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the <b>ComplianceAsCode</b> initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 🌈
🧚 NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level 🧚
Profile ID: xccdf_org.ssgproject.content_profile_high-rev-4
This compliance profile reflects the core set of <b>High-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat. 🫶
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for High-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the <b>stricter security setting was chosen</b>. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the <b>ComplianceAsCode</b> initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 👑
💜 NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level 💜
Profile ID: xccdf_org.ssgproject.content_profile_high
This compliance profile reflects the core set of <b>High-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for High-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the <b>stricter security setting was chosen</b>. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the <b>ComplianceAsCode</b> initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 💅
🍓 NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level 🍓
Profile ID: xccdf_org.ssgproject.content_profile_moderate-node-rev-4
This compliance profile reflects the core set of <b>Moderate-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat. ✨
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the <b>stricter security setting was chosen</b>. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the <b>ComplianceAsCode</b> initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 🌸
💖 NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level 💖
Profile ID: xccdf_org.ssgproject.content_profile_moderate-node
This compliance profile reflects the core set of <b>Moderate-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the <b>stricter security setting was chosen</b>. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the <b>ComplianceAsCode</b> initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 🦋
🌈 NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level 🌈
Profile ID: xccdf_org.ssgproject.content_profile_moderate-rev-4
This compliance profile reflects the core set of <b>Moderate-Impact Baseline</b> configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes.
NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level</p>
Profile ID: xccdf_org.ssgproject.content_profile_moderate
Bestie, this compliance profile is the whole core set of Moderate-Impact Baseline config settings for rolling Red Hat OpenShift Container Platform out into U.S. Defense, Intelligence, and Civilian agencies. The development partners and sponsors? U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat. Iconic lineup ngl 👑
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
And when two config requirements don't agree — password lengths, whatever — the stricter security setting was chosen, periodt. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides come courtesy of the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes.
North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Node level
Profile ID: xccdf_org.ssgproject.content_profile_nerc-cip-node
This compliance profile is a whole set of security recs for using Red Hat OpenShift Container Platform in critical infrastructure in the energy sector. It follows the recommendations coming from these CIP standards:
CIP-002-5CIP-003-8CIP-004-6CIP-005-6CIP-007-3CIP-007-6CIP-009-6
North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Platform level
Profile ID: xccdf_org.ssgproject.content_profile_nerc-cip
Same energy, platform edition 💅 — a set of security recommendations for using Red Hat OpenShift Container Platform in critical infrastructure in the energy sector, following the recs from these CIP standards:
CIP-002-5CIP-003-8CIP-004-6CIP-005-6CIP-007-3CIP-007-6CIP-009-6
PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss-3-2
Ensures PCI-DSS v3.2.1 security configuration settings are applied. That's it, that's the vibe ✨
PCI-DSS v4.0.0 Control Baseline for Red Hat OpenShift Container Platform 4
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss-4-0
Ensures PCI-DSS v4.0.0 security configuration settings are applied. Newer version, same slay 🫶
PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss-node-3-2
Ensures PCI-DSS v3.2.1 security configuration settings are applied. (Yes bestie, the heading looks identical — the ID is what's different, so read the ID. 🙈)
PCI-DSS v4.0.0 Control Baseline for Red Hat OpenShift Container Platform 4
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss-node-4-0
Ensures PCI-DSS v4.0.0 security configuration settings are applied.
PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss-node
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
DISA STIG for Red Hat OpenShift Container Platform 4 - Node level
Profile ID: xccdf_org.ssgproject.content_profile_stig-node-v2r2
This profile contains configuration checks that align to the DISA STIG for Red Hat OpenShift Container Platform 4.
DISA STIG for Red Hat OpenShift Container Platform 4 - Node level
Profile ID: xccdf_org.ssgproject.content_profile_stig-node-v2r3
This profile contains configuration checks that align to the DISA STIG for Red Hat OpenShift Container Platform 4.
DISA STIG for Red Hat OpenShift Container Platform 4 - Node level
Profile ID: xccdf_org.ssgproject.content_profile_stig-node
This profile contains configuration checks that align to the DISA STIG for Red Hat OpenShift Container Platform 4.
DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level
Profile ID: xccdf_org.ssgproject.content_profile_stig-v2r2
This profile contains configuration checks that align to the DISA STIG for Red Hat OpenShift Container Platform 4.
DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level
Profile ID: xccdf_org.ssgproject.content_profile_stig-v2r3
This profile contains configuration checks that align to the DISA STIG for Red Hat OpenShift Container Platform 4.
DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Red Hat OpenShift Container Platform 4.
✨ Profiles in Guide to the Secure Configuration of Oracle Linux 10 ✨
Source data stream: ssg-ol10-ds.xml
Okay bestie, so the Guide to the Secure Configuration of Oracle Linux 10 is chopped up into what we call 'profiles' — basically lil' groupings of security settings that all vibe with one known policy. Here's the whole lineup of profiles you can pick from: 💅
🌸 ANSSI-BP-028 (enhanced)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This one's packed with configs that line up with ANSSI-BP-028 v2.0 at the enhanced hardening level. ✨
So ANSSI? That's the French National Information Security Agency — the full name is Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is their whole configuration recommendation for GNU/Linux systems. Very demure, very French, very secure. 🇫🇷
You can grab a copy of the ANSSI-BP-028 right off the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
And an English version of the ANSSI-BP-028 lives here too: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🔥 ANSSI-BP-028 (high)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
Configs that align to ANSSI-BP-028 v2.0, but this time at the high hardening level. Yeah, we're going up a notch. 😤
ANSSI = the French National Information Security Agency, aka Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is their configuration recommendation for GNU/Linux systems.
Copy of the ANSSI-BP-028: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
English version also available: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🦋 ANSSI-BP-028 (intermediary)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
Configs aligning to ANSSI-BP-028 v2.0 at the intermediary hardening level. The middle child, and honestly? She eats. 💅
ANSSI stands for the French National Information Security Agency — Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is their configuration recommendation for GNU/Linux systems.
ANSSI-BP-028 copy: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
English version: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🎀 ANSSI-BP-028 (minimal)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
Configs that align to ANSSI-BP-028 v2.0 at the minimal hardening level. Starting small but still secure, periodt. ✨
ANSSI is the French National Information Security Agency, aka Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
ANSSI-BP-028 copy: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
English version: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🌈 Australian Cyber Security Centre (ACSC) Essential Eight
- Profile ID:
xccdf_org.ssgproject.content_profile_e8
Config checks for Oracle Linux 10 that align to the Australian Cyber Security Centre (ACSC) Essential Eight. G'day and also lock it down. 🇦🇺
A copy of the Essential Eight in Linux Environments guide lives at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
💜 Health Insurance Portability and Accountability Act (HIPAA)
- Profile ID:
xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule sets up U.S. national standards to protect individuals' electronic personal health information that's created, received, used, or maintained by a covered entity. The Security Rule wants appropriate administrative, physical, and technical safeguards so that the confidentiality, integrity, and security of electronic protected health information stay intact. Very serious business, and yes, your data deserves main character protection. 🔒
This draft profile configures Oracle Linux 10 to the HIPAA Security Rule identified for securing electronic protected health information.
Heads up bestie: using this profile in no way guarantees or makes any claims against legal compliance with the HIPAA Security Rule(s). It's a draft. Don't @ me.
⭐ Australian Cyber Security Centre (ACSC) ISM Official - Base
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o
Config checks for Oracle Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM goes with a risk-based approach to cyber security. This profile gives you a guide to aligning Oracle Linux security controls with the ISM — which you can use to pick controls specific to an organisation's security posture and risk profile. Customized, we love to see it. 💅
Copy of the ISM right here at the ACSC website:
🧚 Australian Cyber Security Centre (ACSC) ISM Official - Secret
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o_secret
Config checks for Oracle Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM). This time with extra secret sauce. 🤫
The ISM uses a risk-based approach to cyber security. This profile is a guide to aligning Oracle Linux security controls with the ISM, which you can use to select controls specific to an organisation's security posture and risk profile.
Copy of the ISM at the ACSC website:
👑 Australian Cyber Security Centre (ACSC) ISM Official - Top Secret
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o_top_secret
Config checks for Oracle Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM). Top Secret is giving maximum clearance energy. 🕵️
The ISM uses a risk-based approach to cyber security. This profile gives you a guide to aligning Oracle Linux security controls with the ISM, so you can select controls specific to an organisation's security posture and risk profile.
Copy of the ISM at the ACSC website:
💖 Protection Profile for General Purpose Operating Systems
- Profile ID:
xccdf_org.ssgproject.content_profile_ospp
Lowkey important context: this profile is based on the Oracle Linux 9 Common Criteria Guidance as guidance for Oracle Linux 10, because OL 10 guidance literally wasn't available at the time of release. We work with what we have. 😭
And where it makes sense, CNSSI 1253 or DoD-specific values are used for configuration, based on the Configuration Annex to the OSPP.
🍓 PCI-DSS v4.0.1 Control Baseline for Oracle Linux 10
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a whole set of security standards designed to make sure payment card data is handled securely, with the goal of preventing data breaches and protecting sensitive financial information. Protect the bag. 💳✨
This draft profile ensures Oracle Linux 10 is configured in alignment with PCI-DSS v4.0.1 requirements.
💀 DRAFT - STIG for Oracle Linux 10
- Profile ID:
xccdf_org.ssgproject.content_profile_stig
This is a draft profile, made for experimental purposes. It's not based on the DISA STIG for OL 10, because that wasn't available at time of the release. So, like, proceed with that in mind bestie. 🙈
💀 DRAFT - STIG with GUI for Oracle Linux 10
- Profile ID:
xccdf_org.ssgproject.content_profile_stig_gui
This is a draft profile, made for experimental purposes. It's not based on the DISA STIG for OL 10, because it wasn't available at time of the release. Same energy, just with a GUI this time. 🖥️✨
🌸 Profiles in Guide to the Secure Configuration of Oracle Linux 7 🌸
Source data stream: ssg-ol7-ds.xml
okay so the Guide to the Secure Configuration of Oracle Linux 7 is split into 'profiles' — think of them as lil curated groupings of security settings that match up to a known policy 💖. Here's every single one you can pick from:
🎀 ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_nt28_enhanced
This one's packed with configurations that align to ANSSI-BP-028 at the enhanced hardening level, bestie.
ANSSI is the French National Information Security Agency — say it with me, it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems ✨.
A copy of the ANSSI-BP-028 lives at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
💅 DRAFT - ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_nt28_high
Configurations aligning to ANSSI-BP-028 at the high hardening level 🫶.
ANSSI is the French National Information Security Agency, and yes it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
🦋 ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_nt28_intermediary
Configurations that align to ANSSI-BP-028 at the intermediary hardening level, no cap.
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
🌈 ANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_nt28_minimal
Configurations that align to ANSSI-BP-028 at the minimal hardening level — the chillest of the four fr fr.
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
👑 Criminal Justice Information Services (CJIS) Security Policy
Profile ID: xccdf_org.ssgproject.content_profile_cjis
This profile is derived from FBI's CJIS v5.4 Security Policy. A copy of this policy is chilling at the CJIS Security Policy Resource Center:
https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center
💜 Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile ID: xccdf_org.ssgproject.content_profile_cui
Straight from NIST 800-171, Section 2.2: the security requirements for protecting the confidentiality of CUI in non-federal information systems and organizations have a well-defined structure that consists of:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements come from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic ones, are taken from the security controls in NIST Special Publication 800-53 ✨.
This profile configures Oracle Linux 7 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI).
🍓 DRAFT - Australian Cyber Security Centre (ACSC) Essential Eight
Profile ID: xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Oracle Linux 7 that align to the Australian Cyber Security Centre (ACSC) Essential Eight 🔥.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
🧚 Health Insurance Portability and Accountability Act (HIPAA)
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity 💖. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Oracle Linux 7 to the HIPAA Security Rule identified for securing of electronic protected health information.
okay real talk bestie — use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). 💀
⭐ NIST National Checklist Program Security Guide
Profile ID: xccdf_org.ssgproject.content_profile_ncp
This compliance profile reflects the core set of security related configuration settings for deployment of Oracle Linux 7 into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat 👑.
This baseline implements configuration requirements from the following sources:
- Committee on National Security Systems Instruction No. 1253 (CNSSI 1253)
- NIST Controlled Unclassified Information (NIST 800-171)
- NIST 800-53 control selections for MODERATE impact systems (NIST 800-53)
- U.S. Government Configuration Baseline (USGCB)
- NIAP Protection Profile for General Purpose Operating Systems v4.2.1 (OSPP v4.2.1)
- DISA Operating System Security Requirements Guide (OS SRG)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the OpenSCAP/SCAP Security Guide initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors OpenSCAP/SCAP Security Guide content as minor divergences, such as bugfixes, work through the consensus and release processes 💅.
🦋 DRAFT - Protection Profile for General Purpose Operating Systems
Profile ID: xccdf_org.ssgproject.content_profile_ospp
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. Accordingly, this configuration profile is suitable for use in U.S. National Security Systems ✨.
🎀 PCI-DSS v3.2.1 Control Baseline Draft for Oracle Linux 7
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Ensures PCI-DSS v3.2.1 related security configuration settings are applied 🫶.
🌸 Security Profile of Oracle Linux 7 for SAP
Profile ID: xccdf_org.ssgproject.content_profile_sap
This profile contains rules for Oracle Linux 7 Operating System in compliance with SAP note 2069760 and SAP Security Baseline Template version 1.9 Item I-8 and section 4.1.2.2. Regardless of your system's workload all of these checks should pass 💜.
🌈 Standard System Security Profile for Oracle Linux 7
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of Oracle Linux 7 system. Regardless of your system's workload all of these checks should pass, periodt.
🔥 DISA STIG for Oracle Linux 7
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Oracle Linux V3R1 💅.
👑 DISA STIG with GUI for Oracle Linux 7
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This profile contains configuration checks that align to the DISA STIG with GUI for Oracle Linux V3R1.
⚠️ Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Oracle Linux 7 profile. 🫶
🌈 Profiles in Guide to the Secure Configuration of Oracle Linux 8 🌈
Source data stream: ssg-ol8-ds.xml
okay bestie, so the Guide to the Secure Configuration of Oracle Linux 8 is chopped up into profiles — aka little groupings of security settings that each line up with a known policy. here's every single one that's available 💅
⭐ ANSSI-BP-028 (enhanced) ⭐
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
this one is packed with configs that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI = the French National Information Security Agency, and it literally stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems, no cap.
you can grab a copy of the ANSSI-BP-028 over on the ANSSI website:
🔥 ANSSI-BP-028 (high) 🔥
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
this profile holds configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency — Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
a copy of the ANSSI-BP-028 lives at the ANSSI website:
✨ ANSSI-BP-028 (intermediary) ✨
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
this profile is all configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI, the French National Information Security Agency, stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
copy of the ANSSI-BP-028? ANSSI website:
🦋 ANSSI-BP-028 (minimal) 🦋
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
yep, this profile contains configurations aligning to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, standing for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
a copy of the ANSSI-BP-028 can be found at the ANSSI website:
💜 Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) 💜
Profile ID: xccdf_org.ssgproject.content_profile_cui
straight from NIST 800-171, Section 2.2: security requirements for protecting the confidentiality of CUI in non-federal information systems and organizations have a well-defined structure that consists of:
- a basic security requirements section;
- a derived security requirements section.
the basic security requirements come from FIPS Publication 200, which hands you the high-level and fundamental security requirements for federal information and information systems. the derived security requirements — which supplement the basic ones — are taken from the security controls in NIST Special Publication 800-53.
this profile configures Oracle Linux 8 to the NIST Special Publication 800-53 controls that are identified for securing Controlled Unclassified Information (CUI). 🫶
🎀 Australian Cyber Security Centre (ACSC) Essential Eight 🎀
Profile ID: xccdf_org.ssgproject.content_profile_e8
this profile is full of configuration checks for Oracle Linux 8 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
a copy of the Essential Eight in Linux Environments guide is at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
🌸 Health Insurance Portability and Accountability Act (HIPAA) 🌸
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
the HIPAA Security Rule establishes U.S. national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. the Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
this profile configures Oracle Linux 8 to the HIPAA Security Rule identified for securing electronic protected health information.
⚠️ heads up bestie: use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). like, at all.
👑 Australian Cyber Security Centre (ACSC) ISM Official 👑
Profile ID: xccdf_org.ssgproject.content_profile_ism_o
this profile contains configuration checks for Oracle Linux 8 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
the ISM takes a risk-based approach to cyber security. this profile is your guide to aligning Oracle Linux security controls with the ISM, and you can use it to pick controls specific to an organisation's security posture and risk profile.
a copy of the ISM lives at the ACSC website:
💖 Protection Profile for General Purpose Operating Systems 💖
Profile ID: xccdf_org.ssgproject.content_profile_ospp
this profile reflects the mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
it's consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. so yeah — this configuration profile is suitable for use in U.S. National Security Systems. main character energy fr 💅
💳 PCI-DSS v4.0 Control Baseline for Oracle Linux 8 💳
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
this profile makes sure Oracle Linux 8 is configured in alignment with PCI-DSS v4.0 requirements. ✨
🧚 Standard System Security Profile for Oracle Linux 8 🧚
Profile ID: xccdf_org.ssgproject.content_profile_standard
this profile holds rules to ensure the standard security baseline of an Oracle Linux 8 system. regardless of your system's workload, all of these checks should pass. all of them. no skipping 🙈
🦅 DISA STIG for Oracle Linux 8 🦅
Profile ID: xccdf_org.ssgproject.content_profile_stig
this profile contains configuration checks that align to the DISA STIG for Oracle Linux 8 V2R9.
🖥️ DISA STIG with GUI for Oracle Linux 8 🖥️
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
this profile contains configuration checks that align to the DISA STIG with GUI for Oracle Linux V2R9.
⚠️ Warning: the installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. if your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Oracle Linux 8 profile instead. like, seriously bestie, think about it 😭
✨ Profiles in Guide to the Secure Configuration of Oracle Linux 9 ✨
Source data stream: ssg-ol9-ds.xml
Okay bestie, so the Guide to the Secure Configuration of Oracle Linux 9 is split up into 'profiles' — basically lil friend groups of security settings that all vibe with one known policy. Here's the full roster of what's available: 💅
🌸 ANSSI-BP-028 (enhanced) 🌸
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile is packed with configs that align to ANSSI-BP-028 at the enhanced hardening level. ANSSI is the French National Information Security Agency — and it stands for Agence nationale de la sécurité des systèmes d'information, no cap. ANSSI-BP-028 is literally a configuration recommendation for GNU/Linux systems.
Wanna peek at a copy of ANSSI-BP-028? It lives on the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/🔥 ANSSI-BP-028 (high) 🔥
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configs aligned to ANSSI-BP-028 at the high hardening level. ANSSI is the French National Information Security Agency — aka Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/✨ ANSSI-BP-028 (intermediary) ✨
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configs aligned to ANSSI-BP-028 at the intermediary hardening level. ANSSI is the French National Information Security Agency, standing for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/🎀 ANSSI-BP-028 (minimal) 🎀
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configs aligned to ANSSI-BP-028 at the minimal hardening level. ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/👑 Centro Criptológico Nacional (CCN) - STIC for Oracle Linux 9 - Advanced 👑
Profile ID: xccdf_org.ssgproject.content_profile_ccn_advanced
This profile defines a baseline that lines up with the "Advanced" configuration of the CCN-STIC-620 Guide, dropped by the National Cryptological Center of Spain back in 2022-08.
The CCN-STIC-620 guide includes hardening settings for Oracle Linux 9 at basic, intermediate, and advanced levels. So pick your fighter. 💅
🦋 Centro Criptológico Nacional (CCN) - STIC for Oracle Linux 9 - Basic 🦋
Profile ID: xccdf_org.ssgproject.content_profile_ccn_basic
This profile defines a baseline matching the "Basic" configuration of the CCN-STIC-620 Guide, issued by the National Cryptological Center of Spain in 2022-08.
The CCN-STIC-620 guide includes hardening settings for Oracle Linux 9 at basic, intermediate, and advanced levels.
🌈 Centro Criptológico Nacional (CCN) - STIC for Oracle Linux 9 - Intermediate 🌈
Profile ID: xccdf_org.ssgproject.content_profile_ccn_intermediate
This profile defines a baseline that aligns with the "Intermediate" configuration of the CCN-STIC-620 Guide, issued by the National Cryptological Center of Spain in 2022-08.
The CCN-STIC-620 guide includes hardening settings for Oracle Linux 9 at basic, intermediate, and advanced levels.
💀 DRAFT - Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) 💀
Profile ID: xccdf_org.ssgproject.content_profile_cui
Straight from NIST 800-171, Section 2.2: the security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a super well-defined structure that's made up of:
- (i) a basic security requirements section;
- (ii) a derived security requirements section.
The basic security requirements come from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements — which supplement the basic ones — are taken from the security controls in NIST Special Publication 800-53.
This profile configures Oracle Linux 9 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
⭐ Australian Cyber Security Centre (ACSC) Essential Eight ⭐
Profile ID: xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Oracle Linux 9 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers🫶 Health Insurance Portability and Accountability Act (HIPAA) 🫶
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Oracle Linux 9 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). (read that again, bestie — it's not a legal flex, okay?)
💜 Australian Cyber Security Centre (ACSC) ISM Official 💜
Profile ID: xccdf_org.ssgproject.content_profile_ism_o
This profile contains configuration checks for Oracle Linux 9 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Oracle Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
https://www.cyber.gov.au/ism🧚 DRAFT - Protection Profile for General Purpose Operating Systems 🧚
Profile ID: xccdf_org.ssgproject.content_profile_ospp
This profile is part of Oracle Linux 9 Common Criteria Guidance documentation for Target of Evaluation based on Protection Profile for General Purpose Operating Systems (OSPP) version 4.2.1 and Functional Package for SSH version 1.0.
Where appropriate, CNSSI 1253 or DoD-specific values are used for configuration, based on Configuration Annex to the OSPP.
💳 PCI-DSS v4.0 Control Baseline for Oracle Linux 9 💳
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
This profile ensures Oracle Linux 9 is configured in alignment with PCI-DSS v4.0 requirements. 🛡️
🌟 Standard System Security Profile for Oracle Linux 9 🌟
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure the standard security baseline of an Oracle Linux 9 system. Regardless of your system's workload, all of these checks should pass. Periodt.
🔥 DISA STIG for Oracle Linux 9 🔥
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Oracle Linux 9 V1R6.
🙈 DISA STIG with GUI for Oracle Linux 9 🙈
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This profile contains configuration checks that align to the DISA STIG for Oracle Linux 9 V1R6.
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Oracle Linux 9 profile.
🦋 Profiles in Guide to the Secure Configuration of OpenEmbedded 🦋
Source data stream: ssg-openembedded-ds.xml
The Guide to the Secure Configuration of OpenEmbedded is broken into 'profiles' — groupings of security settings that correlate to a known policy. Available profiles are:
🍓 Sample expanded Security Profile for OpenEmbedded Distros 🍓
Profile ID: xccdf_org.ssgproject.content_profile_expanded
This profile is a sample for use in documentation and example content. The selected rules include the standard profile plus more network rules and password aging; they should still pass quickly on most systems. 💅
🎀 Sample Security Profile for OpenEmbedded Distros 🎀
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile is an sample for use in documentation and example content. The selected rules are standard and should pass quickly on most systems. ✨
✨ Profiles in Guide to the Secure Configuration of openEuler 2203 ✨
Source data stream: ssg-openeuler2203-ds.xml
The Guide to the Secure Configuration of openEuler 2203 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. Here's what's on the menu bestie:
🎀 Standard System Security Profile for openEuler 22.03 LTS
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of an openEuler system. Regardless of your system's workload, all of these checks should pass. Like, every single one. No skipping. 💅
🌸 Profiles in Guide to the Secure Configuration of openSUSE 🌸
Source data stream: ssg-opensuse-ds.xml
The Guide to the Secure Configuration of openSUSE is broken into 'profiles', aka groupings of security settings that correlate to a known policy. Available profiles:
🎀 Standard System Security Profile for openSUSE
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of an openSUSE system. Regardless of your system's workload, all of these checks should pass. Periodt. 💖
👑 Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4 👑
Source data stream: ssg-rhcos4-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. Available profiles:
🧚 DRAFT - ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/🧚 DRAFT - ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/🧚 DRAFT - ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/🧚 DRAFT - ANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/🌈 BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.1 and SYS.1.3
Profile ID: xccdf_org.ssgproject.content_profile_bsi-2022
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements OS-Level configuration requirements from the following sources:
- Building-Block SYS.1.1 General Server
- Building-Block SYS.1.3 Linux Server
- Building-Block SYS.1.6 Containerisation
- Building-Block APP.4.4 Kubernetes
🌈 BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.1 and SYS.1.3
Profile ID: xccdf_org.ssgproject.content_profile_bsi
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements OS-Level configuration requirements from the following sources:
- Building-Block SYS.1.1 General Server
- Building-Block SYS.1.3 Linux Server
- Building-Block SYS.1.6 Containerisation
- Building-Block APP.4.4 Kubernetes
🦋 Australian Cyber Security Centre (ACSC) Essential Eight
Profile ID: xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Red Hat Enterprise Linux CoreOS that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers⭐ NIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS
Profile ID: xccdf_org.ssgproject.content_profile_high-rev-4
This compliance profile reflects the core set of High-Impact Baseline configuration settings for deployment of Red Hat Enterprise Linux CoreOS into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for High-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes.
⭐ NIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS
Profile ID: xccdf_org.ssgproject.content_profile_high
This compliance profile reflects the core set of High-Impact Baseline configuration settings for deployment of Red Hat Enterprise Linux CoreOS into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for High-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes.
💜 NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS
Profile ID: xccdf_org.ssgproject.content_profile_moderate-rev-4
This compliance profile reflects the core set of Moderate-Impact Baseline configuration settings for deployment of Red Hat Enterprise Linux CoreOS into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes.
💜 NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS
Profile ID: xccdf_org.ssgproject.content_profile_moderate
This compliance profile reflects the core set of Moderate-Impact Baseline configuration settings for deployment of Red Hat Enterprise Linux CoreOS into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- NIST 800-53 control selections for Moderate-Impact systems (
NIST 800-53)
Okay so when the config requirements disagreed — think password lengths and stuff — the stricter security setting won. No compromise, periodt. And the Security Requirement Traceability Guides (RTMs) plus sample System Security Configuration Guides? Those come to you via the scap-security-guide-docs package. 💖
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 👑
North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for Red Hat Enterprise Linux CoreOS ⚡
- Profile ID:
xccdf_org.ssgproject.content_profile_nerc-cip
This compliance profile reflects a set of security recommendations for the usage of Red Hat Enterprise Linux CoreOS in critical infrastructure in the energy sector. It follows the recommendations coming from these CIP standards, bestie:
CIP-002-5CIP-003-8CIP-004-6CIP-005-6CIP-007-3CIP-007-6CIP-009-6
DISA STIG for Red Hat Enterprise Linux CoreOS 🎖️
- Profile ID:
xccdf_org.ssgproject.content_profile_stig-v2r2
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux CoreOS 4.
DISA STIG for Red Hat Enterprise Linux CoreOS 🎖️
- Profile ID:
xccdf_org.ssgproject.content_profile_stig-v2r3
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux CoreOS 4.
DISA STIG for Red Hat Enterprise Linux CoreOS 🎖️
- Profile ID:
xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux CoreOS 4.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 10 🍓
- Source data stream:
ssg-rhel10-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 10 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced) 🇫🇷
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-systemANSSI-BP-028 (high) 🇫🇷
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-systemANSSI-BP-028 (intermediary) 🇫🇷
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-systemANSSI-BP-028 (minimal) 🇫🇷
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-systemBSI SYS.1.1 and SYS.1.3 🇩🇪
- Profile ID:
xccdf_org.ssgproject.content_profile_bsi
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements OS-Level configuration requirements from the following sources:
- Building-Block
SYS.1.1General Server - Building-Block
SYS.1.3Linux Server
CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server 🖥️
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server 🖥️
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation 💻
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation 💻
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 10 Benchmark™, v1.0.1, released 2025-09-30.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
Australian Cyber Security Centre (ACSC) Essential Eight 🦘
- Profile ID:
xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-serversHealth Insurance Portability and Accountability Act (HIPAA) 🏥
- Profile ID:
xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals's electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 10 to the HIPAA Security Rule identified for securing of electronic protected health information.
⚠️ bestie, listen — use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). It's a vibe, not a lawyer. 😭
Australian Cyber Security Centre (ACSC) ISM Official - Base 🦘
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
https://www.cyber.gov.au/ismAustralian Cyber Security Centre (ACSC) ISM Official - Secret 🤫
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o_secret
This profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
okay so the ISM is out here doing a whole risk-based approach to cyber security 🎀 and this profile is literally your little roadmap for lining up Red Hat Enterprise Linux security controls with the ISM — which slaps, because it means you can pick the controls that actually fit your org's security posture and risk profile, yk? 💅
you can grab a copy of the ISM at the ACSC website, bestie:
👑 Australian Cyber Security Centre (ACSC) ISM Official - Top Secret 👑
Profile ID: xccdf_org.ssgproject.content_profile_ism_o_top_secret
this one's got all the config checks for Red Hat Enterprise Linux 10 that line up with the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) ✨
and yeah, the ISM does the risk-based approach thing to cyber security — this profile is the guide for aligning RHEL security controls with it, so you can select controls specific to your organisation's security posture and risk profile. it's giving choose-your-own-adventure but for hardening 🌸
a copy of the ISM lives at the ACSC website:
🌈 Protection Profile for General Purpose Operating Systems 🌈
Profile ID: xccdf_org.ssgproject.content_profile_ospp
this profile is based on the Red Hat Enterprise Linux 10 Common Criteria Guidance, periodt.
and where it makes sense, CNSSI 1253 or DoD-specific values get used for configuration — that's straight from the Configuration Annex to the OSPP 💖
💳 PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 10 💳
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards made to keep payment card data handled securely — the whole goal being to stop data breaches and protect sensitive financial info 🫶
so this profile makes sure Red Hat Enterprise Linux 10 is configured in alignment with PCI-DSS v4.0.1 requirements. no cap.
🔥 DISA STIG for Red Hat Enterprise Linux 10 🔥
Profile ID: xccdf_org.ssgproject.content_profile_stig
this profile has the configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 10 V1R2 ⭐ and on top of being applicable to RHEL 10 itself, this configuration baseline also applies to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10. iconic behaviour tbh.
🦋 DISA STIG with GUI for Red Hat Enterprise Linux 10 🦋
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
same deal as above: configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 10 V1R2, and it's applicable to RHEL 10 plus the operating system tier of Red Hat technologies based on Red Hat Enterprise Linux 10 ✨
⚠️ Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 10 profile. 💀 like, seriously bestie, more GUI = more attack surface, and that is not the vibe.
💜 Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 8 💜
Source data stream: ssg-rhel8-ds.xml
okay so the Guide to the Secure Configuration of Red Hat Enterprise Linux 8 is broken into 'profiles' — groupings of security settings that correlate to a known policy 🎀 here's the roster:
🧚 ANSSI-BP-028 (enhanced) 🧚
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
this profile has configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level 🔥
ANSSI is the French National Information Security Agency, and it stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems, iykyk.
a copy of the ANSSI-BP-028 is at the ANSSI website:
and an English version of the ANSSI-BP-028 is also at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
💅 ANSSI-BP-028 (high) 💅
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
configurations aligning to ANSSI-BP-028 v2.0 at the high hardening level ✨
ANSSI is the French National Information Security Agency — Agence nationale de la sécurité des systèmes d'information — and ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
a copy of the ANSSI-BP-028 is at the ANSSI website:
and the English version is also at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🌸 ANSSI-BP-028 (intermediary) 🌸
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
configurations aligning to ANSSI-BP-028 v2.0 at the intermediary hardening level 💖
ANSSI = the French National Information Security Agency, standing for Agence nationale de la sécurité des systèmes d'information, and ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
a copy of the ANSSI-BP-028 is at the ANSSI website:
English version, also on the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🎀 ANSSI-BP-028 (minimal) 🎀
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
configurations aligning to ANSSI-BP-028 v2.0 at the minimal hardening level 🫶
ANSSI is the French National Information Security Agency (Agence nationale de la sécurité des systèmes d'information) and ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
a copy of the ANSSI-BP-028 is at the ANSSI website:
and an English version of the ANSSI-BP-028 is also at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
🛡️ CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server 🛡️
Profile ID: xccdf_org.ssgproject.content_profile_cis
this profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28 ⭐
and it includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content. slay.
✨ CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server ✨
Profile ID: xccdf_org.ssgproject.content_profile_cis_server_l1
baseline aligning to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28 💖
also includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
💻 CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation 💻
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l1
baseline aligning to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28 🌸
yep, it includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content too.
🔮 CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation 🔮
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l2
baseline aligning to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v4.0.0, released 2025-08-28 👑
includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content. periodt.
🌈 Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) 🌈
Profile ID: xccdf_org.ssgproject.content_profile_cui
straight from NIST 800-171, Section 2.2: security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure that consists of:
- a basic security requirements section;
- a derived security requirements section.
the basic security requirements come from FIPS Publication 200, which gives the high-level and fundamental security requirements for federal information and information systems 💅 and the derived security requirements — which supplement the basic ones — are taken from the security controls in NIST Special Publication 800-53.
so this profile configures Red Hat Enterprise Linux 8 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
🦋 Australian Cyber Security Centre (ACSC) Essential Eight 🦋
Profile ID: xccdf_org.ssgproject.content_profile_e8
this profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Essential Eight 🎀
a copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
🏥 Health Insurance Portability and Accountability Act (HIPAA) 🏥
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule is giving major "we protect your health data" energy — it sets U.S. national standards to protect individuals' electronic personal health information that gets created, received, used, or maintained by a covered entity. The Security Rule is like, okay bestie, you NEED appropriate administrative, physical and technical safeguards to make sure your electronic protected health information stays confidential, intact, and secure. 💖
This profile configures Red Hat Enterprise Linux 8 to the HIPAA Security Rule identified for securing electronic protected health information. But real talk — use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). It's giving ✨best effort, not a lawyer✨.
🌸 Australian Cyber Security Centre (ACSC) ISM Official 🌸
- Profile ID:
xccdf_org.ssgproject.content_profile_ism_o
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL. 🇦🇺
The ISM uses a risk-based approach to cyber security, which is honestly so main character of it. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile. iykyk.
A copy of the ISM can be found at the ACSC website, go look it up bestie:
https://www.cyber.gov.au/ism🦋 Protection Profile for General Purpose Operating Systems 🦋
- Profile ID:
xccdf_org.ssgproject.content_profile_ospp
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1). No cap, it's literally in the name.
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. So accordingly, this configuration profile is suitable for use in U.S. National Security Systems. 🇺🇸✨
💳 PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 8 💳
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information. Protect the card numbers, periodt. 💳
This profile ensures Red Hat Enterprise Linux 8 is configured in alignment with PCI-DSS v4.0.1 requirements.
🔥 DISA STIG for Red Hat Enterprise Linux 8 🔥
- Profile ID:
xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 8 V2R8.
In addition to being applicable to Red Hat Enterprise Linux 8, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 8 image
🖥️ DISA STIG with GUI for Red Hat Enterprise Linux 8 🖥️
- Profile ID:
xccdf_org.ssgproject.content_profile_stig_gui
This profile contains configuration checks that align to the DISA STIG with GUI for Red Hat Enterprise Linux 8 V2R8.
In addition to being applicable to Red Hat Enterprise Linux 8, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 8 image
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 8 profile. Not me telling you the GUI is a glow-up that comes with a security tax 💀
✨ Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 9 ✨
- Source data stream:
ssg-rhel9-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 9 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are, bestie, and there are a LOT of them 💅:
🧚 ANSSI-BP-028 (enhanced) 🧚
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level. Extra crunchy, extra secure. 🔥
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. 🇫🇷
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system💜 ANSSI-BP-028 (high) 💜
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system🌸 ANSSI-BP-028 (intermediary) 🌸
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level. The middle child, but make it secure. 🙈
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system🎀 ANSSI-BP-028 (minimal) 🎀
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level. Baby steps, but secure baby steps. ✨
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/An English version of the ANSSI-BP-028 can also be found at the ANSSI website:
https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system🛡️ BSI SYS.1.1 and SYS.1.3 🛡️
- Profile ID:
xccdf_org.ssgproject.content_profile_bsi
This profile defines a baseline that aligns to the BSI (Federal Office for Security Information) IT-Grundschutz Basic-Protection.
This baseline implements OS-Level configuration requirements from the following sources:
- Building-Block SYS.1.1 General Server
- Building-Block SYS.1.3 Linux Server
🇪🇸 Centro Criptológico Nacional (CCN) - STIC for Red Hat Enterprise Linux 9 - Advanced 🇪🇸
- Profile ID:
xccdf_org.ssgproject.content_profile_ccn_advanced
This profile defines a baseline that aligns with the "Advanced" configuration of the CCN-STIC-610A22 Guide issued by the National Cryptological Center of Spain in 2022-10.
The CCN-STIC-610A22 guide includes hardening settings for Red Hat Enterprise Linux 9 at basic, intermediate, and advanced levels. Slay at every tier. 💅
🇪🇸 Centro Criptológico Nacional (CCN) - STIC for Red Hat Enterprise Linux 9 - Basic 🇪🇸
- Profile ID:
xccdf_org.ssgproject.content_profile_ccn_basic
This profile defines a baseline that aligns with the "Basic" configuration of the CCN-STIC-610A22 Guide issued by the National Cryptological Center of Spain in 2022-10.
The CCN-STIC-610A22 guide includes hardening settings for Red Hat Enterprise Linux 9 at basic, intermediate, and advanced levels.
🇪🇸 Centro Criptológico Nacional (CCN) - STIC for Red Hat Enterprise Linux 9 - Intermediate 🇪🇸
- Profile ID:
xccdf_org.ssgproject.content_profile_ccn_intermediate
This profile defines a baseline that aligns with the "Intermediate" configuration of the CCN-STIC-610A22 Guide issued by the National Cryptological Center of Spain in 2022-10.
The CCN-STIC-610A22 guide includes hardening settings for Red Hat Enterprise Linux 9 at basic, intermediate, and advanced levels.
🔐 CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server 🔐
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
👑 CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Server 👑
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile is out here defining a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20. 💖
And yes, this profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content. slay.
✨ CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Workstation ✨
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l1
Okay so this one defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20. 🎀
And again — this profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content. periodt.
🦋 CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Workstation 🦋
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l2
Same energy, next level: this profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 9 Benchmark™, v2.0.0, released 2024-06-20. 💅
And yeah, this profile includes Center for Internet Security® Red Hat Enterprise Linux 9 CIS Benchmarks™ content. 💖
🌸 DRAFT - Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) 🌸
Profile ID: xccdf_org.ssgproject.content_profile_cui
Bestie, straight from NIST 800-171, Section 2.2: security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure that consists of:
- (i) a basic security requirements section;
- (ii) a derived security requirements section.
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53. 🫶
And this profile configures Red Hat Enterprise Linux 9 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)." 👑
⭐ Australian Cyber Security Centre (ACSC) Essential Eight ⭐
Profile ID: xccdf_org.ssgproject.content_profile_e8
This profile contains configuration checks for Red Hat Enterprise Linux 9 that align to the Australian Cyber Security Centre (ACSC) Essential Eight. 🇦🇺
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-
content/publications/hardening-linux-workstations-and-servers💜 Health Insurance Portability and Accountability Act (HIPAA) 💜
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. 🩺
This profile configures Red Hat Enterprise Linux 9 to the HIPAA Security Rule identified for securing of electronic protected health information.
⚠️ real talk: use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). not a flex, just facts. 💀
🌈 Australian Cyber Security Centre (ACSC) ISM Official 🌈
Profile ID: xccdf_org.ssgproject.content_profile_ism_o
This profile contains configuration checks for Red Hat Enterprise Linux 9 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL. 📋
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile. 🔥
A copy of the ISM can be found at the ACSC website:
https://www.cyber.gov.au/ism🎀 Protection Profile for General Purpose Operating Systems 🎀
Profile ID: xccdf_org.ssgproject.content_profile_ospp
This profile is part of Red Hat Enterprise Linux 9 Common Criteria Guidance documentation for Target of Evaluation based on Protection Profile for General Purpose Operating Systems (OSPP) version 4.3 and Functional Package for SSH version 1.0. 🧚
Where appropriate, CNSSI 1253 or DoD-specific values are used for configuration, based on Configuration Annex to the OSPP. ✨
💳 PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 9 💳
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information. 💸
This profile ensures Red Hat Enterprise Linux 9 is configured in alignment with PCI-DSS v4.0.1 requirements. slay.
👑 DISA STIG for Red Hat Enterprise Linux 9 👑
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 9 V2R9. 🛡️
In addition to being applicable to Red Hat Enterprise Linux 9, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 9, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 9 image
💅 DISA STIG with GUI for Red Hat Enterprise Linux 9 💅
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 9 V2R9. 🛡️
In addition to being applicable to Red Hat Enterprise Linux 9, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 9, such as:
- Red Hat Enterprise Linux Server
- Red Hat Enterprise Linux Workstation and Desktop
- Red Hat Enterprise Linux for HPC
- Red Hat Storage
- Red Hat Containers with a Red Hat Enterprise Linux 9 image
🚨 Warning: the installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 9 profile. like… fr fr, think about it. 😭
🖥️ Profiles in Guide to the Secure Configuration of Red Hat Virtualization 4 🖥️
Source data stream: ssg-rhv4-ds.xml
The Guide to the Secure Configuration of Red Hat Virtualization 4 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are: 🫶
💳 PCI-DSS v3.2.1 Control Baseline for Red Hat Virtualization Host (RHVH) 💳
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
Ensures PCI-DSS v3.2.1 security configuration settings are applied. periodt. ✨
🚧 DRAFT - DISA STIG for Red Hat Virtualization Host (RHVH) 🚧
Profile ID: xccdf_org.ssgproject.content_profile_rhvh-stig
This draft profile contains configuration checks that align to the DISA STIG for Red Hat Virtualization Host (RHVH). 👀
note the word draft bestie, it's doing a lot of work there.
🦋 VPP - Protection Profile for Virtualization v. 1.0 for Red Hat Virtualization Host (RHVH) 🦋
Profile ID: xccdf_org.ssgproject.content_profile_rhvh-vpp
This compliance profile reflects the core set of security related configuration settings for deployment of Red Hat Virtualization Host (RHVH) 4.x into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat. 👑
This baseline implements configuration requirements from the following sources:
- Committee on National Security Systems Instruction No. 1253 (CNSSI 1253)
- NIST 800-53 control selections for MODERATE impact systems (NIST 800-53)
- U.S. Government Configuration Baseline (USGCB)
- NIAP Protection Profile for Virtualization v1.0 (VPP v1.0)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package. 📚
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode project, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. 💖
🌸 Profiles in Guide to the Secure Configuration of SUSE Linux Enterprise 12 🌸
Source data stream: ssg-sle12-ds.xml
okay bestie so the Guide to the Secure Configuration of SUSE Linux Enterprise 12 is split up into 'profiles' — literally just groupings of security settings that match up to a known policy. the ones you can pick from are:
💜 ANSSI-BP-028 (enhanced)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
🦋 ANSSI-BP-028 (high)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
✨ ANSSI-BP-028 (intermediary)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
🎀 ANSSI-BP-028 (minimal)
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
🔥 CIS SUSE Linux Enterprise 12 Benchmark for Level 2 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® SUSE Linux Enterprise 12 Benchmark™, v3.1.0, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 12 CIS Benchmarks™ content.
👑 CIS SUSE Linux Enterprise 12 Benchmark for Level 1 - Server
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® SUSE Linux Enterprise 12 Benchmark™, v3.1.0, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 12 CIS Benchmarks™ content.
🌈 CIS SUSE Linux Enterprise 12 Benchmark for Level 1 - Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® SUSE Linux Enterprise 12 Benchmark™, v3.1.0, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 12 CIS Benchmarks™ content.
⭐ CIS SUSE Linux Enterprise 12 Benchmark Level 2 - Workstation
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® SUSE Linux Enterprise 12 Benchmark™, v3.1.0, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 12 CIS Benchmarks™ content.
💳 PCI-DSS v4 Control Baseline for SUSE Linux enterprise 12
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss-4
Ensures PCI-DSS v4 security configuration settings are applied.
🧾 PCI-DSS v3.2.1 Control Baseline for SUSE Linux enterprise 12
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
🛡️ Standard System Security Profile for SUSE Linux Enterprise 12
- Profile ID:
xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a SUSE Linux Enterprise 12 system. Regardless of your system's workload all of these checks should pass.
🎯 DISA STIG for SUSE Linux Enterprise 12
- Profile ID:
xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for SUSE Linux Enterprise 12 V3R5.
🌸 Profiles in Guide to the Secure Configuration of SUSE Linux Enterprise 15 🌸
Source data stream: ssg-sle15-ds.xml
okay so bestie, the Guide to the Secure Configuration of SUSE Linux Enterprise 15 is split up into 'profiles' — which are literally just groupings of security settings that line up with a known policy. here's the whole lineup 💖
👑 ANSSI-BP-028 (enhanced) 👑
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
🔥 ANSSI-BP-028 (high) 🔥
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
✨ ANSSI-BP-028 (intermediary) ✨
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
🦋 ANSSI-BP-028 (minimal) 🦋
- Profile ID:
xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
Only the components strictly necessary to the service provided by the system should be installed. Those whose presence can not be justified should be disabled, removed or deleted. Performing a minimal install is a good starting point, but doesn't provide any assurance over any package installed later. Manual review is required to assess if the installed services are minimal.
💅 CIS SUSE Linux Enterprise 15 Benchmark for Level 2 - Server 💅
- Profile ID:
xccdf_org.ssgproject.content_profile_cis
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® SUSE Linux Enterprise 15 Benchmark™, v1.1.1, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 15 CIS Benchmarks™ content.
🌈 CIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Server 🌈
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_server_l1
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® SUSE Linux Enterprise 15 Benchmark™, v1.1.1, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 15 CIS Benchmarks™ content.
🎀 CIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Workstation 🎀
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l1
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® SUSE Linux Enterprise 15 Benchmark™, v1.1.1, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 15 CIS Benchmarks™ content.
🍓 CIS SUSE Linux Enterprise 15 Benchmark Level 2 - Workstation 🍓
- Profile ID:
xccdf_org.ssgproject.content_profile_cis_workstation_l2
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® SUSE Linux Enterprise 15 Benchmark™, v1.1.1, released 01-24-2022.
This profile includes Center for Internet Security® SUSE Linux Enterprise 15 CIS Benchmarks™ content.
🧚 General System Security Profile for SUSE Linux Enterprise (SLES) 15 🧚
- Profile ID:
xccdf_org.ssgproject.content_profile_general
This profile contains configuration checks that align to the General System Security Profile for SUSE Linux Enterprise (SLES) 15.
💜 Health Insurance Portability and Accountability Act (HIPAA) 💜
- Profile ID:
xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile contains configuration checks that align to the HIPPA Security Rule for SUSE Linux Enterprise 15 V1R3.
🔒 PCI-DSS v4 Control Baseline for SUSE Linux enterprise 15 🔒
- Profile ID:
xccdf_org.ssgproject.content_profile_pci-dss-4
Ensures PCI-DSS v4 security configuration settings are applied.
☁️ Public Cloud Hardening for SUSE Linux Enterprise 15 CHOST ☁️
- Profile ID:
xccdf_org.ssgproject.content_profile_pcs-hardening-chost
This profile contains configuration checks to be used to harden SUSE Linux Enterprise 15 CHOST for use with public cloud providers.
🌟 Hardening for Public Cloud Image of SUSE Linux Enterprise Server (SLES) for SAP Applications 15 🌟
- Profile ID:
xccdf_org.ssgproject.content_profile_pcs-hardening-sap
This profile contains configuration rules to be used to harden the images of SUSE Linux Enterprise Server (SLES) for SAP Applications 15 including all Service Packs, for Public Cloud providers, currently AWS, Microsoft Azure, and Google Cloud.
💖 Public Cloud Hardening for SUSE Linux Enterprise 15 💖
- Profile ID:
xccdf_org.ssgproject.content_profile_pcs-hardening
This profile contains configuration checks to be used to harden SUSE Linux Enterprise 15 for use with public cloud providers.
⭐ Standard System Security Profile for SUSE Linux Enterprise 15 ⭐
- Profile ID:
xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a SUSE Linux Enterprise 15 system based off of the SUSE Hardening Guide. Regardless of your system's workload all of these checks should pass.
🫶 DISA STIG for SUSE Linux Enterprise 15 🫶
- Profile ID:
xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for SUSE Linux Enterprise 15 V2R7.
✨ Profiles in Guide to the Secure Configuration of SUSE Linux Enterprise 16 ✨
Source data stream: ssg-sle16-ds.xml
The Guide to the Secure Configuration of SUSE Linux Enterprise 16 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. The profiles you can pick from are:
ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This profile is full of configs that align to ANSSI-BP-028 v2.0 at the enhanced hardening level. 💅
ANSSI is the French National Information Security Agency — it literally stands for Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems, no cap.
A copy of the ANSSI-BP-028 lives at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-
securite-relatives-a-un-systeme-gnulinux/And an English version of the ANSSI-BP-028 also lives at the ANSSI website:
https://messervices.cyber.gouv.fr/guides/en-
configuration-recommendations-gnulinux-systemANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This profile is full of configs that align to ANSSI-BP-028 v2.0 at the high hardening level. 🔥
ANSSI is the French National Information Security Agency — it literally stands for Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems, no cap.
A copy of the ANSSI-BP-028 lives at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-
securite-relatives-a-un-systeme-gnulinux/And an English version of the ANSSI-BP-028 also lives at the ANSSI website:
https://messervices.cyber.gouv.fr/guides/en-
configuration-recommendations-gnulinux-systemANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This profile is full of configs that align to ANSSI-BP-028 v2.0 at the intermediary hardening level. 🌸
ANSSI is the French National Information Security Agency — it literally stands for Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems, no cap.
A copy of the ANSSI-BP-028 lives at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-
securite-relatives-a-un-systeme-gnulinux/And an English version of the ANSSI-BP-028 also lives at the ANSSI website:
https://messervices.cyber.gouv.fr/guides/en-
configuration-recommendations-gnulinux-systemANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This profile is full of configs that align to ANSSI-BP-028 v2.0 at the minimal hardening level. 🍓
ANSSI is the French National Information Security Agency — it literally stands for Agence nationale de la sécurité des systèmes d'information. And ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems, no cap.
A copy of the ANSSI-BP-028 lives at the ANSSI website:
https://www.ssi.gouv.fr/administration/guide/recommandations-de-
securite-relatives-a-un-systeme-gnulinux/And an English version of the ANSSI-BP-028 also lives at the ANSSI website:
https://messervices.cyber.gouv.fr/guides/en-
configuration-recommendations-gnulinux-systemDRAFT General System Security Profile for SUSE Linux Enterprise (SLES) 16
Profile ID: xccdf_org.ssgproject.content_profile_base
This profile contains configuration checks that align to the General System Security Profile for SUSE Linux Enterprise (SLES) 16. ✨
Health Insurance Portability and Accountability Act (HIPAA)
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
The HIPAA Security Rule establishes U.S. national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. 🫶
This profile contains configuration checks that align to the HIPPA Security Rule for SUSE Linux Enterprise 16.
PCI-DSS v4.0.1 Control Baseline for SUSE Linux Enterprise 16
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss-4
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information. 💳
This profile ensures SUSE Linux Enterprise 16 is configured in alignment with PCI-DSS v4.0.1 requirements.
✨ Profiles in Guide to the Secure Configuration of SUSE Linux Enterprise Micro 5 ✨
Source data stream: ssg-slmicro5-ds.xml
The Guide to the Secure Configuration of SUSE Linux Enterprise Micro 5 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. The profiles you can pick from are:
General System Security Profile for SUSE Linux Enterprise Micro (SLEM) 5
Profile ID: xccdf_org.ssgproject.content_profile_general
This profile contains configuration checks that align to the General System Security Profile for SUSE Linux Enterprise Micro (SLEM) 5. 💖
Public Cloud Hardening for SUSE Linux Enterprise Micro (SLEM) 5
Profile ID: xccdf_org.ssgproject.content_profile_pcs-hardening
This profile contains configuration checks to be used to harden SUSE Linux Enterprise Micro (SLEM) 5 for use with public cloud providers. ☁️✨
DISA STIG for SUSE Linux Enterprise Micro (SLEM) 5
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for SUSE Linux Enterprise Micro (SLEM) 5 V1R4. 👑
✨ Profiles in Guide to the Secure Configuration of SUSE Linux Enterprise Micro 6 ✨
Source data stream: ssg-slmicro6-ds.xml
The Guide to the Secure Configuration of SUSE Linux Enterprise Micro 6 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. The profiles you can pick from are:
General profile for SUSE Linux Enterprise Micro (SLEM) 6
Profile ID: xccdf_org.ssgproject.content_profile_general
This profile contains configuration checks that align to the for SUSE Linux Enterprise Micro (SLEM) 6. 🦋
✨ Profiles in Guide to the Secure Configuration of TencentOS Server 4 ✨
Source data stream: ssg-tencentos4-ds.xml
The Guide to the Secure Configuration of TencentOS Server 4 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. The profiles you can pick from are:
Basic System Security Profile for TencentOS Server 4
Profile ID: xccdf_org.ssgproject.content_profile_basic
This profile contains rules to ensure basic security baseline of a TencentOS Server 4 system. Regardless of your system's workload all of these checks should pass. 💯
Standard System Security Profile for TencentOS Server 4
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of a TencentOS Server 4 system. 🌈
✨ Profiles in Guide to the Secure Configuration of Ubuntu 22.04 ✨
Source data stream: ssg-ubuntu2204-ds.xml
The Guide to the Secure Configuration of Ubuntu 22.04 is broken into 'profiles', aka groupings of security settings that correlate to a known policy. The profiles you can pick from are:
CIS Ubuntu Linux 22.04 LTS Benchmark for Level 1 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_level1_server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™, v2.0.0, released 2024-03-28. 📅
This profile includes Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™ content.
CIS Ubuntu Linux 22.04 LTS Benchmark for Level 1 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_level1_workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™, v2.0.0, released 2024-03-28. 📅
This profile includes Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™ content.
CIS Ubuntu Linux 22.04 LTS Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_level2_server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™, v2.0.0, released 2024-03-28. 📅
This profile includes Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™ content.
CIS Ubuntu Linux 22.04 LTS Benchmark for Level 2 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_level2_workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™, v2.0.0, released 2024-03-28. 📅
This profile includes Center for Internet Security® Ubuntu Linux 22.04 LTS Benchmark™ content.
Standard System Security Profile for Ubuntu 22.04
Profile ID: xccdf_org.ssgproject.content_profile_standard
This profile contains rules to ensure standard security baseline of an Ubuntu 22.04 system. Regardless of your system's workload all of these checks should pass. 🌟
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide (STIG) V2R7
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Canonical Ubuntu 22.04 LTS V2R7. 👑
Profiles in Guide to the Secure Configuration of Ubuntu 24.04
Source data stream: ssg-ubuntu2404-ds.xml
Okay so The Guide to the Secure Configuration of Ubuntu 24.04 is broken into 'profiles', which are basically groupings of security settings that correlate to a known policy. Here's the lineup of available profiles, bestie 💖
CIS Ubuntu Linux 24.04 LTS Benchmark for Level 1 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_level1_server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™, v1.0.0, released 2024-08-26. 🗓️
This profile includes Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™ content.
CIS Ubuntu Linux 24.04 LTS Benchmark for Level 1 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_level1_workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™, v1.0.0, released 2024-08-26. 💅
This profile includes Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™ content.
CIS Ubuntu Linux 24.04 LTS Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_level2_server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™, v1.0.0, released 2024-08-26. 🔥
This profile includes Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™ content.
CIS Ubuntu Linux 24.04 LTS Benchmark for Level 2 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_level2_workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™, v1.0.0, released 2024-08-26. ✨
This profile includes Center for Internet Security® Ubuntu Linux 24.04 LTS Benchmark™ content.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) V1R5
Profile ID: xccdf_org.ssgproject.content_profile_stig
This profile contains configuration checks that align to the DISA STIG for Canonical Ubuntu 24.04 LTS V1R5. 🫡
Profiles in Guide to the Secure Configuration of Ubuntu 26.04
Source data stream: ssg-ubuntu2604-ds.xml
The Guide to the Secure Configuration of Ubuntu 26.04 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
…and that's it, bestie 😭 that's literally where the list stops — no profiles listed after that, no cap. She said "available profiles are:" and then walked offstage. Iconic honestly.
✨ EXAMPLES ✨
Wanna scan your system with the OpenSCAP utility against the ospp profile? Say less. 👑
oscap xccdf eval --profile ospp --results-arf /tmp/`hostname`-ssg-results.xml --report /tmp/`hostname`-ssg-results.html /usr/share/xml/scap/ssg/content/ssg-{product}-xccdf.xmlMore deets live on these websites, go look:
- https://www.github.com/ComplianceAsCode/content — the project's Github page.
- https://complianceascode.readthedocs.io — the project's ReadTheDocs page.
- https://app.gitter.im/#/room/#Compliance-As-Code-The_content:gitter.im — the project's Gitter IM space.
📁 FILES 📁
/usr/share/xml/scap/ssg/content— houses SCAP content utilizing the following naming conventions:- SCAP Source data streams:
ssg-{product}-ds.xml
- SCAP Source data streams:
/usr/share/scap-security-guide/ansible/— contains Ansible Playbooks for SSG profiles./usr/share/scap-security-guide/kickstart/— contains example kickstarts that install systems hardened against a particular profile./usr/share/scap-security-guide/tailoring/— contains tailoring files that enable rules that are not covered by third-party SCAP content and disables rules that are covered by the content shipped inscap-security-guide.
👀 SEE ALSO 👀
💌 AUTHOR 💌
Please direct all questions to the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
And that's a wrap on the whole entire page, bestie!! 🎀 This one's version 1, dated 26 Jan 2013, and it's the scap-security-guide(8) manual page — go forth and harden everything, you absolute legend. 💖✨
📦 where this page comes from
- fedora 43: scap-security-guide 0.1.82-1.fc43 · BSD-3-Clause
- fedora 44: scap-security-guide 0.1.82-1.fc44 · BSD-3-Clause
- ubuntu stonking: ssg-base 0.1.82-1 · BSD-3-Clause
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms