DISA STIGs

DISA Security Technical Implementation Guides (STIGs) are configuration standards published by the Defense Information Systems Agency (DISA) that define mandatory hardening requirements for systems used by the Department of Defense. STIGs cover hundreds of operating systems, network devices, applications, and services.

For CMMC purposes, STIGs are one of the two most common references for system hardening (alongside CIS Benchmarks). STIGs are stricter and more DoD-specific than CIS Benchmarks; they include detailed compliance checks that can be automated using tools like SCAP Compliance Checker.