CIQ partner

Rocky Linux hardening: STIG, CIS and FIPS built in

Hardening a server by hand against DISA STIG or CIS means hundreds of rules and weeks of testing. RLC Pro Hardened arrives with that work done, plus protections a standard Rocky does not have, such as kernel runtime monitoring. We deploy it, close the gaps and stay with you through the audit.

Talk to a Linux engineerMessage us on WhatsApp

Based on Rocky Linux 9, with everything in RLC Pro: LTS releases, FIPS 140-3 and support.

Rocky Linux hardening without going rule by rule

Community Rocky Linux ships the basics: SELinux on and the usual packages. DISA STIG or CIS ask for far more: passwords, SSH, permissions, logging and crypto set rule by rule, and kept that way after every update.

RLC Pro Hardened starts from there. The most exposed components come hardened by CIQ and the compliance profiles are applied with its playbooks, so your first scan is already mostly green.

What RLC Pro Hardened includes
Hardened packagesglibc, OpenSSH and the kernel, built by CIQ with a smaller attack surface.
LKRGWatches kernel integrity at runtime and stops privilege escalations and rootkits.
Memoryhardened_malloc blocks overflows and use-after-free bugs in root processes.
ProfilesDISA STIG, CIS Level 2 and NIST 800-171 in OpenSCAP, with playbooks to apply them.
FIPS 140-3NIST-validated cryptographic modules; FIPS mode on in the STIG images.
FoundationAll of RLC Pro: LTS releases, CIQ patches and support. SELinux enforcing.

How many rules it passes once the profiles are applied

It does not reach 100% because some rules are left out on purpose: the ones that would lock you out or clash with the environment. We review those one by one and justify each exception.

A physical server with the partitioning STIG asks for goes further than a cloud VM.

RLC Pro Hardened 9*% of rules
  1. DISA STIGServer with full partitioning
    96
  2. DISA STIGCloud virtual machine
    90–93
  3. CIS Level 2Server with full partitioning
    98–99
  4. CIS Level 2Cloud virtual machine
    94–98
* CIQ data, measured with OpenSCAP and GOSS after applying its playbooks.

Is Hardened what you need?

RLC Pro Hardened

If you are assessed against DISA STIG, CIS or NIST 800-171 (CMMC), or work in defence, government, finance or healthcare and want to start from a hardened system.

RLC Pro

If what you need is LTS releases, FIPS and support, without a specific compliance profile. More on RLC Pro.

Hardening Rocky yourself

Possible with OpenSCAP and the community security guide, but keeping it compliant after every update is on you.

AIX and IBM i

If your servers are IBM Power with AIX or IBM i, the equivalent is PowerSC.

Still on CentOS 7? Start there: CentOS 7 extended support. All editions on Rocky Linux support.

What we bring

CIQ prepares the image; making it work with your applications and getting it through the audit is on us.

  1. Before

    Which framework applies

    STIG, CIS, NIST 800-171, Cyber Essentials or NIS2: we pick the profile and list the gaps.

  2. Pilot

    Your applications, with the profile applied

    We test the profile with what runs on your servers and fix whatever breaks.

  3. Rollout

    The same on every server

    With CIQ's playbooks and Ansible, in your data centre or in the cloud.

  4. Audit

    Report and exceptions

    OpenSCAP scans, justified exceptions and the paperwork your assessor asks for.

  5. Day to day

    Support in English, Spanish or French

    24/7 or 8×5, with every update checked against the profile so you keep what you gained.

Frequently asked questions

What is RLC Pro Hardened?

It is RLC Pro, CIQ's Rocky Linux with LTS, FIPS and support, with the hardening already done: hardened glibc, OpenSSH and kernel, kernel runtime protection (LKRG), a hardened memory allocator, SELinux enforcing and OpenSCAP profiles for DISA STIG, CIS Level 2 and NIST 800-171.

Is it 100% DISA STIG compliant out of the box?

No. The baseline is hardened and, with CIQ's playbooks, a server with full partitioning passes over 96% of the STIG rules and over 98% of the CIS rules. The rest are rules disabled on purpose so you do not lock yourself out; we go through them with you and document every exception for the assessor.

What is LKRG?

Linux Kernel Runtime Guard: a module that checks the integrity of the kernel while the system runs and stops privilege escalation attempts and rootkits. In Hardened it comes installed and enabled.

Does it help with CMMC or Cyber Essentials?

Yes, on the technical side. For CMMC, the NIST 800-171 (CUI) profile is the one that applies. For Cyber Essentials, the hardened baseline covers secure configuration out of the box. The policies and evidence are still yours to produce, and we help with that.

Which versions are available?

RLC Pro Hardened is based on Rocky Linux 9 and follows its minor releases (9.7 is the latest). OpenSCAP profiles for version 10 are not published yet.

Does it include FIPS 140-3?

Yes. It inherits RLC Pro's cryptographic modules, with NIST FIPS 140-3 validation, and the STIG and NIST 800-171 images boot in FIPS mode.

Tell us what you are audited against

With the framework (STIG, CIS, CMMC, Cyber Essentials…) and your list of servers, we will tell you which profile to apply and what would be left to close.

Talk to a Linux engineerMessage us on WhatsApp