DISA STIG implementation timeline

[bsecker]

Hi, I see that DISA have released their STIG guidance for RKE2. What is the timeline for implementing STIG as an RKE2 security profile?

Cheers

[brandond]

I don't believe that's been requested or prioritized through our product manager. At this point we are only targeting CIS.

[Martin-Weiss]

I tried to look in the published document and could not find anything that needs to be implemented on the RKE2 side of things. I just understand that the STIG guidance requires the CIS profile to be used on the RKE2 side of things.. but maybe I did not understand the text properly or did not look into the correct document? Did you find some details that are missing in RKE2?

[clemenko]

The CIS profile is a control within the STIG is required. There are a few more settings that are required. Here is an unofficial doc on the settings : https://github.com/clemenko/rke2/blob/master/RKE2_STIG.md