How Unified Automation is Transforming STIG Compliance

By now, most in the DoD and other sensitive agencies know how critical automation is to the STIG compliance process. But does it matter what kind of cybersecurity automation tools you use and in what combination?

A recent FedInsider webinar, Talking Tech: Simplifying STIG Compliance with Unified Automation, addressed the topic of STIG automation to a packed “room” of over 200 live viewers. The panel consisted of Dr. Kurt Jarvis of the Air Force Sustainment Center, Sean Perryman from the Naval Information Warfare Center Atlantic, and Brian Hajost, Founder of SteelCloud. All three are experts in STIG implementation. John Breeden from FedInsider served as host and moderator.

To watch this webinar on-demand, click here!

Reviewing the basics of STIG compliance 

Security Technical Implementation Guides (STIGs) are made up of thousands of configuration standards that provide a roadmap for securing operating systems, software, databases, and hardware. Developed by the Defense Information Systems Agency (DISA), STIGs align agencies with NIST SP 800-53 and the Risk Management Framework (RMF) from the National Institute of Standards and Technology, turning off unnecessary services, enforcing encryption, and modifying default settings that could create vulnerabilities.

STIGs have a long-proven history of effectiveness and are mandated within the DoD, while other Departments, contractors and independent organizations voluntarily leverage them because of their strengths or to align with 800-53 and RMF. STIGs are updated every three months as new vulnerabilities and technologies emerge. The more sophisticated hackers get, the more STIGs matter in the process of securing sensitive information.

“Compliance doesn’t have to be chaos. If you treat it like a quality process, it becomes manageable.”—Brian Hajost 

While highly beneficial, STIGs can be a pain in the app

STIGs sound simple enough on paper, but all the panelists noted that STIG implementation is rife with challenges:

• STIGs break things: STIGs often “break” applications that are not specifically designed for hardened environments. A commercial application that is secure enough for the corner bookstore is not secure enough for the DoD. STIGs bridge that gap by turning off vulnerable parts of the applications.
• STIGs create complex conflicts: Because you have to turn off parts of applications, STIGs create conflicts between user needs/functionality and compliance requirements.
• The volume is overwhelming: With thousands of STIG settings that are updated quarterly, the volume of work is too great to be handled manually by your existing teams. This is compounded by an extreme shortage of qualified experts in the marketplace.
• Lack of Consistency. Without a centralized process, different teams may implement and monitor STIGs differently, leaving vulnerabilities in their wake.
• Fragmented Compliance. In manual and partially automated environments, there is often a disconnect between policy development and policy implementation, leading to incompliant implementation and significant rework.
• Inconsistent Tools. Engineers, IA personnel and auditors may all use different tools, leading to inconsistent and conflicting results.

This is why automation is necessary. And more than just automation, but consistent automation across your enterprise.

“If someone two cubes away already wrote a STIG, and you don’t know it—that’s a problem,” observes Sean Perryman.

Unified automation can solve many STIG challenges

Automation, when used correctly and consistently, delivers superior results compared to manual implementations that often contain errors, take too long to do thoroughly, and provide inconsistent results. The panel agreed that unified automation—a single solution that scans, remediates, reports and monitors—is the best solution to use throughout the enterprise.

A unified solution, like SteelCloud’s patented ConfigOS, not only delivers the rapid ATOs needed to keep critical operations up to date (reducing the time to operationalize new tech from months to weeks), but it also eliminates the false negatives, policy mismatches and rework that often result from using disparate tools. Unified automation also allows engineers to shift left—embed compliance early and continually throughout technology lifecycles. Tools like ConfigOS help automate up to 90% of the STIG process, while supporting compliance, aligning with RMF requirements and facilitating successful audits like JCIP and CORA.

Best practices to consider when automating STIG compliance

Dr. Kurt Jarvis points out that, “Everybody starts with ‘I have a very small enclave with a small number of endpoints. Let’s do it manually.’ They can start that way, but it is just not scalable.” With the increasing complexity of attacks, automation is becoming the only way most agencies can remain STIG compliant and work with efficiency. Here are the best practices the experts recommend:

• Rethink your mindset: Stop scanning for problems. Instead start from secure-by-default builds by shifting left and introducing compliance during development, not after deployment. “The traditional model is scan and fix,” says Hajost. “The better model is fix, then confirm.”
• Break down silos: Sharing knowledge and applying a single, unified solution for use by implementers, auditors and IA teams reduces time, effort, duplicate effort and rework. Use automation not just for scale, but forclarity and synchronization across roles.
• Empower engineers: Give engineers the tools and opportunity to master their jobs and innovate unique solutions.
• Supplement with AI: AI and LLMs can help with unstructured controls and documentation analysis.
• Implement continuous monitoring and compliance: A unified solution can help you stay compliant between audits with real-time validation and updates. Continuous compliance eliminates secure configuration drift and keeps you compliance-ready.

“We’re not just trying to make compliance easier—we’re trying to make it invisible.”—Brian Hajost

Unified automation delivers unprecedented results

STIG compliance is complex, but it’s non-optional. With continual updates, it’s also an ongoing effort that is never complete. With unified automation, agencies can achieve faster approvals, greater accuracy, and significant labor savings—while positioning themselves for long-term cyber resilience.

SteelCloud has been the premier unified automation solution for the DoD for over a decade. ConfigOS has been consistently proven to reduce effort by 90%, creating a 23:1 ratio of labor savings for some clients. Across the board, ATOs are achieved in weeks, rather than months, especially critical when getting technology to the front lines. And in one Navy program, using ConfigOS reduced quarterly update time from 250 manhours to minutes. These types of gains free engineers to focus on innovation rather than repetitive compliance tasks.

If you want more detail about STIGs and the concepts outlined here, be sure to listen to the whole webinar, which includes more detailed examples of use cases and the challenges of manual implementations. Then set aside two hours of your day for a demo of SteelCloud’s automation solution, ConfigOS. Discover the solution that makes compliance invisible!