Red Hat Enterprise Linux 10 STIG automation now matches DISA STIG V1R2

For the U.S. Department of Defense (DoD) and its contractors, security has to hold up against a published baseline—not a general claim that systems are “secure.” The Defense Information Systems Agency (DISA) defines that baseline in Security Technical Implementation Guides (STIGs), and STIG compliance is required for information systems that connect to DoD networks.

In March 2026, the Defense Information Systems Agency (DISA) published a Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux (RHEL) 10. The scap-security-guide version 0.1.82 STIG profile is now available,  automating scanning and remediating RHEL 10 against DISA’s official STIG V1R2, bringing RHEL 10 to full STIG maturity. 

With the release of this compliance automation profile, organizations can benefit from:

• Repeatable assessment & remediation using OpenSCAP (oscap), Red Hat Satellite, and Red Hat Lightspeed (formerly Red Hat Insights) and apply rules with the official RHEL 10 STIG Ansible galaxy role.
• Harden at install or image-build time with Kickstart, RHEL image builder, and RHEL image mode, so STIG alignment is not a manual cleanup step.

• Accelerated Authority to Operate (ATO) pathways by simplifying compliance reporting and strengthening your documentation framework on the path toward an ATO. 

  *Note: While the updated profile automates the technical configuration requirements of the STIG, system administrators and security officers must still review findings within the context of their specific operational environment to achieve full compliance certification.

Get started

For comprehensive configuration steps, implementation guides, and FIPS mode requirements, visit the official Red Hat DISA STIG compliance page. 

Use scap-security-guide version 0.1.82 and select the RHEL 10 STIG profile (stig or stig_gui) in Red Hat Lightspeed (formerly Insights), Red Hat Satellite, or via the oscapcommand line interface to evaluate and remediate your systems against DISA STIG v1r2.

To review the underlying official baseline documents, access the official DISA benchmark directly at the DoD Cyber Exchange.