General Cyber Exchange Announcements
Supplemental Automation Content has been updated for July 2020
This content leverages Configuration Management tools to enforce STIG requirements. These tools allow for customization and use a STIG-centric approach.
The Supplemental Automation Content can be found on the Cyber Exchange website on the Supplemental Automation Content tab located at:
https://cyber.mil/stigs/supplemental-automation-content/
For users who do not have a CAC that has DoD Certificates, the Supplemental Automation Content is also available from:
https://public.cyber.mil/stigs/supplemental-automation-content/
McAfee Home Use Solutions
McAfee has announced a “Work from Home (WFH)” program that provides free access to their Total Protection solution for 60-days. Under McAfee WFH, anyone can download their premier anti-virus and secure virtual private networking solutions to better protect their systems in response to the heightened mission need to support telework requirements. Click here to learn more about McAfee’s corporate Work from Home program.
The DoD Home Use program provides an annual subscription to McAfee’s Internet Security product for approved DoD employees via this website: https://www.disa.mil/Cybersecurity/Network-Defense/Antivirus/Home-Use.
SRGs/STIGs Announcements
SCC Survey 2024
The SCAP Compliance Checker (SCC) development team is requesting your feedback as part of their annual customer satisfaction survey. The survey has been redesigned from previous years, and it’s now shorter and easier to complete, with more focus on what end users need going forward. This is your chance to help influence SCC requirements for FY25.
The survey is currently open and results will be analyzed at the end of April 2024. The SCC team requests your feedback be completed by April 15.
https://usnavy.gov1.qualtrics.com/jfe/form/SV_4ZpXv8JkUlDs4lw
DISA releases the Google Android 14 BYOAD Security Technical Implementation Guide
The Defense Information Systems Agency recently approved the Google Android 14 BYOAD Security Technical Implementation Guide (STIG), which is effective immediately upon release.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases the Samsung Android 14 BYOAD Security Technical Implementation Guide
The Defense Information Systems Agency recently approved the Samsung Android 14 BYOAD Security Technical Implementation Guide (STIG), which is effective immediately upon release.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases RHEL 9 STIG with Ansible
The Defense Information Systems Agency recently released the RHEL 9 Security Technical Implementation Guide (STIG) with Ansible. This content is published as a resource to assist in the application of security guidance to systems.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the file from the DOD Cyber Exchange website at https://cyber.mil/stigs/supplemental-automation-content/. The file is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/supplemental-automation-content/.
Users who are unable to find and download the content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases RHEL 9 STIG with Chef
The Defense Information Systems Agency recently released the RHEL 9 Security Technical Implementation Guide (STIG) with Chef. This content is published as a resource to assist in the application of security guidance to systems.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the file from the DOD Cyber Exchange website at https://cyber.mil/stigs/supplemental-automation-content/. The file is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/supplemental-automation-content/.
Users who are unable to find and download the content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases the Red Hat Enterprise Linux (RHEL) 9 Security Technical Implementation Guide benchmark
The Defense Information Systems Agency recently approved the automated benchmark for the Red Hat Enterprise Linux (RHEL) 9 Security Technical Implementation Guide (STIG), which is effective immediately upon release.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the benchmark from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The benchmark is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the benchmark or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases the Apple iOS/iPadOS 17 BYOAD Security Technical Implementation Guide
The Defense Information Systems Agency recently approved the Apple iOS/iPadOS 17 BYOAD Security Technical Implementation Guide (STIG), which is effective immediately upon release.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases the IBM zSecure Suite Security Technical Implementation Guide
The Defense Information Systems Agency recently approved the IBM zSecure Suite Security Technical Implementation Guide (STIG), which is effective immediately upon release.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases out-of-cycle F5 BIG-IP STIG update
The Defense Information Systems Agency has released an out-of-cycle update for the F5 BIG-IP Security Technical Implementation Guide (STIG), which becomes effective immediately upon release.
Customers who possess a Common Access Card (CAC) that has valid Department of Defense (DOD) certificates can obtain the files from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The files are also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the files can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases updates to the SRG/STIG Library Compilations.
These updates include the latest quarterly SRG/STIG update and newly released SRGs and STIGs published since the last quarterly update.
Customers can obtain the compilation from the DoD Cyber Exchange website at https://public.cyber.mil/stigs/compilations/.
Users who are unable to find and download the SRG/STIG compilation can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
DISA releases the Microsoft Windows Server DNS Security Technical Implementation Guide
The Defense Information Systems Agency recently approved the Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide (STIG), which is effective immediately upon release.
Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.
Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.
GPO Update
Group Policy Objects (GPOs) have been updated for January 2024. See the Change Log document included in the zip file for additional information.
DISA risk management executive posted the GPOs for use by system administrators to ease the burden in securing systems within their environment.
The GPOs can be found on Cyber Exchange website on the Group Policy Objects tab located at https://cyber.mil/stigs/gpo/. For users who do not have a CAC that has DoD certificates, the GPO is also available from https://public.cyber.mil/stigs/gpo/.
List of GPOs currently in the package:
Office Products
Access 2013
Access 2016
Excel 2013
Excel 2016
InfoPath 2013
Lync 2013
Office 2019-M365 Apps
Office System 2013
Office System 2016
OneDrive for Business 2016
OneNote 2013
OneNote 2016
Outlook 2013
Outlook 2016
PowerPoint 2013
PowerPoint 2016
Project 2013
Project 2016
Publisher 2013
Publisher 2016
SharePoint Designer 2013
Skype for Business 2016
Visio 2013
Visio 2016
Word 2013
Word 2016
Browsers
Edge
Google Chrome
Internet Explorer 11
Mozilla Firefox
Antivirus
Windows Defender AV
Adobe Acrobat
Adobe Acrobat Pro DC Continuous
Adobe Acrobat Reader DC Continuous
Operating Systems
Windows 10
Windows 11
Windows Firewall
Windows 2012 R2 DC
Windows 2012 R2 MS
Windows Server 2016 (MS and DC)
Windows Server 2019 (MS and DC)
Windows Server 2022
PKI/PKE Announcements
New WCF CAs released
The WCF PKI has recently deployed updated WCF Signing CAs 1-10. These new certificates are now available in the WCF PKI PKCS#7 Certificate Bundle v5.15.
Updated version of InstallRoot
This release includes bug fixes and updates to InstallRoot embedded TAMP messages.
New DoD PKI CAs Released
The latest DoD PKI CA Certificates Bundle (PKCS#7) v5.12 has been updated to include DoD ID/Email CAs 70-73 and DoD SW CAs 74-77. These new CAs should begin production issuance in the second half of 2023.