General Cyber Exchange Announcements

Supplemental Automation Content has been updated for July 2020

This content leverages Configuration Management tools to enforce STIG requirements. These tools allow for customization and use a STIG-centric approach.

The Supplemental Automation Content can be found on the Cyber Exchange website on the Supplemental Automation Content tab located at:
https://cyber.mil/stigs/supplemental-automation-content/

For users who do not have a CAC that has DoD Certificates, the Supplemental Automation Content is also available from:
https://public.cyber.mil/stigs/supplemental-automation-content/

McAfee Home Use Solutions

McAfee has announced a “Work from Home (WFH)” program that provides free access to their Total Protection solution for 60-days. Under McAfee WFH, anyone can download their premier anti-virus and secure virtual private networking solutions to better protect their systems in response to the heightened mission need to support telework requirements. Click here to learn more about McAfee’s corporate Work from Home program.

The DoD Home Use program provides an annual subscription to McAfee’s Internet Security product for approved DoD employees via this website: https://www.disa.mil/Cybersecurity/Network-Defense/Antivirus/Home-Use.

SRGs/STIGs Announcements

DISA releases RHEL 8 STIG with Chef

The Defense Information Systems Agency recently released the Red Hat Enterprise Linux (RHEL) Security Technical Implementation Guide (STIG) with Chef. This content is published as a resource to assist in the application of security guidance to systems.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the file from the DOD Cyber Exchange website at https://cyber.mil/stigs/supplemental-automation-content/. The file is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/supplemental-automation-content/.

Users who are unable to find and download the content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

DISA releases the SPEC Innovations Innoslate 4.x Security Technical Implementation Guide

The Defense Information Systems Agency recently approved the SPEC Innovations Innoslate 4.x Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update - DISA releases the Microsoft Windows Server 2022 Security Technical Implementation Guide

The Defense Information Systems Agency recently approved the Microsoft Windows Server 2022 Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

Request for comments - DISA releases draft Windows 11 STIG SCAP benchmark for review

The Defense Information Systems Agency recently released the draft Windows 11 Security Technical Implementation Guide (STIG) Security Content Automation Protocol (SCAP) benchmark for review.

Customers who possess a Common Access Card that has valid Department of Defense certificates can submit comments and/or recommended changes to the draft benchmark by 07 October 2022 on the comment matrix spreadsheet, which is located with the benchmark at https://cyber.mil/stigs/downloads. The draft benchmark and comment matrix are also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.

Please email comments to disa.stig_spt@mail.mil and include the title and version of the benchmark in the subject line. Users who are unable to find and download these files or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil.

DISA releases STIG Viewer 2.17 and User Guide

The Defense Information Systems Agency recently approved the Security Technical Implementation Guide (STIG) Viewer 2.17 and the STIG Viewer User Guide.

Customers who possess a Common Access Card (CAC) that has valid Department of Defense certificates can obtain the files from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The files are also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update-DISA releases Oracle Linux 8 STIG with Ansible

The Defense Information Systems Agency recently released the Oracle Linux 8 Security Technical Implementation Guide (STIG) with Ansible. This content is published as a resource to assist in the application of security guidance to systems.

Customers who possess a Common Access Card (CAC) that has valid Department of Defense (DOD) certificates can obtain the file from the DOD Cyber Exchange website at https://cyber.mil/stigs/supplemental-automation-content/. The file is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/supplemental-automation-content/.

Users who are unable to find and download the content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update: DISA releases the Tanium 7.x Security Technical Implementation Guide

The Defense Information Systems Agency recently approved the Tanium 7.x Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads/.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update: DISA releases the Juniper EX Series Switches Security Technical Implementation Guide

The Defense Information Systems Agency recently approved the Juniper EX Series Switches Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads/.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update: DISA releases the MariaDB Enterprise 10.x Security Technical Implementation Guide

The Defense Information Systems Agency recently approved the MariaDB Enterprise 10.x Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads/.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update: DISA releases the Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide

The Defense Information Systems Agency recently approved the Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card that has valid Department of Defense certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads/.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

STIG Update-DISA releases the AvePoint DocAve 6 Security Technical Implementation Guide

The Defense Information Systems Agency recently released the AvePoint DocAve 6 Security Technical Implementation Guide (STIG), which is effective immediately upon release.

Customers who possess a Common Access Card (CAC) that has valid Department of Defense (DOD) certificates can obtain the STIG from the DOD Cyber Exchange website at https://cyber.mil/stigs/downloads/. The STIG is also available on the Cyber Exchange public site at https://public.cyber.mil/stigs/downloads/.

Users who are unable to find and download the guide or other content can report their issue to the Cyber Exchange web team at dod.cyberexchange@mail.mil. Individuals who have further questions related to STIG content should email the DISA STIG customer support desk at disa.stig_spt@mail.mil.

GPO Update

Group Policy Objects (GPOs) have been updated for July 2022. See the Change Log document included in the zip file for additional information.

DISA risk management executive posted the GPOs for use by system administrators to ease the burden in securing systems within their environment.

The GPOs can be found on Cyber Exchange website on the Group Policy Objects tab located at https://cyber.mil/stigs/gpo/. For users who do not have a CAC that has DoD certificates, the GPO is also available from https://public.cyber.mil/stigs/gpo/.

List of GPOs currently in the package:

Office Products

Access 2013

Access 2016

Excel 2013

Excel 2016

InfoPath 2013

Lync 2013

Office 365 ProPlus

Office System 2013

Office System 2016

OneDrive for Business 2016

OneNote 2013

OneNote 2016

Outlook 2013

Outlook 2016

PowerPoint 2013

PowerPoint 2016

Project 2013

Project 2016

Publisher 2013

Publisher 2016

SharePoint 2010

SharePoint Designer 2013

Skype for Business 2016

Visio 2013

Visio 2016

Word 2013

Word 2016

Browsers

Edge

Google Chrome

Internet Explorer 11

Antivirus

Windows Defender AV

Adobe Acrobat

Adobe Acrobat Pro DC Continuous

Adobe Acrobat Reader DC Continuous

Operating Systems

Windows 10

Windows Firewall

Windows 2012 R2 DC

Windows 2012 R2 MS

Windows Server 2016 (MS and DC)

Windows Server 2019 (MS and DC)

PKI/PKE Announcements

New WCF CAs released - Certificate Bundle v5.13

The WCF PKI has recently deployed updated WCF Signing CAs 1-10. These new certificates are now available in the WCF PKI PKCS#7 Certificate Bundle v5.13.