Puppet Community

CIS_Red_Hat_Enterprise_Linux_9_Benchmark_v2.0.0.pdf

That's not the STIG benchmark, unfortunately

True, this is their standard CIS Benchmark.  Thing is, look at the controls. With a few exceptions, CIS's flagship benchmark does a rather good job of fulfilling the STIG.  The two examples that yiou need to self remediate escape me at the moment.

Yeah, we have support for CIS RHEL 9 already, but STIG is different. The biggest difference for SCE comes in terms of how you configure it, because with STIG you configure the controls using VulnID, not CIS control name / number

there's also the different MAC levels, as well as the confidentiality levels, that form the initial baselines with the STIG that have no CIS counterparts

fundamentally, they aren't that different, but the details make it such that we can't support using the standard CIS benchmark for DISA STIG

Hmph.  You'd think we'd have as tight a security as that.