Axonius Ax-OS STIG Compliance Checklist

20 items · Security · Hard difficulty · 1 week

Quick, actionable steps to get Ax-OS STIG-compliant.

• Download the official Ax-OS STIG document

  Get the latest from DISA or public.cyber.mil (search Ax-OS STIG).

• Inventory all Ax-OS instances and record versions

  Capture hostnames, versions, CPEs, and environment (prod/stage).

• Review related OS and component STIGs

  Identify applicable OS, database, and network STIGs to apply alongside Ax-OS guidance.

• Patch Ax-OS to the latest vendor-supported release

  Follow vendor instructions; prefer tested vendor patches addressing CVEs.

• Test patches in a staging environment

  Validate functionality and rollback procedures before production updates.

• Backup Ax-OS configuration and data before changes

  Store backups in a secure, access-controlled location.

• Enforce strong authentication (MFA/CAC)

  Integrate CAC or multi-factor authentication per DoD requirements.

• Configure role-based access control and least privilege

  Map roles, limit admin privileges, and remove default or shared accounts.

• Disable unused services and unnecessary features

  Turn off plugins, agents, or modules not required for operation.

• Harden network access and management interfaces

  Restrict management access and require secure transport for admin traffic.

• Restrict management ports to authorized admin networks

  Apply firewall rules or ACLs limiting access by CIDR.

• Enable TLS with valid certificates for all management endpoints

  Use signed certs and disable weak ciphers; no self-signed in prod.

• Enable and centralize logging to a SIEM

  Forward logs in real time to a monitored SIEM for analysis.

• Configure log forwarding and verify delivery

  Test log forwarding and alerting from Ax-OS to your SIEM.

• Verify log retention, rotation, and secure storage

  Ensure retention meets DoDI 8500.01 and audit requirements.

• Configure audit settings per the STIG and retain audit records

  Enable required audit events, protect logs, and document retention policy.

• Run vulnerability scans and remediate findings

  Schedule regular scans and track remediation to closure.

• Document configuration changes and approvals

  Keep change records, baselines, and authorization evidence in a secure repo.

• Schedule periodic STIG compliance reviews and updates

  Plan quarterly or change-driven reviews to maintain compliance.

• Submit comments or change requests to DISA if needed

  Email proposals to the official DISA STIG contact address.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.