RGS MCM STIG Compliance Checklist

17 items · Security · Hard difficulty · 4 hours

Implement and verify RGS MCM STIG controls across multi-cluster environments.

• Download the RGS MCM STIG (Ver 2, Rel 2)

  Obtain the latest STIG from DISA Cyber Exchange or public.cyber.mil.

• Review the STIG scope, summary, and applicability

  Identify controls that apply to your RGS MCM deployment and out-of-scope items.

• Inventory managed Kubernetes clusters and components

  List clusters, OS, hypervisor, container runtime, and CNI plugins.

• Verify vendor-specific Kubernetes STIGs or SRGs are applied

  Follow vendor STIGs or the generic SRG when vendor guidance is unavailable.

• Harden underlying environment components

  Ensure host OS, container runtime, and network plugins meet their STIGs/SRGs.

• Harden host operating systems (OS)

  Apply OS STIGs, disable unused services, enforce baseline configurations.

• Harden container runtime (e.g., Docker, containerd)

  Restrict privileges, apply runtime SRG guidance, and isolate runtimes.

• Harden CNI and network plugins (e.g., Calico, Flannel)

  Secure plugin configs and implement network policies where supported.

• Implement global RBAC in RGS MCM

  Configure multi-cluster roles to enforce least privilege across clusters.

• Configure multi-cluster access controls and limit admin privileges

  Remove wide default permissions and assign scoped administrative roles.

• Enforce secure default configurations for RGS MCM

  Disable unused features and apply secure templates and policies.

• Validate and implement network policies and cluster segmentation

  Ensure pod-to-pod and cross-cluster traffic restrictions are enforced.

• Enable and configure audit logging for RGS MCM and clusters

  Centralize audit logs, enforce retention, and secure log storage.

• Integrate vulnerability scanning for container images and clusters

  Scan images and nodes regularly and remediate critical findings.

• Apply timely updates and patches to RGS MCM, Kubernetes, and dependencies

  Test patches in staging and follow change control before production rollouts.

• Document security configurations, deviations, and approved exceptions

  Record rationale, evidence, and authorization for audit purposes.

• Subscribe to DISA Cyber Exchange and monitor STIG updates

  Track change history and pull updated STIGs or resources when released.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.