Reference view

STIG to CIS Crosswalk

A crosswalk relates STIG rules and CIS recommendations through the NIST 800-53 controls they share.

Every classification on this page is computed from NIST 800-53 control sets. Explanatory prose never decides a match.

How to read this

Each STIG rule and each CIS recommendation is reduced to a set of base NIST 800-53 controls. The two sets are then compared. The comparison, not an opinion, produces one of four results.

Exactexact: Both sides anchor to the identical set of 800-53 controls. Nothing on one side that is not on the other.
Partialpartial: The control sets overlap but are not identical. At least one shared control, plus controls unique to one side.
Nonenone: Both sides are anchored to 800-53, and they share no control. This is a real, meaningful result, not an error and not missing data.
Unmappableunmappable: One or both sides have no 800-53 anchor, so nothing can be said about the relationship. Unmappable is NOT "no relationship" and it is NOT a failure. It means the pivot is absent, so the comparison cannot be made at all.

Read this twice: unmappable is a statement about the pivot, not about the rules. It says the 800-53 anchor is missing on at least one side, so no relationship can be asserted or denied. It is not a failure of the tool, and it is not evidence that the two items are unrelated.

Determinism rule: classification is computed from control sets only. Any explanatory prose added later may describe why two items look related, but it must never alter, override, or suggest a classification.

Pair classification totals

6 STIG rules x 8 CIS recommendations = 48 computed pairs. Select a total to filter the list.

Crosswalk pairs

Showing 48 of 48 pairs.

Sort

STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
5.2.10Level 1
Ensure sudo authentication is required for privilege escalation
Partial
AC-6
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
1.1.2.5.1Level 2
Ensure separate partition exists for /var/log
None
no shared control
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
1.2.16Level 1
Ensure system-wide crypto policy is not set to legacy
None
no shared control
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
1.2.5Level 1
Ensure repository GPG keys are configured and verified
None
no shared control
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
2.2.1Level 1
Ensure unnecessary server services are not installed
None
no shared control
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
3.5.1.1Level 1
Ensure a host-based firewall is installed and enabled
None
no shared control
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
5.4.1.6Level 1
Ensure inactive password lock is configured
None
no shared control
STIG
V-DEMO-0001CAT I
RHEL 9 must disable direct root login via SSH.
CIS
6.2.1.1Level 2
Ensure auditd service is enabled and active
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
1.1.2.5.1Level 2
Ensure separate partition exists for /var/log
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
1.2.16Level 1
Ensure system-wide crypto policy is not set to legacy
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
1.2.5Level 1
Ensure repository GPG keys are configured and verified
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
2.2.1Level 1
Ensure unnecessary server services are not installed
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
3.5.1.1Level 1
Ensure a host-based firewall is installed and enabled
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
5.2.10Level 1
Ensure sudo authentication is required for privilege escalation
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
5.4.1.6Level 1
Ensure inactive password lock is configured
None
no shared control
STIG
V-DEMO-0002CAT II
RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.
CIS
6.2.1.1Level 2
Ensure auditd service is enabled and active
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
1.1.2.5.1Level 2
Ensure separate partition exists for /var/log
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
1.2.16Level 1
Ensure system-wide crypto policy is not set to legacy
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
1.2.5Level 1
Ensure repository GPG keys are configured and verified
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
2.2.1Level 1
Ensure unnecessary server services are not installed
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
3.5.1.1Level 1
Ensure a host-based firewall is installed and enabled
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
5.2.10Level 1
Ensure sudo authentication is required for privilege escalation
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
5.4.1.6Level 1
Ensure inactive password lock is configured
None
no shared control
STIG
V-DEMO-0003CAT II
RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.
CIS
6.2.1.1Level 2
Ensure auditd service is enabled and active
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
1.1.2.5.1Level 2
Ensure separate partition exists for /var/log
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
1.2.16Level 1
Ensure system-wide crypto policy is not set to legacy
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
1.2.5Level 1
Ensure repository GPG keys are configured and verified
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
2.2.1Level 1
Ensure unnecessary server services are not installed
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
3.5.1.1Level 1
Ensure a host-based firewall is installed and enabled
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
5.2.10Level 1
Ensure sudo authentication is required for privilege escalation
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
5.4.1.6Level 1
Ensure inactive password lock is configured
None
no shared control
STIG
V-DEMO-0004CAT III
RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.
CIS
6.2.1.1Level 2
Ensure auditd service is enabled and active
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
1.1.2.5.1Level 2
Ensure separate partition exists for /var/log
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
1.2.16Level 1
Ensure system-wide crypto policy is not set to legacy
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
1.2.5Level 1
Ensure repository GPG keys are configured and verified
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
2.2.1Level 1
Ensure unnecessary server services are not installed
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
3.5.1.1Level 1
Ensure a host-based firewall is installed and enabled
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
5.2.10Level 1
Ensure sudo authentication is required for privilege escalation
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
5.4.1.6Level 1
Ensure inactive password lock is configured
None
no shared control
STIG
V-DEMO-0006CAT II
RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.
CIS
6.2.1.1Level 2
Ensure auditd service is enabled and active
None
no shared control
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
1.1.2.5.1Level 2
Ensure separate partition exists for /var/log
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
1.2.16Level 1
Ensure system-wide crypto policy is not set to legacy
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
1.2.5Level 1
Ensure repository GPG keys are configured and verified
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
2.2.1Level 1
Ensure unnecessary server services are not installed
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
3.5.1.1Level 1
Ensure a host-based firewall is installed and enabled
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
5.2.10Level 1
Ensure sudo authentication is required for privilege escalation
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
5.4.1.6Level 1
Ensure inactive password lock is configured
Unmappable
no 800-53 anchor
STIG
V-DEMO-0005CAT II
RHEL 9 must disable USB mass storage on systems without USB peripheral requirements.
CIS
6.2.1.1Level 2
Ensure auditd service is enabled and active
Unmappable
no 800-53 anchor

NIST 800-53 pivot

Every base control that either corpus anchors to, including controls with items on only one side. A one-sided control is a real result.

AC-20 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

5.4.1.6 Ensure inactive password lock is configured

AC-61 stig / 1 cis

STIG items

V-DEMO-0001 RHEL 9 must disable direct root login via SSH.

CIS items

5.2.10 Ensure sudo authentication is required for privilege escalation

AC-71 stig / 0 cisSingle sided

STIG items

V-DEMO-0002 RHEL 9 must lock an account after three consecutive invalid logon attempts within a 15-minute window.

CIS items

None anchored here.

AC-81 stig / 0 cisSingle sided

STIG items

V-DEMO-0004 RHEL 9 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system.

CIS items

None anchored here.

AU-20 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

6.2.1.1 Ensure auditd service is enabled and active

AU-40 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

1.1.2.5.1 Ensure separate partition exists for /var/log

AU-121 stig / 0 cisSingle sided

STIG items

V-DEMO-0003 RHEL 9 must generate audit records for all successful and unsuccessful uses of privileged commands.

CIS items

None anchored here.

CM-50 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

1.2.5 Ensure repository GPG keys are configured and verified

CM-70 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

2.2.1 Ensure unnecessary server services are not installed

IA-21 stig / 0 cisSingle sided

STIG items

V-DEMO-0001 RHEL 9 must disable direct root login via SSH.

CIS items

None anchored here.

MA-41 stig / 0 cisSingle sided

STIG items

V-DEMO-0006 RHEL 9 SSH daemon must be configured to use FIPS 140-3 validated MACs.

CIS items

None anchored here.

SC-70 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

3.5.1.1 Ensure a host-based firewall is installed and enabled

SC-130 stig / 1 cisSingle sided

STIG items

None anchored here.

CIS items

1.2.16 Ensure system-wide crypto policy is not set to legacy