DISA STIGs and GPO packages

Annotated source catalog

DISA STIGs and DISA STIG GPO Packages: A Reference Collection (verified as of October 19, 2026)

DISA’s Security Technical Implementation Guides (STIGs) are the DoD’s product-specific configuration standards, derived from DISA Security Requirements Guides (SRGs) that are in turn derived from NIST SP 800-53 via Control Correlation Identifiers (CCIs); the current quarterly DISA GPO package is “Group Policy Objects (GPOs) - October 2026,” uploaded to the DoD Cyber Exchange on 2026-10-16, and the current STIG Viewer is 3.8.1 (released October 2, 2026).

1. TL;DR — the guidance baseline

• What and who: STIGs (XCCDF-formatted, rule-by-rule hardening requirements rated CAT I/II/III) and SRGs (technology-class requirements that “are derived from the NIST 800-53 and related documents”) are published by the Defense Information Systems Agency (DISA) on the DoD Cyber Exchange (cyber.mil, formerly public.cyber.mil). DoDI 8510.01 (RMF for DoD; 2014 text, RMF Step 3) requires that products in a system boundary “be configured in accordance with applicable STIGs or SRGs where STIGs are not available.” The DISA GPO package (latest: October 2026, uploaded 2026-10-16) is an implementation aid containing ADMX templates, GPO backup exports, GPO reports, WMI filter exports and STIG checklist files that cover “most applicable GPO STIG settings”. It is not the STIG itself.
• How it fits RMF/800-53: each STIG rule cites one or more CCIs, and each CCI decomposes an SP 800-53 control into a single, actionable statement. NIST’s National Checklist Program (NCP) re-lists DISA STIGs (with SCAP 1.4 content and links to the DISA GPO package) alongside CIS and vendor checklists. Assessment is done with DISA STIG Viewer 3.8.1 (CKL/CKLB checklists), the Navy’s SCAP Compliance Checker (SCC 5.15, NIWC Atlantic, released 09/01/2026), and optionally the Navy’s Evaluate-STIG (NSWC Crane/NAVSEA) and STIG Manager (NUWC Newport, open source).
• How to get them: unclassified STIGs, SRGs, SCAP benchmarks, the GPO package, STIG Viewer and SCC are free, public downloads from cyber.mil. CAC/PKI is needed only for restricted content and some tools’ distribution points (e.g., Evaluate-STIG on NAVSEA’s SPORK). The comparison baselines are CIS Benchmarks (consensus-based, free PDF under CC BY-NC-SA 4.0, with a STIG profile that replaced the former Level 3) and Microsoft security baselines in the Security Compliance Toolkit (SCT 1.0, Download Center page dated 10/8/2026). The Windows STIGs build on the Microsoft baselines and generally exceed them.

2. Guidance landscape overview

3. Section A — DISA’s own artifacts and tooling

A.1 What a STIG is, and the SRG → STIG hierarchy

• Source: DoD Cyber Exchange STIG pages (https://www.cyber.mil/stigs/); DoDI 8510.01; STIG Overview documents (e.g., Amazon Linux 2023 STIG Overview V1R4, 01 July 2026, “Developed by Amazon and DISA for the DOD”). Publisher: DISA (Risk Management Executive). Free; unclassified. Status: current.
• Definition (DoD policy): DoDI 8510.01 describes STIGs as product-specific documents that capture applicable DoD policies and security requirements as well as best practices

and configuration guidelines. SRGs are developed by DISA to give general security compliance guidelines and “serve as source guidance documents for STIGs”; “When a STIG is not available for a product, an SRG may be used.”

• Derivation from NIST SP 800-53: SRG overviews state the requirements “are derived from the NIST 800-53 and related documents.” STIG Overview documents add that “All technical NIST SP 800-53 requirements were considered while developing this STIG” and that applicable 800-53 controls are applied based on CNSSI 1253.
• Example SRGs: General Purpose Operating System (GPOS) SRG (a third-party tracker lists V3R4 dated 2026-10-05; not confirmed on cyber.mil); Application Server SRG (V4R5/V4R6 in 2026 per third-party trackers); Network Device Management SRG; Application Security and Development (ASD) STIG/SRG. DISA released a draft General Application (GAPP) SRG for review on August 18, 2026.
• Vendor-developed STIGs: DISA’s Risk Management Executive runs a process in which product vendors author STIGs that DISA reviews and publishes (e.g., the Amazon Linux 2023 STIG is labeled “Developed by Amazon and DISA for the DOD”).
• Example rule counts: Windows Server 2025 STIG V1R1 (26 Jan 2026) contains 284 rules — 29 CAT I, 243 CAT II, 12 CAT III (per a third-party STIG tracker that mirrors DISA content).

A.2 STIG structure and identifiers

• Format: STIGs ship as ZIP packages containing an XCCDF (Extensible Configuration Checklist Description Format) XML benchmark plus PDF companions (Overview, Revision History, Read Me, Release Memo). The XCCDF is a “manual” (human-checked) benchmark; automated checks ship separately as SCAP benchmarks (XCCDF + OVAL data streams). NIST NCP listings show DISA now publishing SCAP 1.4 content (e.g., “U_MS_Windows_10_V3R7_STIG_SCAP_1-4_Benchmark”) and “Standalone XCCDF 1.1.4” STIG files.
• Versioning: “Version X, Release Y” (VxRy), e.g., Windows 11 STIG V2R11. New Versions generally mean major restructuring; Releases are incremental updates.
• Per-rule fields (as exposed by STIG Viewer 3.x, which sorts/searches on them): Group ID (Vuln ID, form V-######, e.g., V-279922), Rule ID (form SV- ######r######_rule), STIG ID (product-prefixed, e.g., WN25-00-000070 for Windows Server 2025), Rule Title, Severity, Discussion, Check (check text), Fix (fix text), CCI references, and Legacy IDs. SRG-based rules also carry an SRG requirement ID (e.g., SRG-OS-000327-GPOS-00127) and often a “Satisfies:” list of multiple SRG IDs.
• Numbering transition: current STIGs use the V-/SV- identifiers; older identifiers are retained in the Legacy ID field so assessors can map findings across revisions. (The exact date DISA re-baselined numbering was not re-verified in this research.)

A.3 Severity Category Codes (CAT I / II / III)

• Source: “Vulnerability Severity Category Code Definitions” table in every STIG Overview (e.g., Amazon Linux 2023 STIG Overview V1R4, July 2026). Each security policy in a STIG “is assigned a Severity Category Code of CAT I, II, or III.”
• CAT I (High): any vulnerability whose exploitation “will directly and immediately result in loss of Confidentiality, Availability, or Integrity.”
• CAT II (Medium): any vulnerability whose exploitation “has a potential to result in loss of” confidentiality, availability, or integrity.
• CAT III (Low): any vulnerability whose exploitation “degrades measures to protect against loss of” confidentiality, availability, or integrity.
• XCCDF mapping: in XCCDF, CAT I/II/III appear as severity high/medium/low. STIG Viewer 3.x allows a reviewer to override severity in a checklist (with justification). Vendor documentation notes that most rules are CAT II and that “During STIG development DISA may modify severity.”
• Not CVSS: CAT codes rate the impact of a misconfiguration/weakness in DoD context; they are not CVSS scores and are not computed from CVSS metrics.

A.4 The DISA STIG GPO package

• Title / location: “Group Policy Objects (GPOs)” — https://www.cyber.mil/stigs/gpo/. Publisher: DISA Risk Management Executive. Free, unclassified, public. Status: current release “Group Policy Objects (GPOs)
  • October 2026,” uploaded 2026-10-16, alongside a separate “Intune Policy
  • October 2026” package (same date). Prior release: July 2026 (announced July 22, 2026, with “Change Log document included in the .zip files”). July 2026 ZIP name: U_STIG_GPO_Package_July_2026.zip (per NIST NCP; NCP publishes a SHA-256 hash for it).
• Contents (DISA’s description): “This package contains ADMX template files, GPO backup exports, GPO reports, and WMI filter exports and STIG Checklist files.” Earlier packages (e.g., January 2022) also contained a ReadMe.txt, Change Log, and Known Issues file; per-product folders are named like “DoD Windows 11 vXrY” / “DoD Microsoft Edge VxRy,” each holding a GPO backup and report (gpreport.xml). In 2022 the Intune policies were inside the ZIP; in 2026 they are a separate download.
• LGPO / scripts: No evidence was found that Microsoft’s LGPO.exe is bundled in the DISA package; third-party guides instruct users to download LGPO from Microsoft’s SCT and point it at the DISA GPO folder for standalone (non-domain) systems. Import scripts and a version table could not be confirmed for 2026.
• Coverage (as verifiable): DISA’s July 2026 announcement lists Windows 10, Windows 11, Office 2019–M365 Apps, Microsoft Edge, and Microsoft Defender Antivirus; NIST NCP pages link the 2026 GPO package from the Windows 11 STIG (V2R11), Windows 10 STIG (V3R7), Windows Defender Firewall with Advanced Security, Office 365 ProPlus, OneDrive, and Office System 2016 checklists. Third-party guides show Windows Server 2022 domain controller/member server GPOs and Firefox in recent packages. Windows Server 2016/2019/2025, Active Directory Domain/Forest, IE11, Chrome and Adobe GPOs were not confirmed for 2026 in this research.
• Relationship to STIG rules: the GPOs “contain most applicable GPO STIG settings contained in STIG files” — i.e., only settings that are expressible as Group Policy, and not all of those (organization-specific values such as some User Rights Assignments are placeholders). Manual/procedural rules (documentation, account reviews, file permissions requiring local judgement) are outside the GPOs. DISA warns the GPOs must be evaluated in a representative test environment before production.
• Timing: GPO and STIG dates can differ; DISA aims for the gap to be no more than “a few weeks” (e.g., October 2026 STIGs announced Oct 6; GPOs uploaded Oct 16).

A.5 Release cadence, Sunset STIGs, document library

• Quarterly Release Schedule and Summary page (https://www.cyber.mil/stigs/quarterly-release-schedule-and-summary): Q1 “End of January 2026,” Q2 “End of April 2026,” Q3 “End of July 2026”; the Q4 row still reads “End of October 2025” (page not updated at time of research). Actual 2026 announcements were earlier in the month: July 2026 Quarterly Release (July 10, 2026) and October 2026 Quarterly Release (October 6, 2026). Out-of-cycle updates and draft SRGs (e.g., GAPP SRG draft, Aug 18, 2026) appear between quarters.
• STIG Announcements page (https://www.cyber.mil/stigs/stig-announcements) is the authoritative change feed (quarterly releases, tool releases, GPO/Intune updates).
• Sunset STIGs: superseded or end-of-life products are moved to “Sunset” status (e.g., NCP lists “Sunset
  • Microsoft Windows 10 STIG
  • Ver 2, Rel 9” and “Sunset-Microsoft Windows 10 STIG
  • Ver 3, Rel 6” as prior XCCDF files). Sunset content remains downloadable but is no longer maintained.
• Libraries: the STIGs Document Library (https://www.cyber.mil/stigs/downloads/) and quarterly STIG Library Compilation ZIPs (which STIG Viewer and STIG Manager can import wholesale).

A.6 STIG Viewer 3.x

• Title / location: STIG Viewer 3.x — “SRG and STIG Tools” page (https://www.cyber.mil/stigs/srg-stig-tools/). Publisher: DISA. Free, public; Windows (ZIP and MSI) and Linux builds plus a hash file.
• Current version: 3.8.1, uploaded/announced October 2, 2026 (“refreshes software dependencies… There are no changes to functionality”). 3.8.0 and the STIG Viewer 3.x User Guide V1R8 were released August 18, 2026. Adaptiva’s third-party patch library lists 3.7.0 with a release date of 2/11/2026; its release notes include an “Updated CCI List” and “Updated Applicability Guide content as of January 2026.”
• What it does (User Guide V1R6, 15 Aug 2025): views one or more XCCDF STIGs in human-readable form; maintains a STIG library; imports compilation ZIPs; searches by Content, Rule Title, Severity, STIG ID, Group ID, Rule ID, CCI or Legacy ID; displays CCI data; compares STIG versions; builds checklists; imports SCAP/XCCDF results into checklists so the manual portion can be completed; exports HTML/CSV; and includes the SRG/STIG Applicability Guide (build an asset collection and determine which SRGs/STIGs apply).
• Checklist formats: CKL (legacy XML, used by STIG Viewer 2.x and eMASS; 3.4 renamed “eMass CKL” export to “CKL”) and CKLB (JSON; DISA publishes the “Stig Viewer 3 CKLB JSON Schema”).
• Legacy: “STIG Viewer Version 3.x is a replacement for the previous DISA tools STIG Viewer 2.x and STIG-SRG Applicability Guide.” 3.x is not Java-based; DISA’s FAQ states there will be no JAR release. Windows EXE/MSI files have been DoD code-signed since 2.15.

A.7 SCAP content and the SCAP Compliance Checker (SCC)

• Title / location: SCAP Compliance Checker — NIWC Atlantic page (https://www.niwcatlantic.navy.mil/Technology/SCAP/) and DISA SCAP page (https://www.cyber.mil/stigs/SCAP/). Developer: Naval Information Warfare

Center (NIWC) Atlantic, U.S. Navy; distributed via the DoD Cyber Exchange and a public GitHub archive (niwc-atlantic/scap-scc). Free; governed by an end-user licence agreement.

• Current version: SCC 5.15, release date 09/01/2026 (NIWC); cyber.mil files uploaded 2026-09-09 for Windows, Linux x86_64 and AArch64, Solaris 11 (i386/SPARC), macOS ARM64, plus a UNIX remote-scanning plugin. SCC 5.14.1 Ubuntu builds remain (2026-05-05).
• Capabilities: “SCC is a SCAP Validated Authenticated Configuration Scanner, with support for SCAP versions 1.0, 1.1, 1.2, 1.3 and 1.4”; local and remote scanning of Windows and Linux/Solaris; Cisco IOS/IOS XE offline and SSH scanning; GUI and CLI. NIST’s SCAP 1.3 validation record (#147) is for SCC 5.6.0.1, validated 11/04/2022.
• Public availability and history: “Starting with version 5.4, SCC is publicly available and can be downloaded from” DISA (Navy press release, 2021, “free for public use”); funding credits run IRS (2008–2010), NSA (2010–2012), DISA (2013–2022).
• DISA SCAP benchmarks: published on the SCAP page per product (e.g., “Microsoft Windows 11 STIG SCAP Benchmark - Ver 2, Rel 11,” uploaded 2026-10-05). SCAP benchmarks automate only a subset of each STIG’s rules; the remainder must be checked manually (STIG Viewer) or with tools such as Evaluate-STIG.

A.8 Evaluate-STIG (separate from DISA)

• Developer: Naval Surface Warfare Center (NSWC) Crane Division, under NAVSEA (U.S. Navy) — a US government tool, not a DISA product.
• Distribution: NAVSEA GitLab “SPORK” (spork.navsea.navy.mil/nswc-crane-division/evaluate-stig), which requires DoD CAC/PKI; classified networks via Intelink (NAVSEA-RMF). Not distributed on cyber.mil.
• What it does: PowerShell (with a Bash variant for Linux) that detects applicable STIGs on an asset, evaluates the checks it has logic for (including many manual checks), and writes CKL/CKLB checklists; supports -ListSupportedProducts/-ListApplicableProducts and can upload results directly to STIG Manager (requires PowerShell 7 for that integration).
• Version: the current 2026 build could not be verified from public sources.

A.9 STIG Manager (open source)

• Developer: Naval Undersea Warfare Center Division Newport (NUWCDIVNPT), U.S. Navy; GitHub (NUWCDIVNPT/stig-manager), container images including an Iron Bank variant.
• What it does: API and web client for managing STIG assessments across collections of assets; imports DISA STIG library compilations, CKL/CKLB and XCCDF results; exports CKL(B).
• Current state: release 1.6.17 raised the minimum database to MySQL 8.4.0; active development through October 2026 (e.g., merges dated Oct 5 and Oct 14, 2026).

A.10 Control Correlation Identifiers (CCIs)

• Definition (DISA): CCI “provides a standard identifier and description for each of the singular, actionable statements that comprise an IA control or IA best practice,” bridging “high-level policy expressions and low-level technical implementations.”
• Role: STIG and SRG rules cite CCIs (e.g., CCI-001453 maps to AC-17); CCIs map to SP 800- 53 controls (current Rev 5 CCIs include IDs in the CCI-004xxx range). DoDI 8510.01 tasks DISA to ensure CCIs, SRGs and STIGs are consistent with DoD security controls and assessment procedures.
• Governance: DISA’s CCI process document (draft V1R0.1) states DISA established the initial CCI List from SP 800-53 and accepts proposed changes by email (cci@disa.mil).
• Where to get the list (conflicting sources): one DAU Acquipedia version says that “As of 2021, the CCI List is no longer published on the DOD Cyber Exchange” and directs users to export CCIs from STIGs via STIG Viewer; another version says the CCI list “has moved to the STIG Document Library downloads section.” STIG Viewer 3.7 release notes cite an “Updated CCI List” bundled in the tool. Treat STIG Viewer and the STIG Document Library as the current routes.

A.11 Access notes (public vs CAC/PKI)

• DISA’s legacy download page describes two tiers: “DoD Cyber Exchange Public (public.cyber.mil),” with “limited access to publicly releasable cyber training and guidance to all Internet users,” and “DoD Cyber Exchange NIPR (cyber.mil),” with exclusive access for DoD PKI credential holders. Current www.cyber.mil pages carry the banner “Login with DoD CAC for full access.”
• Unclassified STIGs, SRGs, SCAP benchmarks, the GPO and Intune packages, STIG Viewer and SCC are listed as “Unclassified” and are publicly downloadable. Some STIGs and supporting content (and Evaluate-STIG) require DoD PKI.
• Recent DISA documents use “Department of War (DoW)” wording in places alongside “DOD”; cyber.mil content is being migrated, and some legacy pages (e.g., Cyber Workforce content) are slated to sunset December 31, 2026.

4. Section B — Related government and standards guidance

B.1 NIST

• SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations — NIST; Sept 2020 (updated Dec 2020); current; free, US government work (public domain in the US). Scope: the control catalog the SRGs/STIGs implement via CCIs. Key point: controls are outcome-oriented, not product settings; STIGs supply the product-level settings for configuration controls such as CM-6 (configuration settings) and CM-7 (least functionality).
• National Checklist Program (NCP) — https://ncp.nist.gov (also reachable via nvd.nist.gov/ncp/repository); current; free. Scope: centralized repository of security configuration checklists from authoritative sources. Key points: lists DISA STIGs with authority “Governmental Authority: Defense Information Systems Agency,” review status, type (Compliance), and links to SCAP content, standalone XCCDF, GPO and Intune packages — e.g., Windows 10 STIG V3R7 (Checklist ID 629) links “Group Policy Objects (GPOs) - July 2026” and SCAP 1.4 content. NCP also hosts CIS Benchmarks, which carry CIS’s CC BY-NC-SA 4.0 licence text.
• SP 800-70, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers — NIST. The Rev 5 IPD was released Dec 9, 2025, with comments due Jan 16, 2026. NIST CSRC lists Rev 5 as final on May 8, 2026 (authors

Stephen Quinn and Blair Heiserman, DOI 10.6028/NIST.SP.800-70r5), superseding Rev 4 (02/15/2018). Rev 5 adds mappings between checklist settings, CSF 2.0 outcomes, SP 800-53 controls and CCE identifiers. Note on tiers: the Tier I–IV scheme (Tier I prose- based through Tier IV complete SCAP-validated content) is from Rev 3; Rev 4 “Removed the checklist ‘tier’ and ‘SCAP Expressed’ concepts,” so NCP listings now describe automation by content type (prose vs SCAP) rather than tier. The NCP participant page still listed Rev 5 as an initial public draft at time of research.

• SP 800-126 Rev 4, Technical Specifification for SCAP: SCAP Version 1.4 — NIST; final June 8, 2026 (draft Dec 11, 2025); current; with annex SP 800-126A Rev 4. Key points: SCAP 1.4 “is the current final release”; Rev 4 removes backward-compatibility requirements for earlier SCAP versions, revises digital-signature requirements, and redirects OVAL references to the OVAL Community GitHub. NIST credits NIWC Atlantic’s team (Jack Vander Pol is a co-author) with shaping the revision. SCAP 1.3 (Rev 3) is superseded; NIST’s SCAP Content Validation Tool supports 1.2, 1.3 and 1.4.
• RMF publications — these frame where STIG compliance evidence is used (the Implement, Assess and Monitor steps). SP 800-37 Rev 2 (RMF, Joint Task Force) was finalized 12/20/2018 and supersedes Rev 1 (06/05/2014). SP 800-137 (ISCM; Dempsey, Johnston of DoD, Stine et al.) was finalized 09/30/2011, with SP 800-137A as a companion. SP 800-117 (SCAP adoption guide, 2010) is legacy and was not re-verified.

B.2 DoD policy

• DoDI 8500.01, “Cybersecurity” — DoD CIO; March 14, 2014, as amended; current; public. It establishes the DoD cybersecurity program. As quoted in NIST NCP’s DISA checklist entry, it says all DoD IT “will be […] configured […] consistent with applicable DoD cybersecurity policies, standards, and architectures,” and that DISA “develops and maintains control correlation identifiers (CCIs), security requirements guides (SRGs), security technical implementation guides (STIGs)…”
• DoDI 8510.01, “Risk Management Framework for DoD Systems” — DoD CIO; effective July 19, 2022 (reissued and cancelled the March 12, 2014 “RMF for DoD IT” version); current; public. Key points (2014 text, carried forward in substance): DISA ensures CCIs, SRGs and STIGs are consistent with DoD controls and assessment procedures; systems are configured per applicable STIGs, or SRGs where STIGs are unavailable; assessment is performed at the CCI level.
• CNSSI 1253 — Committee on National Security Systems; cited in STIG Overviews as the basis for applying SP 800-53 controls to DoD/NSS systems.

B.3 NSA

• Posture: NSA historically published security configuration guides (now archived) and the Windows Secure Host Baseline repository on code.nsa.gov (“Configuration guidance for implementing the Windows 10 and Windows Server 2016 DoD Secure Host Baseline settings”), now legacy. No current, comprehensive NSA Windows baseline separate from DISA was found; DISA owns STIGs.
• Current outputs: NSA Cybersecurity Information Sheets (CSIs) on targeted hardening topics, e.g., “Guidance for Managing UEFI Secure Boot” and “Best Practices Guide for Cyber Hygiene” (Sept 2026). These are free government publications and complementary to, not substitutes for, STIGs.
• Tool relationship: NSA funded SCC development in 2010–2012.

B.4 CIS (Center for Internet Security, nonprofit)

• CIS Benchmarks — https://www.cisecurity.org/cis-benchmarks; “more than 100 CIS Benchmarks across 25+ vendor product families,” developed “through a unique consensus-based process.” Free PDFs for non-commercial use under CC BY-NC-SA 4.0; commercial use requires CIS approval; CIS Controls use CC BY-NC-ND 4.0.
• Profiles: Level 1 (base hardening with minimal functional impact), Level 2 (defense in depth), and a STIG profile that “replaces the previous Level 3” and “provides all recommendations that are STIG specific”; where a STIG recommendation contradicts a CIS recommendation, this is noted in the recommendation description, and the STIG ID is listed in each recommendation’s additional information.
• CIS STIG Benchmarks (current versions listed): Microsoft Windows 11 STIG 1.2.0, Windows 10 STIG 1.0.0, Windows Server 2022 STIG 3.0.0, Windows Server 2019 STIG 4.0.0, Windows Server 2016 STIG 4.0.0, Windows Server DNS STIG 1.0.0, SQL Server 2022 Instance STIG 1.0.0, Apple macOS 26 Tahoe STIG 1.0.0, among others; CIS also sells STIG Hardened Images on cloud marketplaces.
• CIS-CAT: CIS-CAT Pro (automated assessment against benchmarks, including the STIG benchmarks) and build kits (GPOs) require CIS SecureSuite membership (paid); CIS- CAT Lite is free with limited content.
• Cadence: CIS commits to cover the latest Windows build “within 90 days of a new Windows version release.”

B.5 Microsoft

• Security Compliance Toolkit (SCT) 1.0 — https://www.microsoft.com/en-us/download/details.aspx?id=55319; Download Center page dated 10/8/2026; free under Microsoft’s Download Center terms (not public domain). Current files include Windows 11 v26H2 Security Baseline v2, v25H2, v24H2, v23H2; Windows Server 2025 Security Baseline – 2602; Windows Server 2022; Windows 10 22H2 and older; Microsoft Edge v151; Microsoft 365 Apps for Enterprise 2512; LGPO.zip; PolicyAnalyzer.zip; SetObjectSecurity.zip.
• Baselines: Microsoft’s version matrix shows Windows 11 26H2 (September 2026) and Windows Server 2025 (February 2026). Each baseline ZIP contains “GPO Backups, GPO reports, Excel spreadsheets, WMI filters, and scripts to apply the settings to local policy.” SCT replaced the retired Security Compliance Manager.
• LGPO.exe: command-line tool to apply/export local policy — imports GPO backups, registry.pol, security templates (GptTmpl.inf) and audit CSVs, and converts registry.pol to/from “LGPO text.”
• Policy Analyzer: read-only comparison of GPO sets (and local policy/registry), highlighting redundancies and conflicts; exports to Excel — the standard way to diff a DISA GPO against the Microsoft baseline.
• Relationship to STIGs: Microsoft’s baselines are Microsoft’s recommended enterprise settings; Windows STIGs cover most of the same settings and add DoD-specific requirements (e.g., DoD banners, stricter audit and account policies, DoD PKI/certificate rules) plus non-GPO procedural checks, so a STIG-configured system generally exceeds the Microsoft baseline, with some differing values.

B.6 IETF

• Not applicable as a source of STIG requirements. STIGs reference protocols (e.g., TLS, SNMP, NTP) by name and version and occasionally cite RFCs within individual rules, but no IETF document defines or governs STIGs.

5. Topic crosswalk

6. Where authorities agree, differ, or conflict

• DISA STIG vs CIS Benchmark: both target secure configuration and overlap heavily on Windows/Linux settings. The difference is authority and process: STIGs are DoD- mandated and DISA-approved (often vendor-authored); CIS Benchmarks are consensus products. CIS’s STIG profile explicitly bridges the two and flags contradictions with CIS recommendations — the clearest sign the baselines are not identical. CIS STIG

Benchmark versions (e.g., Windows Server 2022 STIG 3.0.0) track specific DISA releases and can lag DISA’s quarterly updates.

• STIG GPO package vs Microsoft baseline: both are delivered as GPO backups with reports and WMI filters, and DISA’s Windows GPOs largely start from the same Windows settings. DISA adds DoD-specific and stricter values and omits settings that need organizational values (placeholders); Microsoft ships LGPO and Policy Analyzer, while DISA’s package (per available evidence) does not bundle LGPO. Use Policy Analyzer to see exact deltas for a given release pair.
• Severity models are not comparable: CAT I–III rates DoD impact of a weakness; CVSS scores software vulnerabilities (CVEs); CIS Level 1/2/STIG are profile scopes; CIS Implementation Groups (IG1–IG3) belong to the CIS Controls, not the Benchmarks. A CAT I finding is not equivalent to a “critical” CVSS score.
• Cadence: DISA is quarterly (2026 releases arrived early in Jan/Apr/Jul/Oct months, e.g., Oct 6), with GPOs a few weeks later (Oct 16); Microsoft ships per OS/app release (e.g., Windows 11 26H2 baseline in September 2026, ahead of a DISA STIG for that build); CIS targets 90 days after a Windows release. Expect periods when the newest Windows build has a Microsoft baseline but not yet a matching STIG update.
• Manual vs SCAP-automatable checks: SCAP benchmarks (SCC) automate only part of a STIG; the remainder is manual (STIG Viewer) or semi-automated (Evaluate-STIG). A clean SCC score is not full STIG compliance.
• Applicability outside DoD: STIGs are required for DoD systems per DoDI 8510.01, but are freely usable elsewhere as hardening references; NIST NCP lists them for broad use. Non-DoD frameworks (e.g., NIST SP 800-171/CMMC) do not name STIGs as the required baseline (per secondary sources).
• Internal DISA inconsistencies to note: the Quarterly Release Schedule page’s Q4 row still reads “End of October 2025”; Windows Server 2025 versioning differs between the October announcement (STIG V1R4) and the SCAP benchmark (V1R2, uploaded 2026-10- 05) — SCAP benchmark release numbers are tracked separately from STIG release numbers, so always match the benchmark to the STIG release named in its readme.

7. Caveats and items that could not be verified

• cyber.mil pages render via JavaScript and could not be fetched in full; DISA facts were verified from indexed page text of cyber.mil, DISA PDFs (dl.dod.cyber.mil), and NIST NCP listings.
• The exact October 2026 GPO package file tree, ZIP name, hash, product list, presence of LGPO.exe, import scripts, a “Support Files” folder or a README version table were not verifiable; download the ZIP and read its ReadMe/Change Log to confirm.
• Coverage of Windows Server 2016/2019/2025, Active Directory Domain/Forest, IE11, Chrome and Adobe in the 2026 GPO package was not confirmed.
• The Windows Server 2025 STIG release is reported as V1R4 (October 6 announcement snippet) by one source and V1R2 by trackers; the SCAP benchmark is V1R2. Confirm on the STIG Document Library.
• Evaluate-STIG’s current version is behind CAC; not verified. STIG Manager’s and SCC’s licence terms were not reviewed in detail.
• One third-party source claims SCC downloads are CAC-gated; NIWC Atlantic states SCC has been publicly available from DISA since 5.4 — the primary source is preferred.
• CCI list publication location is described inconsistently by DAU sources; the date of DISA’s V-/SV- renumbering was not re-verified.
• SP 800-70 Rev 5 is listed as final on NIST CSRC (May 8, 2026, superseding Rev 4 of 02/15/2018), but the NCP participant page still shows the draft. SP 800-37 Rev 2 (final 12/20/2018) and SP 800-137 (final 09/30/2011) dates are confirmed on CSRC. SP 800-53 Rev 5 minor releases, SP 800-117 and CNSSI 1253 versions were not re-verified in this session.
• DoDI 8500.01’s configuration and DISA-tasking wording was confirmed from the quotation in NIST NCP’s DISA checklist entry rather than from the instruction itself. DoDI 8510.01’s STIG/SRG language (“configured in accordance with applicable STIGs or SRGs where STIGs are not available”) was confirmed from the 2014 text, and the 2022 reissue’s existence and effective date were confirmed separately.
• Third-party trackers (stigviewer.com, cyber.trackr.live, stigaview.com) were used only for rule counts and SRG versions and are not authoritative.
• US government works (DISA, NIST, NSA, DoD) are generally not subject to US copyright, but vendor-co-developed STIGs and bundled third-party files may carry other terms; DISA does not publish a single explicit reuse licence that was verified here.