What a STIG check is, how to read its check text and fix text, what CAT I, CAT II, and CAT III severity mean, and which STIG checks a SCAP scan can automate.
What a STIG check is
Every requirement in a DISA STIG is a STIG check: one configuration setting or behavior, one way to verify it, and one way to fix it. A current Red Hat Enterprise Linux 9 STIG has about 445 checks; a small application STIG may have a dozen. Each check becomes one line in your STIG checklist.
Anatomy of a STIG check
- V-number (for example V-257777) — the vulnerability ID. It stays the same across releases, which is why people search for it.
- Rule title — the requirement in one sentence, such as "RHEL 9 must be a vendor-supported release."
- Severity — CAT I, CAT II, or CAT III (below).
- Discussion — why the requirement exists.
- Check text — the exact steps or command to verify it, and what counts as a finding.
- Fix text — how to remediate it.
- CCIs — Control Correlation Identifiers that map the check to NIST SP 800-53 controls.
CAT I, CAT II, and CAT III severity
DISA assigns every STIG check one of three severity categories. STIG Vault labels them High, Medium, and Low, and the severity filter on each STIG page narrows it to just its CAT I (High) checks.
- CAT I (high) — exploitation directly leads to loss of confidentiality, availability, or integrity. Open CAT I findings usually block an ATO.
- CAT II (medium) — exploitation has the potential to lead to that loss. Most STIG checks are CAT II.
- CAT III (low) — the finding degrades protections against that loss.
Manual STIG checks vs automated SCAP checks
Many STIG checks can be automated: DISA packages those as a SCAP benchmark that a scanner such as SCAP Compliance Checker evaluates. The rest — policy, documentation, and anything that needs judgment — stay manual. A scan result and a checklist line up because the SCAP rule and the STIG check share the same SV- number.
Browse the automated side in the SCAP Repository, and the manual side in the STIG checklists.
Finding the STIG check you need
- Know the V-number? Look it up with Search.
- Know the setting? Search a phrase, in quotes for an exact match — for example "audit log".
- Need what changed? STIG Compare lists added, removed, and changed checks between releases.
Frequently asked questions
What is a STIG check?
A STIG check is one requirement in a DISA STIG: a setting to verify (check text), how to fix it (fix text), a severity from CAT I to CAT III, and a V-number that identifies it across releases.
What does CAT I mean in a STIG?
CAT I is the highest STIG severity: a finding whose exploitation directly leads to loss of confidentiality, availability, or integrity. CAT II is medium and CAT III is low.
Can STIG checks be automated?
Many can. DISA publishes the automatable STIG checks as SCAP benchmarks, which a scanner such as SCAP Compliance Checker runs. Checks that need human judgment remain manual.