> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/cheat-sheet-1/hardening/stigs-compliance-and-benchmarks.md).

# Stigs / Compliance & Benchmarks

## Microsoft Security Compliance Toolkit 1.0 <a href="#dlcdetail__pagetitle" id="dlcdetail__pagetitle"></a>

The **Microsoft Security Compliance Toolkit 1.0** is a set of tools provided by Microsoft to help **IT administrators and security professionals configure, manage, and verify security settings** in Windows operating systems and other Microsoft products, based on Microsoft’s **recommended security baselines**.

{% embed url="<https://www.microsoft.com/en-us/download/details.aspx?id=55319>" %}

## **CIS Benchmarks (Center for Internet Security)**

* What it is: Free, community-developed security configuration guidelines for systems like Windows, Linux, macOS, AWS, Azure, Docker, and more.
* Format: PDF guides, scripts (PowerShell, Ansible, etc.), and automated tools.
* Security levels: Typically split into Level 1 (basic security) and Level 2 (advanced/hardened).
* Use case: System hardening and compliance checks.

{% embed url="<https://www.cisecurity.org/cis-benchmarks>" %}

## STIGs (Security Technical Implementation Guides – DISA/STIG)

* What it is: Security configuration standards published by the U.S. Department of Defense (DoD).
* Focus: Very strict hardening — commonly used in military and government environments.
* Coverage: Operating systems, applications, databases, network devices, etc.
* Tools: Often used with the SCAP Compliance Checker (SCC Tool) or OpenSCAP.
* Format: XML, checklist, XCCDF, etc.

{% embed url="<https://public.cyber.mil/stigs/>" %}