# Stigs / Compliance & Benchmarks

## Microsoft Security Compliance Toolkit 1.0 <a href="#dlcdetail__pagetitle" id="dlcdetail__pagetitle"></a>

The **Microsoft Security Compliance Toolkit 1.0** is a set of tools provided by Microsoft to help **IT administrators and security professionals configure, manage, and verify security settings** in Windows operating systems and other Microsoft products, based on Microsoft’s **recommended security baselines**.

{% embed url="https://www.microsoft.com/en-us/download/details.aspx?id=55319" %}

## **CIS Benchmarks (Center for Internet Security)**

* What it is: Free, community-developed security configuration guidelines for systems like Windows, Linux, macOS, AWS, Azure, Docker, and more.
* Format: PDF guides, scripts (PowerShell, Ansible, etc.), and automated tools.
* Security levels: Typically split into Level 1 (basic security) and Level 2 (advanced/hardened).
* Use case: System hardening and compliance checks.

{% embed url="https://www.cisecurity.org/cis-benchmarks" %}



## STIGs (Security Technical Implementation Guides – DISA/STIG)

* What it is: Security configuration standards published by the U.S. Department of Defense (DoD).
* Focus: Very strict hardening — commonly used in military and government environments.
* Coverage: Operating systems, applications, databases, network devices, etc.
* Tools: Often used with the SCAP Compliance Checker (SCC Tool) or OpenSCAP.
* Format: XML, checklist, XCCDF, etc.

{% embed url="https://public.cyber.mil/stigs/" %}

