poam.md

POA&M — cs10_stig / stig

StigForge docker verify (OpenSCAP). Policy-exempt rules are excluded from the score denominator. Failure buckets follow stigready poam-from-arf.py classification (N/A / risk-accepted / gap).

Score: 95.71% (floor 90.0%) — meets floor

OpenSCAP failures — classified (3)

Risk-accepted - N/A on a single-tenant cloud AMI (1)

• ensure_redhat_gpgkey_installed

Gap - role vs SSG (scheduled remediation) (2)

• file_permissions_ungroupowned
• network_configure_name_resolution

Policy exempt — not scored (32)

• accounts_password_pam_enforce_root
• auditd_audispd_configure_remote_server
• auditd_offload_logs
• configure_opensc_card_drivers
• dconf_gnome_screensaver_idle_delay
• dconf_gnome_session_idle_user_locks
• ensure_root_password_configured
• force_opensc_card_drivers
• grub2_admin_username
• grub2_password
• grub2_set_password
• grub2_uefi_password
• grub2_unique_name
• install_smartcard_packages
• installed_OS_is_vendor_supported
• package_opensc_installed
• package_pcsc-lite_installed
• package_subscription-manager_installed
• rsyslog_encrypt_offload_defaultnetstreamdriver
• rsyslog_remote_access_monitoring
• rsyslog_remote_loghost
• service_pcscd_enabled
• smartcard_configure_ca
• smartcard_configure_cert_checking
• smartcard_configure_crl
• smartcard_pam_enabled
• sssd_certificate_verification
• sssd_enable_certmap
• sssd_enable_smartcards
• sudo_remove_nopasswd
• sudo_require_authentication
• sudo_require_reauthentication