What is the difference between StigReady Base and Applied pricing?

StigReady Base is $0.02/hr or $149/yr per instance — STIG disk layout, SSH hardening, and cloud-ready defaults; you bring your own CIS/STIG profiles. StigReady Applied is $0.08/hr or $649/yr per instance — full CIS Level 1/2 or DISA STIG remediation with published OpenSCAP scores and an evidence bundle. Both fees are Marketplace software fees on top of normal EC2 costs. The same rate applies to every instance type; it does not change with instance size.

What OpenSCAP evidence is available for Applied?

Every Applied image has an OpenSCAP ARF result, HTML report, POA&M and SBOM, and every Applied image except RHEL 10 has a CVE scan, available from support@stigready.com on request. Scores are measured in-build against the raw, unmodified SSG profile. StigReady is not affiliated with or endorsed by DISA, DoD, NIST, or CIS, and does not claim certified, authorized, or accredited status.

Do you support arm64 / Graviton?

Yes. StigReady Base and Applied build for both x86_64 and arm64 (Graviton). Use the architecture filters on the Base and Applied catalogs to see cells we actually build.

Are StigReady AMIs available on AWS Marketplace?

StigReady Base is on AWS Marketplace: the Base catalog on stigready.com links each image to its listing. StigReady Applied listings are coming soon. Watch our seller profile or email contact@stigready.com for early access and Private Offers. We do not publish AMI IDs on this site.

StigReady — STIG AMI & CIS Benchmark L1/L2 AMI with OpenSCAP Scores

Q: Are RHEL images BYOL?

Yes. Red Hat Enterprise Linux images are BYOL — you supply your own Red Hat subscription. StigReady does not sell or provide Red Hat commercial licenses.

StigReady Base

The base that won't fight you

The structural work that's painful to retrofit — already done. Bring your own profiles, Ansible, and tooling.

STIG Partition Layout

Separate hardened mounts for /home, /tmp, /var, /var/log, /var/log/audit, and /var/tmp on the images built from the OS installer. Amazon Linux 2023 is built from Amazon's prebuilt disk image and gets a separate /var/log/audit, the one partition its STIG requires.

SSH Hardened

Password auth disabled, root login prohibited, host keys regenerated on first boot, no pre-installed keys — cloud-init injects your EC2 key pair.

Minimal & Patched

Built from the official OS ISO (Amazon Linux 2023: Amazon's prebuilt disk image) with a minimal footprint and fully updated packages on a monthly cadence — smaller attack surface, no surprise packages.

AWS-Native

IMDSv2 enforced. SSM Agent pre-installed. cloud-init handles EC2 key-pair injection. Boot-tested on real Nitro EC2 before any image ships. x86_64 and arm64 (Graviton).

Base Catalog

Release 1 · 24 images · Rocky / Alma / RHEL 8–10, Ubuntu 24.04 / 26.04, Amazon Linux 2023 · x86_64 + arm64

OS	Arch	Availability
Loading catalog…

BYOL — Red Hat Enterprise Linux images are Bring Your Own License. You supply the Red Hat subscription; StigReady does not provide commercial Red Hat licenses. Red Hat, Inc. holds the trademarks for Red Hat® and Red Hat Enterprise Linux®.

Partition Layout

GPT disk · LVM volume group vg_root · separate STIG filesystems on every image built from the OS installer. Amazon Linux 2023 is built from Amazon's prebuilt disk image and gets only a separate /var/log/audit (volume group vg_stig), the one partition its STIG requires.

Mount	Filesystem	Options
/boot/efi	vfat	—
/boot	ext4 / xfs	—
/	xfs	—
/home	xfs	nodev,nosuid
/tmp	xfs	nodev,nosuid,noexec
/var	xfs	nodev,nosuid
/var/tmp	xfs	nodev,nosuid,noexec
/var/log	xfs	nodev,nosuid,noexec
/var/log/audit	xfs	nodev,nosuid,noexec
swap	swap	—

The separate-filesystem layout that DISA STIG and CIS benchmarks require — already in place, so the profile you apply has less to remediate.

How It Works

1

Pick your OS

Choose from the RHEL family (Rocky / Alma / BYOL RHEL 8–10), Ubuntu 24.04 or 26.04, or Amazon Linux 2023. x86_64 and arm64. The Base catalog above links each image to its AWS Marketplace listing. Contact us with questions, or browse our seller profile.

2

Launch

EC2 injects your key pair on first boot via cloud-init. Connect as ubuntu or ec2-user over SSH with key-based auth. No password logins, no pre-installed keys.

3

Apply your profiles

Run your own Ansible, OpenSCAP remediation, or auditd rules on a base that already carries the STIG layout — nothing to undo first.

StigReady Applied

Remediated, scored, and provable

The number your auditor asks for — published with every image. We score against the raw, unmodified SSG profile in-build.

Applied overview · scores and filters below

StigForge roles

Remediation is driven by StigForge — public CIS / STIG Ansible roles generated from the SSG datastream. Each release pins its factory commit and SSG version; the OpenSCAP score comes from the StigReady Applied image build that bakes it, never from a container; evidence is available on request.

Scored in-build

Every image is scored against the raw, unmodified SSG profile during the build — not after, not on a different host. A 90% floor and a no-regression ratchet gate every release.

Evidence bundle

Every image has an OpenSCAP ARF result, an HTML report, a POA&M and an SBOM, and every image except RHEL 10 has a CVE scan. They are available from support@stigready.com on request.

FIPS mode on STIG images

DISA STIG images run with FIPS mode enabled, using the OS vendor's FIPS cryptographic modules.

Boot-verified on Nitro EC2

Every image boots on a real EC2 Nitro instance as a build gate. If it doesn't boot clean and pass the scan, it doesn't ship.

Applied Scores

All scores as of the latest published catalog · scored against the raw, unmodified SSG profile

OS	Arch	Baseline	Score	FIPS	Availability
Loading catalog…

BYOL — Red Hat Enterprise Linux images require you to supply your own Red Hat subscription. StigReady does not provide Red Hat commercial licenses.

StigForge

Public Ansible roles

Public CIS and STIG role exports, generated from the raw SSG profile and pinned by immutable tag. Scores are measured by OpenSCAP on the StigReady Applied image built with the role version shown next to each score, and published on this page; evidence is available from support@stigready.com on request. How-tos: Base + roles →

Roles

Public under github.com/stigready.

Loading…

Scores

Measured by OpenSCAP against the raw SSG profile on the StigReady Applied image build, for the role version shown; not in the role repo.

Role	Profiles	Repo
Loading…

Role repos are public. The factory monorepo that builds them stays private.

stigvalidated Coming soon

A second set of tests for each StigForge role: a CINC Auditor test for each SSG rule the role applies that has an OVAL check, written from that check.

When it ships, each hardened image will have its rule-by-rule comparison of these tests with the OpenSCAP scan published, and the test profiles for each role will be public. Nothing is published yet.

Pricing

Software fee on top of your normal EC2 costs. StigReady Base is on AWS Marketplace. StigReady Applied listings are coming soon, so its price below is the planned price.