Blog · 2026-07-30

StigReady Base + StigForge roles

StigReady Base gives you the STIG disk layout and cloud hardening. StigForge gives you public, OpenSCAP-verified Ansible roles for CIS and DISA STIG. Together they are the bring-your-own remediation path. For a pricing-focused comparison, see Base vs Applied.

The two paths

StigReady Applied — a CIS or STIG AMI that is already remediated, scored in-build, and ships an evidence bundle. See Applied and the score table.
StigReady Base + StigForge — run Base, then a public role from github.com/stigready in your own playbooks or image bake. You control when remediation runs and how you re-score.

Use Base + roles when you already have Ansible pipelines, need to tune exceptions, or want the same role in Packer that you run on fleets. Use Applied when you want the score and evidence on day one without wiring OpenSCAP yourself.

What Base already did for you

Every Base AMI is built from the official OS ISO, patched at bake, and boot-tested on Nitro EC2. The STIG partition layout (/home, /tmp, /var, /var/log, /var/log/audit, /var/tmp) is applied at install — that layout is painful to retrofit later. SSH is key-only; IMDSv2 is enforced; SSM Agent is present. Details: STIG disk layout that won't fight you.

Start from the Base catalog on stigready.com. AWS Marketplace listings are rolling out — watch the seller page or contact us for early access. RHEL images are BYOL — you bring a Red Hat subscription.

What StigForge roles add

Each public role repo (*-cis / *-stig) is a Galaxy-style Ansible role plus immutable OpenSCAP evidence under compliance/releases/. Factory CI verifies against the raw, unmodified SSG profile with a 90% floor. Published scores live on stigready.com/#stigforge.

Install with a pinned tag (example: v0.2.4-private-review). Do not float on main.

Hands-on next

More how-tos will land on the blog as we publish them.

Questions? contact@stigready.com