Home STIG questions What is the difference between DISA STIGs and CIS Benchmarks?

What is the difference between DISA STIGs and CIS Benchmarks?

Last updated on Nov 11, 2026

DISA STIGs and CIS Benchmarks are both security configuration baselines. They come from different authors and are required in different settings. If a contract, authorizing official or auditor names one, use that one.

Who writes them

  • DISA STIGs. The Defense Information Systems Agency publishes Security Technical Implementation Guides. They are released with a public domain license and are used by public and private organizations.
  • CIS Benchmarks. The Center for Internet Security builds them with a community of experts. They are vendor agnostic and consensus based.

Both are widely used to support compliance programs such as PCI DSS, HIPAA, SOC 2 and NIST.

How they differ in practice

  • Format and tools. DISA publishes STIGs in XCCDF format. DISA STIG Viewer opens them, builds checklists and imports SCAP or XCCDF scan results. STIG Viewer also displays CCI references when a STIG includes them.
  • Same setting, different value. Scanning projects such as ComplianceAsCode keep one library of technical rules. A STIG profile and a CIS profile group those rules and can set different values for the same setting, such as minimum password length.
  • Separate profiles. A single SCAP data stream can hold both. Run oscap info on the file to list its profiles, for example a CIS profile and a DISA STIG profile.
  • Separate automation. Ansible Lockdown ships separate CIS and STIG roles. Its audit content is tied to each benchmark release.

Choosing one

  1. Check your contract, system security plan or audit scope. If you support a DOD system, ask whether STIGs are required.
  2. If nothing is required, pick the baseline your scanner and remediation tools support for your platform.
  3. Do not mix profiles on one system unless you track which requirement each setting satisfies.

Sources