Home STIG questions Why is my SCAP or automation content behind the latest STIG release?

Why is my SCAP or automation content behind the latest STIG release?

Last updated on Nov 11, 2026

Scanning and hardening projects update their content after DISA publishes a new STIG release. That means your SCAP profile or Ansible role can trail the latest STIG by one or more releases. Match your checklist to the release your content targets, or plan for loosely matched results.

Example

As of 30 Sep 2026, DISA's latest releases include:

  • Canonical Ubuntu 22.04 LTS: Version 2 Release 10 (V2R10).
  • Canonical Ubuntu 24.04 LTS: Version 1 Release 7 (V1R7).
  • Red Hat Enterprise Linux 9: Version 2 Release 10 (V2R10).
  • Red Hat Enterprise Linux 10: Version 1 Release 3 (V1R3).

The ComplianceAsCode v0.1.82 release notes from 1 Sep 2026 update RHEL 9 to V2R9 and RHEL 10 to V1R2. Content from that release is one release behind for both. Ansible Lockdown aims to merge a new tagged release 2 to 4 weeks after a new benchmark comes out.

Steps

  1. Find the release your content targets. Check the project's release notes, or the benchmark version in the profile or branch name.
  2. Look up DISA's latest release for the same product in a STIG catalog.
  3. Download the STIG release that matches your scan content and build your checklist from it. Iron Bank's guide notes that the STIG version must match the version of the SCAP profile.
  4. Import the XCCDF results. STIG Viewer reports results that match Rule ID and revision, results that match Rule ID only, and results that match nothing.
  5. If you must use the newest checklist, review the results that match on Rule ID only before you accept them.

Common problems

  • Many results land as Not Reviewed. The Rule IDs or revisions differ between the scan content and the checklist. Build the checklist from the matching release.
  • A whole release is missing. Some projects skip releases or are still working on them. Ask in the project's discussion forum.

Related

Sources