<div dir="ltr"><p class="MsoNormal" style="margin:0in 0in 14pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt">Product:</span></b><span style="font-size:12pt;font-family:Arial,sans-serif"><br>
</span><span lang="EN" style="font-size:12pt;color:rgb(41,42,46)">BigFix Compliance</span><span style="font-size:12pt;font-family:Arial,sans-serif"></span></p>
<p class="MsoNormal" style="margin:14pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt">Title:</span></b><span style="font-size:12pt;font-family:Arial,sans-serif"><br>
</span><span lang="EN" style="font-size:12pt;color:rgb(41,42,46)">Updated DISA STIG Checklist for RHEL 8 with bugfixes</span><span style="font-size:12pt;font-family:Arial,sans-serif"></span></p>
<p class="MsoNormal" style="margin:14pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt">Security Benchmark:</span></b><span style="font-size:12pt;font-family:Arial,sans-serif"><br>
</span><span lang="EN" style="font-size:12pt;color:rgb(41,42,46)">DISA Red Hat Enterprise Linux 8, V2R7</span><span style="font-size:12pt;font-family:Arial,sans-serif"></span></p>
<p class="MsoNormal" style="margin:14pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span lang="EN" style="font-size:12pt">Published Sites:</span></b><span style="font-size:12pt;font-family:Arial,sans-serif"><br>
</span><span lang="EN" style="font-size:12pt;color:rgb(41,42,46)">DISA STIG Checklist for RHEL 8, site version 29<br>
(The site version is provided for air-gap customers.)</span><span style="font-size:12pt;font-family:Arial,sans-serif"></span></p>
<p class="MsoNormal" style="margin:12pt 0in;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt;line-height:107%">Updated Fixlets:</span></b></p>
<p class="MsoNormal" style="margin:12pt 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">A
separate RHEL 8 filesystem must be used for the /tmp directory</span></p>
<p class="MsoNormal" style="margin:12pt 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must disable mounting of cramfs</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must use cryptographic mechanisms to protect the integrity of audit tools</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 remote X connections for interactive users must be disabled unless to fulfill
documented and validated mission requirements</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must not allow users to override SSH environment variables</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">All
RHEL 8 local initialization files must have mode 0740 or less permissive</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must be a vendor-supported release</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must disable the transparent inter-process communication (TIPC) protocol</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 passwords must have a 24 hours/1 day minimum password lifetime restriction in
/etc/shadow</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must use a separate file system for /var/tmp</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must disable IEEE 1394 (FireWire) Support</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 must disable the stream control transmission protocol (SCTP).</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 Bluetooth must be disabled</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">All
RHEL 8 remote access methods must be monitored</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">RHEL
8 operating systems booted with a BIOS must require a unique superusers name
upon booting into single-user and maintenance modes</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">Additional
details:</span></b></p>
<p class="MsoNormal" style="margin:12pt 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">Both
analysis and remediation checks are included.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">Some
of the checks allow you to use the parameterized setting to enable
customization for compliance evaluation. Note that parameterization and
remediation actions require the creation of a custom site.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">Improved
a few checks by adding the pending restart feature to them. The pending restart
feature works in the following ways:</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt"> The action results will show “Pending Restart”
instead of “Fixed” for those checks which require OS reboot.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">The
check will show relevant for those endpoints until they are rebooted.</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">Post
reboot of the endpoint the action results will show as “Fixed” and the check
will be compliant.</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt"> </span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt">Action to take:</span></b><span style="font-size:12pt"></span></p>
<p class="MsoNormal" style="margin:12pt 0in 0in 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">To
subscribe to the above site, you can use the License Overview Dashboard to
enable and gather the site. Note that you must be entitled to the BigFix
Compliance product and you must be using BigFix version 10.0.0 and later.</span><span style="font-size:12pt"></span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">If
you use custom sites, update your custom sites accordingly to use the latest
content. You can synchronize your content by using the Synchronize Custom
Checks wizard. For more information, see </span><span style="color:black"><a href="https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html"><span style="font-size:12pt;color:rgb(0,136,204);text-decoration:none">Using
the Synchronize Custom Checks wizard</span></a></span><span style="font-size:12pt"></span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><b><span style="font-size:12pt">More information:<br>
</span></b><span style="font-size:12pt">To know more about the
BigFix Compliance SCM checklists, please see the following resources:</span></p>
<p class="MsoNormal" style="margin:12pt 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">BigFix
Forum:</span></p>
<p class="MsoNormal" style="margin:12pt 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="color:black"><a href="https://forum.bigfix.com/c/release-announcements/compliance/63"><b><span style="font-size:12pt;color:rgb(0,136,204);text-decoration:none">Compliance
(Release Announcements)</span></b></a></span><span style="font-size:12pt"></span></p>
<h3 style="margin:0in 0in 19pt 4pt;text-indent:32pt;line-height:120%;break-after:auto;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:14pt;font-family:Calibri,sans-serif"><a name="_qm0gwdfm38jq"></a><span style="font-size:12pt;line-height:120%">This category is used
by HCL to announce new releases for BigFix Compliance.</span></h3>
<p class="MsoNormal" style="margin:12pt 0in 12pt 0.5in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt">BigFix
Compliance SCM Checklists:</span></p>
<h3 style="margin:0in 0in 19pt 4pt;text-indent:32pt;line-height:120%;break-after:auto;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:14pt;font-family:Calibri,sans-serif"><a name="_p9gac39c245c"></a><span style="color:black"><a href="https://forum.bigfix.com/c/release-announcements/scm-checklists/86"><span style="font-size:12pt;line-height:120%;color:rgb(0,136,204);text-decoration:none">SCM Checklists</span></a></span><span style="font-size:12pt;line-height:120%;color:rgb(0,136,204);font-weight:normal"></span></h3>
<p class="MsoNormal" style="margin:12pt 0in 11pt 40pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">This category is the central reference
for all SCM Checklists supported by BigFix Compliance. It covers the complete
list of active checklists across all supported frameworks and platforms,
including CIS, DISA STIG, PCI DSS, NIST, and more, along with site name,
version details, and supported OS versions.</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt">We hope you find this latest release of
SCM content useful and effective. Thank you!<br>
<i>– The BigFix Compliance team</i></span></p></div>