AvailableBase tier
Kapstone Hardened AlmaLinux 9
The hardened operating system alone, for organizations deploying their own applications.
from $0.04/hr software fee, Small instance
Kapstone Hardened Images
Hardened AlmaLinux 9 Images for Federal, State and Local Government and Regulated Industry
DISA STIG applied. FIPS mode enabled. Evidence pack with every release. Priced per hour through Azure Marketplace and AWS Marketplace.
Kapstone Systems provides AlmaLinux 9 virtual machine images with the DISA STIG profile applied, FIPS mode enabled, SELinux enforcing, and a complete evidence pack issued with each monthly release. Images are acquired through existing cloud marketplace agreements and support ATO, CMMC and audit documentation requirements.
Product catalog
Five images on one hardened base
Every image is built from the same STIG-applied, FIPS-enabled AlmaLinux 9 and ships with the same evidence pack. Each application image adds a single function.
In testingStandard tier
Kapstone Hardened SFTP + Control Panel
Managed file exchange with external parties, with an administrative console suitable for help-desk operation.
from $0.15/hr software fee, Small instance
In testingPremium tier
Kapstone Hardened OCR
Document OCR for scanned PDFs, faxes and forms, processed entirely within the customer's virtual machine.
from $0.40/hr software fee, Small instance
Next in developmentPremium tier
Kapstone Hardened Bastion
Browser-based SSH, RDP and VNC access to cloud networks without a VPN client or internet-exposed RDP.
from $0.40/hr software fee, Small instance
In testingPremium tier
Kapstone Hardened FHIR Server
A FHIR R4 repository for health departments and health information exchanges, without vendor lock-in.
from $0.40/hr software fee, Small instance
Planned additions
A secrets server (OpenBao) and a log collector / SIEM (Wazuh) are planned following the five images above. Product pages are not yet published. Organizations with a requirement for either may request notification.
Hardening baseline
Controls applied to every image
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
- Monthly rebuilds with current security updates
A plain-language explanation of each control is provided on the Compliance page.
Evidence pack
Documentation issued with every release
- OpenSCAP scan results
- Automated STIG scan output from the exact build deployed.
- DISA-format .ckl checklist
- Opens in DISA STIG Viewer and can be provided directly to an assessor or ISSO.
- SBOM (CycloneDX)
- A software bill of materials listing every package and version on the image.
- Documented exceptions list
- Each open STIG item, the reason it remains open, and the mitigating control. Suitable as POA&M input.
Acquisition
How purchasing works
Cloud marketplace
Azure Marketplace first; AWS Marketplace to follow. Marketplace charges appear on the existing cloud invoice and are generally eligible toward Microsoft Azure Consumption Commitment (MACC) and AWS Enterprise Discount Program (EDP) commitments. Listings are not yet live; request notification.
Free trial
One month on Azure; 30 days on AWS. The customer pays the cloud provider for the virtual machine; the software fee is waived during the trial period.
Hourly pricing or private offer
A per-hour software fee by instance size. Agencies, primes and organizations requiring a fixed annual price may request a private offer through the marketplace. See Procurement.
Government regions
Azure Government and AWS GovCloud regions are planned. Organizations requiring a specific region are asked to indicate it so it can be prioritized.
Sectors served
Information by sector
Each page describes the sector's requirements, the two or three images that apply, and the applicable purchasing route.
Defense Contractors
CMMC Level 2 and NIST SP 800-171
State and Local Government
State agencies, counties, public health departments
Federal Agencies
Civilian and defense agencies
Regulated Private Sector
Health systems, financial services, insurance, energy
Universities and Research Computing
Research computing, sponsored programs, CUI on grants
Pricing
Three tiers, priced per hour
Larger instances are priced per core; clusters of three or more receive a discount; annual private offers are available. See Pricing for detail and the free trial.
Base
from $0.04/hr
Small instance (≤2 vCPU). Software fee in addition to the cloud VM cost. Launch range $0.04–$0.10/hr; final listing prices are set at launch.
Images: Hardened AlmaLinux 9 (Base)
Standard
from $0.15/hr
Small instance (≤2 vCPU). Software fee in addition to the cloud VM cost. Launch range $0.15–$0.40/hr; final listing prices are set at launch.
Images: Hardened SFTP + Control Panel
Premium
from $0.40/hr
Small instance (≤2 vCPU). Software fee in addition to the cloud VM cost. Launch range $0.40–$1.00/hr; final listing prices are set at launch.
Images: Hardened OCR, Hardened Bastion (Apache Guacamole), Hardened FHIR Server
Cloud cost and security services
Lower cloud spending and a monthly view of security posture
For agencies already running Azure or AWS, Kapstone Systems provides a flat-fee monthly retainer that reduces cloud spending and reports security posture, priced below the savings it identifies. Engagements begin with a no-cost snapshot.
- Snapshot
- No cost. A 30-minute review of the agency's own cost and security dashboards; no credentials are shared.
- Assessment
- $4,500 fixed. Refunded if annual savings identified are less than twice the fee.
- Retainer
- From $2,000 per month. Monthly cost and posture reports and hands-on remediation.
Company
About Kapstone Systems
Kapstone Systems is an information technology consultancy based in New Mexico. The firm was founded by a cloud and systems architect with more than 25 years in IT, including Azure cloud infrastructure and data modernization work for a state health department and REDCap and web-stack administration in a university regulated environment subject to 21 CFR Part 11.
The firm holds AWS and Microsoft Azure certifications and has direct experience in healthcare interoperability (FHIR and HL7v2), public health informatics and HIPAA/HITECH environments. Kapstone Hardened Images apply that experience to a repeatable product: a documented, hardened operating system that customers can acquire through existing cloud agreements.
A one-page capability statement is available in the standard federal format.
Company data
| Legal name | Kapstone Systems |
|---|---|
| Location | New Mexico, United States |
| UEI | [TBD] |
| CAGE code | [TBD] |
| DUNS | [TBD] |
| NAICS codes | [TBD] — suggested: 541512 (Computer Systems Design Services), 541519 (Other Computer Related Services), 513210 (Software Publishers) |
| Small business status | [TBD] |
| Contact | info@kapstone.systems |
Items marked [TBD] are pending registration and will be populated prior to listing.
Frequently asked questions
Common questions
Do these images make an organization STIG or CMMC compliant?
No product does. The images provide hosts with the DISA STIG applied, FIPS mode enabled, and evidence demonstrating both. Compliance is a property of the complete system and the organization. The images complete a defined portion of that work and document it.
Why AlmaLinux 9?
AlmaLinux 9 is a community-governed, RHEL-compatible distribution with a published DISA STIG and a FIPS crypto policy, available without a per-host subscription. Customers receive a hardening profile the government already recognizes without a license fee in addition to the software fee.
How do customers authenticate?
With their own SSH key, supplied at launch. An RSA key is required; ed25519 keys are rejected when FIPS mode is enabled. Password authentication is disabled.
Can the image be modified after deployment?
Yes. The virtual machine belongs to the customer. The evidence pack describes the image as shipped; subsequent changes are the customer's to document. Modified images built and maintained by Kapstone Systems are consulting work and are quoted separately.
What support is included?
Best-effort next-business-day support by email is included with every image. Paid priority support is available.
What is the release cadence?
Every image is rebuilt monthly with current security updates, rescanned, and republished with a new evidence pack. Customers choose when to move to the new version.
Are the images FedRAMP authorized?
No. FedRAMP authorization applies to cloud services; Microsoft and AWS hold those authorizations for their platforms and government regions. The images are built to run within those environments and provide documented hardening toward the customer's own ATO.
Contact Kapstone Systems
Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.
Email: info@kapstone.systems