AvailableBase tier
Kapstone Hardened AlmaLinux 9
A citable baseline: STIG applied, FIPS enabled, exceptions documented, evidence pack per release. Suitable as a target for existing configuration management.
from $0.04/hr
Hardened Images/Sectors/Defense and CMMC
CMMC Level 2 and NIST SP 800-171
Hardened Images for Defense Contractors
For prime and subcontractors that must demonstrate hardened Linux hosts to a CMMC assessor with documentary evidence.
Requirements
The situation this sector typically faces
A CMMC Level 2 assessment requires evidence rather than intent. NIST SP 800-171 families 3.13 (System and Communications Protection) and 3.14 (System and Information Integrity) expect documented configuration baselines, FIPS-validated cryptography for CUI in transit and at rest, and a managed process for flaw remediation.
Smaller contractors typically have one or two staff able to harden Linux, and those staff also operate everything else. A STIG applied manually is difficult to defend months later during assessment.
Assessors work from .ckl checklists, POA&Ms and SBOMs. A per-release evidence pack in those formats reduces assessment preparation.
Baseline
Controls on every image
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
- Monthly rebuilds with current security updates
Each release includes the evidence pack: OpenSCAP results, a DISA-format .ckl, a CycloneDX SBOM and the exceptions list. See Compliance.
Applicable images
Recommended starting points
Next in developmentPremium tier
Kapstone Hardened Bastion
A single audited, MFA-protected access point into the enclave with session recording, replacing exposed RDP or shared VPN credentials.
from $0.40/hr
In testingStandard tier
Kapstone Hardened SFTP + Control Panel
Key-only, chrooted file exchange with primes and partners, with cloud storage attached as folders and all administrative actions logged.
from $0.15/hr
Acquisition
Purchasing route
Available through Azure Marketplace, with AWS Marketplace to follow, under the contractor's existing cloud agreement; no new vendor onboarding is required. Private offers are available for primes seeking fixed annual pricing or coverage of subcontractors. Azure Government and AWS GovCloud regions are planned.
Listing coming soon. Azure Marketplace first; AWS Marketplace to follow. Azure Government and AWS GovCloud regions are planned.
Scope of claims
These images provide hardened hosts with documented evidence toward NIST SP 800-171 and CMMC Level 2 controls. They do not make an enclave compliant on their own; the system boundary, policies, personnel and remaining stack must also be in place.
Support: best-effort next-business-day by email is included; paid priority support is available. Custom builds are consulting engagements, quoted separately.
Contact Kapstone Systems
Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.
Email: info@kapstone.systems