AvailableBase tier
Kapstone Hardened AlmaLinux 9
The hardened operating system for agency applications, with 433 STIG checks passing, zero CAT I findings and an evidence pack for the ATO package.
from $0.04/hr
Hardened Images/Sectors/Federal
Civilian and defense agencies
Hardened Images for Federal Agencies
For federal programs that require STIG-hardened Linux on FedRAMP-authorized cloud regions, acquired through existing contract vehicles.
Requirements
The situation this sector typically faces
An ATO package expects DISA STIGs applied and evidence in the formats the ISSO and eMASS workflow already use. A .ckl and SBOM per release remove a recurring manual task.
Workloads carrying federal data belong in FedRAMP-authorized cloud environments. These images run on Azure and AWS; Azure Government and AWS GovCloud regions are planned.
Acquisition is its own effort. Marketplace purchases through the agency's cloud contract or an authorized reseller avoid new vendor onboarding.
Baseline
Controls on every image
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
- Monthly rebuilds with current security updates
Each release includes the evidence pack: OpenSCAP results, a DISA-format .ckl, a CycloneDX SBOM and the exceptions list. See Compliance.
Applicable images
Recommended starting points
In testingPremium tier
Kapstone Hardened OCR
Records digitization and inbound document processing that remains within the authorization boundary.
from $0.40/hr
In testingPremium tier
Kapstone Hardened FHIR Server
A FHIR R4 repository for federal health programs and their state partners.
from $0.40/hr
Acquisition
Purchasing route
Available on Azure Marketplace first, with AWS Marketplace to follow. Purchase through the agency's existing cloud agreement or authorized reseller. Private offers are available for agency-wide or multi-year terms. Azure Government and AWS GovCloud regions are planned; agencies that require a specific region are asked to indicate it so it can be prioritized.
Listing coming soon. Azure Marketplace first; AWS Marketplace to follow. Azure Government and AWS GovCloud regions are planned.
Scope of claims
Kapstone images are not FedRAMP-authorized products; FedRAMP authorization applies to the cloud services on which they run. The images provide hardened, documented hosts toward the agency's own ATO. The ISSO retains ownership of the package.
Support: best-effort next-business-day by email is included; paid priority support is available. Custom builds are consulting engagements, quoted separately.
Contact Kapstone Systems
Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.
Email: info@kapstone.systems