Hardened Images for Regulated Private Sector

For organizations whose HIPAA, SOC 2, PCI DSS or NERC CIP assessors request hardening evidence that engineering staff currently assemble by hand.

Requirements

The situation this sector typically faces

Each audit cycle, staff export a hardening report, explain the same exceptions and defer automation to the following year. A monthly rebuild with a fresh evidence pack reduces that effort.

Partners and customers transmit files, and SFTP with per-user keys and audit logging remains the most widely supported mechanism.

Vendor and contractor access to production is a recurring assessment question. A recorded, MFA-protected bastion provides a clear answer.

Baseline

Controls on every image

AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
SELinux in enforcing mode
fapolicyd application allow-listing
auditd configured with the STIG audit rule set
Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
Monthly rebuilds with current security updates

Each release includes the evidence pack: OpenSCAP results, a DISA-format .ckl, a CycloneDX SBOM and the exceptions list. See Compliance.

Applicable images

Recommended starting points

In testingStandard tier

Kapstone Hardened SFTP + Control Panel

Customer and partner file exchange with chrooted users, key authentication, quotas, administrator MFA, a complete administrative audit trail and cloud storage attached as folders.

from $0.15/hr

Next in developmentPremium tier

Kapstone Hardened Bastion

Browser-based, recorded, MFA-protected access for staff and vendors. No VPN client; no exposed RDP.

from $0.40/hr

In testingPremium tier

Kapstone Hardened OCR

Claims, intake forms, faxed referrals and scanned contracts made searchable without per-page fees or an external data processor.

from $0.40/hr

Acquisition

Purchasing route

Available through Azure Marketplace, with AWS Marketplace to follow, billed through the existing cloud account. Marketplace spend is generally eligible toward MACC or EDP commitments. Private offers are available for annual terms and clusters. Free trial: one month on Azure, 30 days on AWS.

Listing coming soon. Azure Marketplace first; AWS Marketplace to follow. Azure Government and AWS GovCloud regions are planned.

Listing coming soon — get notified Procurement options

Scope of claims

These images provide hardened, documented hosts that map to the configuration management and access control requirements examined in HIPAA, SOC 2 and PCI DSS assessments. They do not make an organization compliant by themselves.

Support: best-effort next-business-day by email is included; paid priority support is available. Custom builds are consulting engagements, quoted separately.

Contact Kapstone Systems

Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.

Start a Conversation Request listing notification

Email: info@kapstone.systems