AvailableBase tier
Kapstone Hardened AlmaLinux 9
A documented hardened operating system for per-grant enclaves and research virtual machines, with evidence the research security officer can file.
from $0.04/hr
Hardened Images/Sectors/Universities
Research computing, sponsored programs, CUI on grants
Hardened Images for Universities and Research Computing
For research computing groups and sponsored programs offices whose awards now carry CUI requirements.
Requirements
The situation this sector typically faces
DFARS and NIST SP 800-171 clauses on federal awards require a hardened enclave for covered data, and central IT is asked to produce one for each affected grant.
Research computing staff are allocated across clusters, storage and support. The image carries the STIG and FIPS work so staff can support researchers.
Collaborators and sponsors send and receive data. The transfer path must be documented and auditable, and most collaborators are limited to SFTP.
Baseline
Controls on every image
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
- Monthly rebuilds with current security updates
Each release includes the evidence pack: OpenSCAP results, a DISA-format .ckl, a CycloneDX SBOM and the exceptions list. See Compliance.
Applicable images
Recommended starting points
In testingStandard tier
Kapstone Hardened SFTP + Control Panel
Data transfer with collaborators and sponsors: key-only, chrooted, quota-limited, logged, with laboratory storage attached as folders.
from $0.15/hr
Next in developmentPremium tier
Kapstone Hardened Bastion
Recorded, MFA-protected access into the enclave for researchers and IT staff, without exposed RDP or distributed VPN accounts.
from $0.40/hr
Acquisition
Purchasing route
Available through Azure Marketplace, with AWS Marketplace to follow, under the institution's cloud agreement; many institutions purchase through an education cloud program. Private offers are available for campus-wide or multi-grant terms. Free trial: one month on Azure, 30 days on AWS.
Listing coming soon. Azure Marketplace first; AWS Marketplace to follow. Azure Government and AWS GovCloud regions are planned.
Scope of claims
These images provide hardened, documented hosts toward NIST SP 800-171 and CUI requirements on sponsored awards. The system security plan, boundary and personnel complete the picture.
Support: best-effort next-business-day by email is included; paid priority support is available. Custom builds are consulting engagements, quoted separately.
Contact Kapstone Systems
Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.
Email: info@kapstone.systems