# AlmaLinux OS 9 gains free DISA STIG automation in ComplianceAsCode

> **Key takeaway:** TuxCare contributed an open-source DISA STIG compliance profile for AlmaLinux OS 9 to ComplianceAsCode, enabling automated security scanning via OpenSCAP with 434 of 439 checks automated.

**Published:** 2026-10-27T04:02:08.376459+00:00 
**Source:** AlmaLinux Blog 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/almalinux-os-9-gains-free-disa-stig-automation-in-compliance.html 

## Summary
TuxCare has upstreamed a free DISA STIG automation profile for AlmaLinux OS 9 to the ComplianceAsCode project, which maintainers merged on October 20, 2026. The profile will ship in ComplianceAsCode 0.1.83 on November 26, 2026, and allows administrators to run automated OpenSCAP scans against the Defense Information Systems Agency's Security Technical Implementation Guide rather than manually verifying hundreds of requirements.

The profile covers STIG version V1R8 with 439 total requirements, of which 434 have automated checks. Two require human review, one remains pending, and two reference packages (quagga and ypserv) absent from AlmaLinux OS 9. ComplianceAsCode also generates corresponding Bash remediation scripts and Ansible playbooks. However, achieving a full passing STIG result requires TuxCare's Extended Security Updates (ESU) and FIPS 140-3 validated packages, as the STIG mandates FIPS cryptography and the TuxCare ESU repository specifically.

## STIG profile coverage and automation details
- **STIG version and scope:** The profile implements DISA STIG V1R8 for AlmaLinux OS 9, with a controls file enumerating 439 discrete requirements across severity categories CAT I through CAT III.
- **Automated check coverage:** 434 of 439 requirements have automated checks; the remainder include two requiring manual review, one pending implementation, and two referencing non-existent packages (quagga, ypserv).
- **OpenSCAP integration:** The profile integrates with OpenSCAP via the SCAP Security Guide datastream, producing XCCDF evaluation results and HTML reports; remote security advisory checking requires the `--fetch-remote-resources` flag.
- **Remediation artifacts:** ComplianceAsCode generates Bash scripts and Ansible playbooks from the profile, including fixes for enabling the TuxCare ESU repository on licensed systems.
- **Full compliance dependency:** Passing the complete STIG requires TuxCare ESU for AlmaLinux 9.2 or 9.6 with FIPS 140-3 validated packages, as ALMA-09-004310 mandates the TuxCare ESU repository and FIPS cryptography is mandatory under the STIG.

## Why it matters
This contribution gives AlmaLinux OS 9 a fully open-source compliance pathway alongside commercial scanners like Tenable Nessus, reducing barriers for defense contractors, government agencies, and security-conscious enterprises that standardize on DISA STIG hardening. For the broader RHEL-compatible ecosystem, it demonstrates how downstream rebuilds can achieve parity with RHEL 9's existing ComplianceAsCode STIG coverage while clarifying the boundary between community-supported and commercially-supported compliance artifacts.