Announcing the Chainguard Compliance Dashboard

Organizations operating under FedRAMP, Department of Defense (DoD) ATO mandates, or other highly regulated sector requirements across financial services, healthcare, and critical infrastructure face a growing compliance burden. Security leaders, ISSOs, and compliance managers must continuously prove that the software deployed in their environments complies with DISA Security Technical Implementation Guides (STIGs) and FIPS 140-3 cryptography.

A generic compliance label on a container image is no longer sufficient for security reviews or audits. Regulators and auditors demand verifiable, digest-level proof.

Today, we are announcing the General Availability (GA) of the Compliance Dashboard in the Chainguard Console. The Compliance Dashboard gives security, compliance, and engineering teams centralized, direct visibility into DISA General Purpose OS SRG scan results and FIPS 140-3 evidence for Chainguard FIPS Containers.

Instead of requiring teams to manually run scanners, parse complex output, and assemble evidence packages for auditors, the Compliance Dashboard reflects status updates with every image build, downloadable reports, and exportable receipts down to the exact image digest.

Eliminate manual evidence collection for FedRAMP and ATOs

Proving software compliance in regulated environments traditionally requires significant manual overhead:

• Evidence collection is slow and fragmented: Security and compliance teams must assemble scan reports, trace cryptographic dependencies, and map certificates across hundreds of running container tags.

• Third-party scanners lack context: External vulnerability and compliance scanners inspect software from the outside. They often misinterpret underlying cryptographic boundaries or produce noisy, unverified findings.

• Audits require granular provenance: Compliance frameworks require teams to prove compliance for the exact image tag, architecture, and digest running in production, not a generic baseline.

The Compliance Dashboard solves this challenge by providing direct, verifiable insight into the underlying compliance substrate of Chainguard Containers.

Direct visibility into DISA STIGs and FIPS 140-3 evidence

Because Chainguard owns the compliance substrate behind its images — including the cryptographic modules, image hardening, and remediation processes — the Compliance Dashboard delivers direct, validated compliance status rather than third-party estimations.

1. DISA GPOS SRG Scan Results & XCCDF Export

The dashboard surfaces DISA STIG scan results evaluated against the DISA General Purpose Operating System Security Requirements Guide (GPOS SRG) in alignment with our DISA STIG Commitment. Teams can inspect scan details directly in the console or download standard XCCDF (Extensible Configuration Checklist Description Format) reports to attach directly to FedRAMP package submission materials or ATO documentation.

2. Cryptographic and Entropy Provenance

For FIPS-enabled images, the dashboard details which validated FIPS modules supply cryptography and entropy for that specific build. Teams can inspect active FIPS 140-3 certificate numbers and entropy-source certificates, establishing clear cryptographic provenance for auditors.

3. Digest-Level Validation Receipts

Audits require precise verification. The Compliance Dashboard allows teams to export signed validation receipts tied directly to the exact image tag, architecture, and digest evaluated in their pipeline.

How to use the Compliance Dashboard

Using the dashboard fits directly into existing platform engineering and compliance workflows:

1. Navigate to the Image: Open any container image inside the Chainguard Console.

2. Select the Compliance Tab: View the overall status, along with the specific tag, architecture, and digest.

3. Inspect & Export: Review the DISA GPOS SRG compliance status, view associated FIPS 140-3 certificate details, download XCCDF reports, and export validation receipts for security reviews.

What’s next: Custom Assembly support and organization-wide views

Custom Assembly support is planned as a fast follow. This will allow organizations using Chainguard Custom Assembly to extend the same digest-level compliance visibility, STIG reports, and cryptographic receipts to their customized container images. Additionally, Chainguard will introduce an organization-wide compliance dashboard, providing consolidated visibility across all images and product entitlements.

Get started today

The Compliance Dashboard is available today for all Chainguard Console users.

To explore compliance details for your images, log in to the Chainguard Console or speak with our public sector and compliance specialists to learn how Chainguard simplifies FedRAMP and ATO readiness.