‍CHAINGUARD DISA STIG COMMITMENT

1. Definitions 

1.1. “CAT I” means the category code for any vulnerability, which when exploited, will directly and immediately result in the loss of confidentiality, availability, or integrity. These risks are most severe.

1.2. “CAT II” means category code for any vulnerability, which when exploited, has a potential to result in loss of confidentiality, availability, or integrity.

1.3. “CAT III” means category code for any vulnerability, which when exploited, degrades measures to protect against loss of confidentiality, availability, or integrity.

2. Introduction

2.1. The Defense Information Systems Agency Security Technical Implementation Guide (“DISA STIG”) provides technical guidelines that are used by the U.S. Department of Defense (DoD) to secure information systems and software, and includes recommendations for hardening infrastructure and applications against cyber threats. DISA STIGs aim to ensure software and infrastructure meet rigorous security requirements, helping to protect data and systems from cyberattacks. Capitalized terms used, but not defined in this DISA STIG Commitment, have the meanings ascribed in the Agreement (as defined in such Order). 

3. About Chainguard’s STIG Compliance Efforts

3.1. Chainguard is committed to:

1. providing secure, minimal container images that align with the DISA STIG General Purpose Operating System (“GPOS”) Security Requirements Guide (“SRG”); and

2. ensuring the foundational layer (the operating system, applications, and configuration of the images themselves) meet the same guidelines. 

3.2.  The specific configurations and management of these applications are the sole responsibility of the customer as Chainguard is not the owner or maintainer of the web server, application server, database, or other applications that customers deploy as container images.

4. Chainguard DISA STIG Commitment

4.1. Chainguard represents and warrants that it will use commercially reasonable efforts to provide the following for a subset of Chainguard’s published collection of Containers: Use STIG Extensible Configuration Checklist Description Format (.xccdf) for selected Chainguard Containers with implementation of the GPOS Security Requirements Guide (“SRG”) against Wolfi OS; and update STIG .xccdf if changes are introduced to the Wolfi OS-specific technical implementation of the GPOS SRG.