Field guide
STIG Evidence for a Deployable Kit's RMF Package
STIG evidence for a deployable kit comes from scanning each hardened machine as it is actually deployed, then exporting the raw results, a STIG Viewer import file, the documented deviations and a printable summary with a sign-off block. Those results support your RMF package and accreditation. They are evidence for your assessor, not a certification of the kit.
Why STIG evidence goes stale on a fly-away kit
Most programs document hardening once, at delivery, and then the kit changes. Machines are rebuilt, software is installed, identity is enrolled and updates are applied. Each step can quietly undo part of the hardening, so a scan taken at the factory says little about the kit an assessor is looking at months later.
Assembling evidence by hand makes it worse. Someone has to run the scanner on every machine, collect the files, match findings to STIG IDs and explain every deviation, usually under deadline and often without a network connection.
What an assessor needs from a scan
An assessor needs results they can trace and reuse. That means the full machine-readable result, findings broken out by DISA category (CAT I, II and III) with STIG IDs and CCIs, a file they can import into DISA STIG Viewer to build or update a checklist, and the provenance of the scan itself: which scanner and content versions ran, which profile and tailoring applied, and whether the machine was in FIPS mode.
Deviations matter as much as findings. A deviation recorded with its rationale is a decision the assessor can review. An open finding nobody has explained is just a finding.
How Rhombus produces STIG evidence
On current-generation kits, Rhombus runs read-only compliance scans against each hardened virtual machine's DISA STIG profile. A scan runs automatically after every console build of a hardened machine, and on demand for one machine or all of them. The console shows each machine's score, failed rules by CAT I, II and III, and the details of every open finding with its STIG ID, SRG, rule version and CCIs, alongside the documented deviations and their rationale.
Each run exports as a package: the ARF result, an HTML report, XCCDF results for import into DISA STIG Viewer, the scan log, provenance (scanner and content versions, profile, tailoring and FIPS state) and the evidence recorded when the image was built. One download collects the latest successful result for each machine. A printable compliance scan report with kit identity, scorecard, open findings, deviations and a signature block saves as PDF. All of it works offline.
Hardening is built into the image and re-applied after installation steps that would otherwise undo it. The scan itself is read-only and changes nothing, so remediation lives in the image and the evidence describes a repeatable build rather than one-off fixes.
Where scan evidence fits in your accreditation
Authorization is granted to your system, in your environment, by your authorizing official. Scan results and documented deviations are inputs to that decision. Rhombus is hardened to DISA STIG and designed to support your accreditation; it does not replace it.