01
Find
COMPLY finds the instances in your middleware layer and identifies each product and version, so every one is held to the right baseline.
COMPLY™ · Middleware configuration compliance
The checking for your middleware layer, handled.
COMPLY finds your application servers, web servers, gateways and message brokers, assesses each against its STIG or CIS baseline, and tracks every finding until it's verified closed, with the evidence written for you.
- Products covered
- 18
- Checks
- 1,258
- Baselines
- DISA STIG · CIS · vendor
DISA STIG Apache Tomcat Application Server 9 V3R4
V-222931TCAT-AS-000060CAT I
Default password for keystore must be changed.
conf/server.xml
<Certificate type="RSA" certificateKeystorePassword="changeit" />- FoundAssessed against V3R4
- OpenTracked as CAT I
- Re-checkedAfter your team's fix
- Verified closedEvidence written
01The layer in between
Every server in that layer has its own baseline.
Between the operating system and your application sit the servers that carry the traffic: application servers, web servers, gateways and message brokers. Each has its own DISA STIG, CIS benchmark or vendor guidance, and each version has its own rules.
Someone has to check every instance against the right one, keep track of what's open, re-check what's been fixed and write it up for the assessor.
COMPLY handles that checking.
- Your applicationYour code and its dependencies
- Checked by COMPLYMiddlewareApplication servers · web servers · gateways · message brokers
- Operating systemLinux and Windows hosts
- InfrastructureCloud, network and storage
Three of those servers and their baselines
Apache Tomcat 9
- DISA STIGV3R479checks
- CISv1.2.0, Level 120checks
Oracle WebLogic Server 12c
- DISA STIGV2R273checks
Microsoft IIS 10.0
- DISA STIGServer V3R740checks
- DISA STIGSite V2R1544checks
- CISv1.2.1, Level 140checks
02How it works
From instance to evidence, in four steps.
| Instance | Product · Baseline |
|---|---|
| tc-prod-03 | Apache Tomcat 9DISA STIGCISExtension |
| wls-prod-01 | Oracle WebLogic Server 12cDISA STIG |
| iis-web-02 | Microsoft IIS 10.0DISA STIGCIS |
| edge-01 | NGINXCISExtensionDevSec |
| mq-01 | RabbitMQVendorExtension |
02
Assess
Each instance is assessed rule by rule against its baseline, whether that's a DISA STIG, a CIS benchmark or the vendor's own security guidance.
6 of 79 rules shown
- V-222931 · CAT IDefault password for keystore must be changed.Finding
- V-222935 · CAT IIConnectors must be secured.Pass
- V-222932 · CAT IICookies must have secure flag set.Pass
- V-222933 · CAT IICookies must have http-only flag set.Pass
- V-222956 · CAT IIAutodeploy must be disabled.Finding
- V-222951 · CAT IIThe shutdown port must be disabled.Pass
- Passed
- 4
- Findings
- 2
03
Track
Every finding is tracked until it's verified closed. Your engineers make the fix; COMPLY re-checks it before it counts as closed.
V-222931 · CAT I
Default password for keystore must be changed.
- FoundAssessed against V3R4
- OpenTracked as CAT I
- Re-checkedAfter your team's fix
- Verified closedEvidence written
04
Evidence
The evidence is written for you: the baseline each instance was held to, what was found, and when each finding was verified closed.
- Instance
- tc-prod-03.example.com
- Baseline held to
- DISA STIG Apache Tomcat Application Server 9 V3R4
- What was found
- V-222931 · CAT IDefault password for keystore must be changed.
- Where
- conf/server.xml
- Status
- Verified closedRe-checked after your team's fix
03Coverage
Coverage, counted from the checks themselves.
Every number here is read from COMPLY's control packs each time this page is built. Nothing is typed in by hand.
1,258checks across 18 products and 40 baselines
| Baseline | Checks | DISA severity |
|---|---|---|
| Apache Tomcat 9108 checks | ||
| DISA STIGV3R4 | 79 | CAT I 4, CAT II 54, CAT III 21 |
| CISv1.2.0, Level 1 | 20 | None listed |
| Extensionserver.xml, catalina.properties, connector and shutdown hardening9 checks across 3 controls | 9 | None listed |
| Oracle WebLogic Server 12c73 checks | ||
| DISA STIGV2R2 | 73 | CAT I 5, CAT II 49, CAT III 19 |
| Oracle WebLogic Server 14c73 checks | ||
| DISA STIG12c V2R2 rules, back-ported to 14c | 73 | None listed |
| IBM WebSphere Traditional 9.x77 checks | ||
| DISA STIGV2R1 | 77 | CAT I 9, CAT II 56, CAT III 12 |
| IBM WebSphere Liberty143 checks | ||
| DISA STIGV2R4 | 30 | CAT I 7, CAT II 23, CAT III 0 |
| CISv1.0.0, Level 1 | 105 | None listed |
| CISv1.0.0, Level 2 | 8 | None listed |
| Red Hat JBoss EAP 6.367 checks | ||
| DISA STIGV2R6 | 67 | CAT I 10, CAT II 56, CAT III 1 |
| Red Hat JBoss EAP 7.411 checks | ||
| VendorRed Hat security and configuration guides | 11 | None listed |
| Red Hat JBoss EAP 8.0 and 8.112 checks | ||
| VendorRed Hat security documentation | 12 | None listed |
| WildFly 26 and later28 checks | ||
| VendorWildFly Elytron security documentation | 12 | None listed |
| ExtensionServer hardening | 16 | None listed |
| Spring Boot27 checks | ||
| VendorSpring Boot and Spring Security reference | 24 | None listed |
| ExtensionActuator and TLS hardening | 3 | None listed |
| Baseline | Checks | DISA severity |
|---|---|---|
| Apache HTTP Server 2.4189 checks | ||
| CISControls mapped to the CIS Apache HTTP Server 2.4 Benchmark189 checks across 67 controls64 cite CIS and 4 cite a DISA STIG | 189 | None listed |
| IBM HTTP Server 8.5.511 checks | ||
| VendorIBM HTTP Server and mod_ibm_ssl documentation | 11 | None listed |
| IBM HTTP Server 9.0.548 checks | ||
| VendorIBM HTTP Server and mod_ibm_ssl documentation | 11 | None listed |
| ExtensionApache 2.4 hardening for IBM HTTP Server | 37 | None listed |
| Microsoft IIS 10.0124 checks | ||
| DISA STIGServer V3R7 | 40 | CAT I 4, CAT II 34, CAT III 2 |
| DISA STIGSite V2R15 | 44 | CAT I 2, CAT II 42, CAT III 0 |
| CISv1.2.1, Level 1 | 40 | None listed |
| NGINX81 checks | ||
| CISv2.1.0 | 58 | None listed |
| ExtensionHeader, TLS and timeout hardening | 9 | None listed |
| DevSecDevSec NGINX Baseline14 checks across 10 controls9 cite CIS | 14 | None listed |
| Baseline | Checks | DISA severity |
|---|---|---|
| HAProxy45 checks | ||
| VendorHAProxy configuration manual and TLS guidance | 36 | None listed |
| ExtensionTLS and privilege hardening | 9 | None listed |
| Kong Gateway10 checks | ||
| VendorKong secure Admin API guide | 8 | None listed |
| ExtensionAdmin API and TLS hardening | 2 | None listed |
| Traefik11 checks | ||
| VendorTraefik operations documentation | 9 | None listed |
| ExtensionAPI and TLS hardening | 2 | None listed |
| Baseline | Checks | DISA severity |
|---|---|---|
| Apache Kafka39 checks | ||
| VendorApache Kafka and Confluent security guides | 33 | None listed |
| ExtensionBroker security hardening | 6 | None listed |
| Apache ActiveMQ Classic11 checks | ||
| VendorActiveMQ security documentation | 9 | None listed |
| ExtensionAuthentication hardening | 2 | None listed |
| RabbitMQ32 checks | ||
| VendorRabbitMQ production checklist and security guides | 29 | None listed |
| ExtensionTLS and authentication hardening | 3 | None listed |
| Apache ZooKeeper38 checks | ||
| VendorZooKeeper administrator and SSL guides | 33 | None listed |
| ExtensionSecurity hardening | 5 | None listed |
- DISA STIG · CIS
- Rules from the published STIG or CIS benchmark, release by release.
- Vendor
- Checks drawn from the vendor's own security documentation.
- Extension
- Additional hardening checks COMPLY runs on top of the baseline.
- DevSec
- Checks drawn from the open-source DevSec Hardening Framework.
CAT I is DISA's most severe category, CAT III the least.
04Frameworks
Built around the baselines your framework names.
The service provider shall use the DoD STIGs1 to establish configuration settings; Center for Internet Security up to Level 2 (CIS Level 2)2 guidelines shall be used if STIGs are not available; Custom baselines3 shall be used if CIS is not available.
ISO/IEC 27001:2022
Annex A 8.9
Configuration management
PCI DSS v4.0.1
Requirement 2.2.1
Configuration standards
Also for teams running SOC 2 and HIPAA programs.
05Scope
COMPLY handles the checking. The fixes stay with your team.
What COMPLY does
- Finds the instances in your middleware layer
- Assesses each against its STIG or CIS baseline
- Tracks every finding until it's verified closed
- Writes the evidence for you
What stays with your team
- Running the layer
- Making the fixes, with your own engineers and vendors
It doesn't run that layer or take the work over. Your engineers still make the fixes; you get the evidence.
06FAQ
Questions, answered plainly.
The servers between the operating system and your application: application servers, web servers, gateways and proxies, and message brokers.
COMPLY covers Apache Tomcat, Oracle WebLogic Server, IBM WebSphere Traditional, IBM WebSphere Liberty, Red Hat JBoss EAP, WildFly, Spring Boot, Apache HTTP Server, IBM HTTP Server, Microsoft IIS, NGINX, HAProxy, Kong Gateway, Traefik, Apache Kafka, Apache ActiveMQ Classic, RabbitMQ and Apache ZooKeeper today. The coverage table shows every baseline for each.
Each product is assessed against the baselines listed for it in the coverage table: a DISA STIG, a CIS benchmark or the vendor's own security guidance.
For FedRAMP, CM-6(a) sets the order: DISA STIGs first, CIS up to Level 2 where STIGs are not available, and custom baselines where CIS is not available.
No. COMPLY handles the checking: it finds what's out of line with the baseline and re-checks it once it's fixed. Your engineers and vendors make the changes, and you get the evidence.
No. FedRAMP names DISA STIGs outright; ISO/IEC 27001:2022 has Annex A 8.9, Configuration management, and PCI DSS v4.0.1 has Requirement 2.2.1 on configuration standards. COMPLY is also for teams running SOC 2 and HIPAA programs.
Fifteen minutes on a representative setup for your stack: COMPLY finds the instances, assesses them against their baselines, tracks a finding to verified closed and writes the evidence.
Nothing to install beforehand, and no access to your environment needed.
What an assessor needs to follow the work: the baseline each instance was held to, what was found, and when each finding was verified closed. The walkthrough shows a complete example.
07Walkthrough
See it on a setup like yours.
Fifteen minutes. A walkthrough of COMPLY on a representative setup for your stack.
- Discovery, assessment and a finding tracked to verified closed
- Nothing to install beforehand
- No access to your environment needed
Rather book in a new tab? Open the booking page (opens in a new tab)