[Verse 1]
From NIST controls way up high
Down to products where they apply
There's a pathway we must trace
Through the hierarchy's embrace
Eight hundred fifty-three controls
Set the standards for our goals
But they're too broad to use alone
Need translation to call home
[Chorus]
NIST to SRG to STIG we go
Watch the requirements flow
From the general to specific needs
Following where compliance leads
SRG takes the broad control
Makes it fit technology's role
STIG takes it one step more
To the product at the core
[Verse 2]
SRG stands between the lines
Takes those NIST control designs
Makes them fit a category
Operating systems, you see
General Purpose OS SRG
Translates what AC-2 means
Account management made clear
For the platform engineers
[Chorus]
NIST to SRG to STIG we go
Watch the requirements flow
From the general to specific needs
Following where compliance leads
SRG takes the broad control
Makes it fit technology's role
STIG takes it one step more
To the product at the core
[Bridge]
RHEL 8 STIG shows the way
Check inactive accounts today
Lock them out when time expires
That's what AC-2 requires
From the abstract to concrete
Makes compliance more complete
[Verse 3]
Inheritance is the key
Flowing down from one to three
Nothing lost along the way
Just more specific every day
Technology category
Then the product family
Step by step we drill it down
Till implementation's found
[Chorus]
NIST to SRG to STIG we go
Watch the requirements flow
From the general to specific needs
Following where compliance leads
SRG takes the broad control
Makes it fit technology's role
STIG takes it one step more
To the product at the core
[Outro]
Three levels in the chain
Keep security's domain
From controls to checks complete
Making compliance concrete