Information: 

DISA Risk Management Executive (RME)  developed a process whereby original product developers/vendors can write Security Technical Implementation Guides (STIGs) for their products. Vendor STIGs must be written against a published DoD Security Requirements Guide (SRG). Currently published SRGs are available at:http://iase.disa.mil/stigs/srgs/.

To initiate the process, a product vendor must fill out the Vendor STIG Intent Form available under Guidance Documents. The completed form is submitted to disa.stig_spt@mail.mil.

A representative from the Risk Management Executive STIG team will follow-up with the vendor to initiate the process.

Technology specific SRGs reflect what a technology family SHOULD be capable of, in order to be secured. The STIG author (vendor) will assess the SRG controls against a product with one of four potential outcomes. 

Not Applicable - the feature does not exist in the product, and therefore cannot be exploited.

Applicable - configurable - may or may not meet requirement based on settings.

Applicable - inherently meets - not configurable, but meets the requirement by default. 

Applicable - does not meet - not configurable, and does not meet the requirement. 

Upon completion of the SRG spreadsheet, the data is transformed into a STIG. The STIG, once written, will reflect what a specific product CAN do, in a specific release and possible patch level. Published STIGs will only contain requirements that fall into the "applicable and configurable" category.