Question about the recommendations included in SSG

[Yesser-Belhajali]

Hello everyone,I have a question about how the process of collecting and implementing security recommendations works in ComplianceAsCode/SSG.
Let's say you are creating security content for Ubuntu 26.04. Do you start by analyzing existing security benchmarks (for example CIS Ubuntu Benchmark, DISA STIG if available, NIST guidelines, etc.) and then implement their requirements as SSG rules with references to these standards? Or are some rules also created independently based on security best practices?
Also, suppose CIS has the following requirement:
"Minimum password length = 10"

and DISA STIG has:

"Minimum password length = 20"

Would these be represented as the same technical rule with different parameter values depending on the profile? For example, would you create one password length rule, reference both CIS and STIG in that rule, and then define different values in the CIS and STIG profiles?
Or would these be implemented as two separate rules?
I would appreciate any clarification about how the mapping between external security benchmarks, SSG rules, references, and profiles is handled, as I need to understand this process for a project.
Thank you!

[WolfAnto]

Hello @Yesser-Belhajali

I’m not a project maintainer, but here’s how it works in practice in ComplianceAsCode/SSG:

They don’t create all the rules from scratch for each standard. There is a shared library of technical rules (linux_os/guide/). The standards (CIS, STIG, NIST, etc.) are then mapped to this library via files in the controls/ directory. Some rules also exist independently, based on best practices or cross-cutting requirements.

CIS = 10, STIG = 20: one or two rules?
Generally, a single technical rule, with different values depending on the profile.

Example with minimum password length:

Rule: accounts_password_pam_minlen
Variable: var_password_pam_minlen
In controls/cis_ubuntu2404.yml → var_password_pam_minlen=14
In controls/stig_ubuntu2404.yml → var_password_pam_minlen=15
Same rule, different thresholds depending on the standard. The profiles (e.g., cis_level2_workstation, stig) then select the correct mapping.

They only create two separate rules if the technical mechanism differs (e.g., PAM vs. /etc/login.defs), not simply because the value changes.

[Yesser-Belhajali]

@WolfAnto Thank you very much,you are a life saver