Compliance-ready servers, with evidence
SELinux enforcing, SSH key-only with no root login, restrictive firewall, and auditd — all enabled from first boot with no configuration needed.
Apply a full security profile (standard, CIS, OSPP, PCI) via Ansible in one command. Runs as dry-run by default; use --apply to make changes.
herd-compliance-scan evaluates the system with OpenSCAP/SSG and generates HTML reports and machine-readable ARF files for auditors.
Optional FIPS mode using FIPS-approved algorithms. Full-disk encryption with LUKS available. See the Trust Center for scope notes.
Supported baselines: CIS Levels 1 & 2 (Server), OSPP, PCI-DSS, and a lightweight standard profile. All features are in the free Community edition.