Prerequisites

Step 1, Choose the baseline and hardening path

Pick the standard first, then the tool that fits it. Most fleets start with the in product path and reach for the STIG Readiness Guide only when a DoD accreditation demands it.

1. Confirm the standard your fleet must meet with the team that owns risk, and record any controls that will be waived.
2. Choose the in product path with Security Posture Management for the SCG, PCI DSS or General Controls benchmarks.
3. Choose the STIG Readiness Guide path for DoD accreditation, and read Step 8 before you begin.
4. Note that the two paths can coexist, with Security Posture Management for continuous checks and the STIG content for formal evidence.

A baseline is a decision, not just a scan. Applying every control without judgement can break functions your fleet relies on, so evaluate each control against how you operate and document the exceptions.

Step 2, Grant Security Posture Management permissions

Compliance work needs an explicit permission, so grant it to a role before anyone runs an assessment. This happens in VCF Operations.

1. In the VCF Operations navigation bar, click Operate.
2. In the left navigation pane, click Administration, then Control Panel.
3. In the Access Control tile, click the Roles tab.
4. Select the role that your compliance operators use, or add a new one.
5. Grant the Assess and Remediate permission for Security Posture Management, or Assess Only for staff who should not change settings.
6. Click Update to save the role, then confirm the assigned users inherit it.

Separate the two permissions on purpose. Auditors and reviewers can hold Assess Only so they see the posture without the ability to change it, while a smaller group holds Assess and Remediate for the actual fixes.

Step 3, Enable a benchmark and set the assessment schedule

A benchmark measures a set of objects that a policy defines, so you enable the benchmark by binding it to a policy. Then you set how often it reruns.

1. In VCF Operations, open Security Posture Management.
2. Select the benchmark you chose in Step 1, such as the Security Configuration and Hardening Guide.
3. Bind the benchmark to the policy that covers the objects you want assessed, so the scope matches your intent.
4. Open Global Settings and locate the Compliance Assessment Schedule.
5. Set an interval that fits your change rate, for example daily for a busy fleet or weekly for a stable one.
6. Click Save to store the schedule.

Scope through policy keeps the noise down. Bind a strict benchmark to the management domain and a lighter one to a lab so a test cluster does not flood your results with findings you will never act on.

Step 4, Run an assessment and read the results

An assessment scores every in scope object against the benchmark and sorts each control into compliant, non compliant or unknown. Read it before you change anything.

1. In Security Posture Management, start the assessment for the enabled benchmark, or wait for the scheduled run.
2. Open the View Results tab to see the data grid of controls and their status.
3. Filter to Non Compliant so the failing controls sit together.
4. Click a control to read its description, the affected objects and the current values that produced the result.
5. Note any control marked Unknown, which usually means an object could not be evaluated and needs a manual check.

An unknown result is not a pass. It signals that the assessment could not read a value, often because a component was unreachable, so treat it as work to investigate rather than a control you can ignore.

Step 5, Tailor benchmark rules for your environment

Several rules need a value that only you know, such as your DNS servers or your login banner text. Supply those before you remediate, or the fix cannot apply the right setting.

1. In Security Posture Management, open the Benchmarks view and select your benchmark.
2. Browse the rules and open one that expects a site specific value, for example the approved DNS server rule.
3. Enter the value your environment uses, such as your NTP servers, DNS resolvers or banner text.
4. Preview the rule to confirm the tailored value reads correctly.
5. Save the tailored rule so the next assessment and any remediation use your value.

Tailoring is where a generic baseline becomes yours. Record every value you set in the same place you keep your exceptions, so a future operator can see why a rule expects a particular server or banner.

Step 6, Remediate noncompliant objects

Remediation applies the benchmark setting to the objects that failed. Start narrow, confirm nothing breaks, then widen the scope.

1. In the View Results tab, select the rules that offer remediation, since not every control can be fixed automatically.
2. For a first pass, select a single object or a small group rather than the whole fleet.
3. Click Remediate to apply the setting to the selected objects.
4. Watch the task to completion, then confirm the target components stay reachable.
5. Once a small batch is clean, repeat the remediation across the rest of the non compliant objects.

Some controls touch credentials and certificates. Where a finding points at an expiring certificate or a weak password policy, hand it to the task that owns that change, namely Part 6 for password and credential rotation, rather than forcing it from the compliance grid.

Step 7, Export results and generate a compliance report

Evidence is the point of the exercise. Export the results so an auditor or a customer can see the posture without logging in.

1. In the View Results tab, apply the filters that define the scope you want to report.
2. Click Export and choose CSV to pull the raw results for archival or further analysis.
3. Generate a compliance report that summarizes compliant and non compliant items at the control level.
4. Store the export with a timestamp so you keep a dated trail of each assessment.

A dated export answers the question every reviewer asks, which is how the fleet looked at a point in time. Keep each one, because a series of exports shows the posture improving rather than a single snapshot.

Step 8, Apply the STIG Readiness Guide for DoD environments

DoD accreditation needs the STIG Readiness Guide content, which runs a scan, remediate and verify loop from a control host. The content in the vmware dod compliance repository is validated for VCF 9.1.0.0 only, so match the version exactly. Audit first to set a baseline.

# audit a vCenter appliance with InSpec or Cinc Auditor
inspec exec . -t ssh://root@vcenter-mgmt.example.local \
  --input-file inputs-vcenter.yml \
  --reporter cli json:vcenter-results.json

Install the Ansible requirements, then remediate the appliances. A single consolidated playbook covers the whole platform since VCF 9.0, and vCenter application settings are handled by a PowerCLI script rather than Ansible.

# install roles, then remediate appliance rules over SSH
ansible-galaxy role install -r requirements.yml
ansible-playbook -i inventory_vcf.yml playbook.yml \
  -l vcenter --ask-vault-pass -e @vault_vcf.yml

1. Clone the VCF 9.x content and confirm the version in the repository README matches your fleet.
2. Populate the InSpec input file with your approved NTP servers, DNS resolvers and cipher suites.
3. Run the InSpec audit to record which controls pass and fail as your baseline.
4. Encrypt the vault with ansible-vault, then run the playbook against a limited inventory group first.
5. Run the vCenter PowerCLI script for the application rules the Ansible playbook does not cover.
6. Rerun the InSpec audit to verify, then convert the output for the reviewers.

# convert InSpec JSON into a STIG checklist for the DISA STIG Viewer
saf convert hdf2ckl -i vcenter-results.json -o vcenter.ckl

Handle the SDDC Manager appliance with care in this path. The remediation requires you to temporarily allow root over SSH, so set PermitRootLogin back to no and restart sshd once the run completes.

How to verify hardening

Confirm the fixes held and that your evidence is captured before you close the task.

1. Rerun the assessment in Security Posture Management and confirm the previously failing controls now read compliant.
2. Confirm no new Unknown results appeared, which would signal a component the assessment can no longer reach.
3. For the DoD path, confirm the second InSpec audit shows the remediated controls passing.
4. Open your exported report and confirm it reflects the improved score with a current timestamp.
5. Confirm every remediated component is still reachable and serving, especially anything behind an authentication change.

Common errors and fixes

Common questions

References

• Broadcom TechDocs, Compliance Assessment and Reporting using Security Posture Management (VCF 9.1)
• Broadcom TechDocs, Running an Assessment with Security Posture Management (VCF 9.1)
• VCF Blog, Securing the Foundation, VMware Cloud Foundation 9.1 STIG Compliance
• Broadcom TechDocs, VCF 9.x Ansible Playbook Overview (STIG)

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts