The checklists already exist. Everyday computers rarely see them.
Why a free DoD baseline is a public good for an ordinary laptop, and why availability is not the same as use.
Essays
Writing
Ten notes on public Department of Defense checklists and everyday computers, plus other articles. The free STIG Checker tool lives atstig.hsaxena.com.
STIG essays
Himanshu Saxena. Plain English for a general reader. DISA publishes STIGs for the Department of Defense; this series is independent and is not a DoD or DISA publication.
What a STIG is, without the jargon
A lockdown checklist with ranked severity — not a secret document, not a virus scanner, not a DoD endorsement of this website.
When the school or clinic has no security team
The same commercial operating systems, the same lost-laptop risk, and no specialist to translate a 200-rule guide.
Settings gaps are not Hollywood hacking
Most of a STIG is configuration: encryption off, automatic login on, unused services left running.
Nothing runs until a person types their name
Why every check ships unreviewed, why a name freezes a fingerprint, and why a model must not execute.
Silence is not compliance
A report that hides skipped rules is not useful to a board, an insurer, or a parent. Coverage comes first.
Open source as public infrastructure
No account, no key, MIT licence. The safety gate is code you can read. That is how a public baseline should travel.
From auditor language to everyday English
What the rule asks, how serious it is, whether a machine can check it, and what could go wrong if you change it.
A first CAT I scan, for someone new
Start with DISA’s highest severity. Do not confuse a short first pass with a complete baseline.
After the scan: assessment and safe remediation
What this release already does, and why later modules still need a human before any fix script runs.
Other writing
Building a Reusable AI Skill for STIG-to-Excel Conversion ↗
A walkthrough of packaging a repeatable STIG XCCDF-to-Excel workflow as a version-controlled AI skill, including the repository, inputs, outputs, and failure modes.
Beyond Chatbots: Building a Local-First AI Skills Library with Flask, ChromaDB, and Devin ↗
How to assemble a local-first AI skills library with Flask, ChromaDB, and RAG-style retrieval so reusable skills live beside the assistant instead of in one-off chat prompts.