Security Compliance & Certifications
Ubuntu goes through several rigorous security certifications and programs and these pages are dedicated to them. All certification artifacts are available with an Ubuntu Advantage subscription.
Federal Information Processing Standards Publications (FIPS) are issued by the National Institute of Standards and Technology (NIST). FIPS 140-2 specifies the security requirements for cryptographic modules. These requirements address the areas of secure design and implementation.
Ubuntu LTS releases starting with 16.04 (Xenial) come with FIPS validated cryptographic packages, including the Linux kernel and OpenSSL. The full list of packages and certificates is available here.
For more information on FIPS certification on Ubuntu see the FIPS Information and Installation Guide.
Ubuntu LTS releases starting with 16.04 (Xenial) have compliance benchmark documents developed by the Center for Internet Security (CIS). Ubuntu with has developed the Ubuntu Security Guide to automate hardening Ubuntu LTS systems based off of the published CIS benchmarks.
For more information see
- CIS Compliance with Ubuntu Security Guide for Ubuntu 20.04 and later
- CIS Compliance for Ubuntu 16.04 and 18.04.
Security Technical Implementation Guides (STIG) are developed by the Defense Information System Agency (DISA) for the U.S. Department of Defense (DoD). Ubuntu with Ubuntu Pro and Ubuntu Advantage have the necessary certifications and controls to comply with DISA-STIG guidelines.
The DISA-STIG section demonstrates how to automatically apply the DISA-STIG rules for 20.04, as well as how to audit the system.
Common Criteria for Information Technology Security Evaluation (CC) is an international standard. The CC provides a common set of requirements for the security functionality of IT products and for assurance measures applied to these IT products during a security evaluation.
The evaluation process establishes a level of confidence that the security functionality of these IT products and the assurance measures applied to these IT products meet these requirements:
For more information on the Common Criteria certification on Ubuntu see the Common Criteria Guide.