Ansible Automation Platform In-Platform Compliance Dashboard: DISA STIG, CIS, and OpenSCAP

The Ansible Automation Platform now includes an in-platform Compliance Dashboard — an end-to-end compliance experience built into the Ansible Portal for scanning infrastructure against DISA STIG, CIS, and other compliance profiles, reviewing per-host findings, and executing targeted remediation.

Compliance Posture Overview

The dashboard displays a real-time compliance posture with:

• Overall score — percentage compliance across all hosts
• Initial SCAP score — baseline from first scan
• CIS Benchmark score — current CIS compliance level
• PCI-DSS score — payment card industry compliance
• Summary counts: hosts scanned, critical findings, remediated items

Three-Tier Scanner Orchestration

The Compliance Dashboard uses a three-tier scanning model:

Tier 1: Built-In Scanners

- name: Run OpenSCAP compliance scan
  ansible.builtin.include_role:
    name: redhat.rhel_system_roles.compliance
  vars:
    compliance_profile: stig
    compliance_report_format: html
    compliance_report_path: /tmp/stig-report.html

Tier 2: Partner Integrations

• Tenable (Nessus)
• Qualys
• Red Hat Insights

Tier 3: Custom Adapters

See also: Ansible for Healthcare: HIPAA Compliance, EHR Systems, and Medical Device Management

Granular Remediation Builder

The remediation builder provides:

• Per-rule toggles — enable or disable remediation for individual findings
• Parameter customization — adjust remediation parameters per organizational policy
• Host-level targeting — apply fixes to specific hosts or groups
• Powered by Compliance-As-Code content from the trusted RHEL supply chain

- name: Remediate STIG findings
  hosts: rhel_servers
  roles:
    - role: redhat.rhel_system_roles.compliance
      vars:
        compliance_profile: stig
        compliance_remediate: true
        compliance_rules_exclude:
          - xccdf_org.ssgproject.content_rule_disable_host_auth
          - xccdf_org.ssgproject.content_rule_require_smartcard

Agentless Pre-Assessment

• Agentless scanning — no agents required on target hosts
• Scalable — scan thousands of hosts in parallel
• Continuous monitoring — scheduled scans for drift detection
• Audit-grade results — scanner output suitable for compliance certification audits

Scan Results Workflow

1. Define compliance profile (DISA STIG, CIS Level 1/2, PCI-DSS)
2. Select host inventory
3. Run agentless scan
4. Review findings by severity (Critical → Low)
5. Toggle individual rules for remediation
6. Execute targeted remediation playbook
7. Re-scan to verify compliance
8. Export audit-grade report

See also: Ansible Policy and Migration Engine (APME): AI-Powered Playbook Scanning and Compliance

Supported Compliance Profiles

FAQ

Does the Compliance Dashboard require a separate license?

No. It's built into the Ansible Portal as part of AAP. OpenSCAP and PowerSTIG are included. Partner scanners (Tenable, Qualys) require their own licenses.

Can I use this for Windows compliance?

Yes. PowerSTIG provides Windows DISA STIG scanning and remediation. The infra.windows_ops collection adds CIS benchmark support.

How does agentless scanning work?

AAP connects to target hosts via SSH (Linux) or WinRM (Windows) and executes SCAP evaluations remotely. No persistent agent installation required.

Can I export reports for auditors?

Yes. The dashboard generates audit-grade reports in HTML, XML (XCCDF), and ARF formats suitable for compliance certification.

Related Articles

• Ansible Policy and Migration Engine (APME)
• Red Hat Ansible Automation Platform 2.7: What's New
• New Ansible Content Collections 2026
• Red Hat Summit 2026 Highlights