Security Compliance & Certifications for 20.04
Ubuntu goes through several rigorous security certifications and programs and these pages are dedicated to them. All certification artefacts are available with an Ubuntu Pro subscription.
FIPS 140
Federal Information Processing Standards Publications (FIPS) are issued by the National Institute of Standards and Technology (NIST). FIPS 140-2 specifies the security requirements for cryptographic modules. These requirements address the areas of secure design and implementation.
Ubuntu LTS releases starting with 16.04 (Xenial) come with FIPS validated cryptographic packages, including the Linux kernel and OpenSSL. The full list of packages and certificates is available here.
For more information on FIPS certification on Ubuntu see the FIPS Information and Installation Guide.
CIS
Ubuntu LTS releases starting with 16.04 (Xenial) have compliance benchmark documents developed by the Center for Internet Security (CIS). Ubuntu with has developed the Ubuntu Security Guide to automate hardening Ubuntu LTS systems based off of the published CIS benchmarks.
For more information see
- CIS Compliance with Ubuntu Security Guide for Ubuntu 20.04 and later
- CIS Compliance for Ubuntu 16.04 and 18.04.
DISA-STIG
Security Technical Implementation Guides (STIG) are developed by the Defense Information System Agency (DISA) for the U.S. Department of Defense (DoD). Ubuntu with Ubuntu Pro and Ubuntu Advantage have the necessary certifications and controls to comply with DISA-STIG guidelines.
The DISA-STIG section demonstrates how to automatically apply the DISA-STIG rules for 20.04, as well as how to audit the system.
Common Criteria
Common Criteria for Information Technology Security Evaluation (CC) is an international standard. The CC provides a common set of requirements for the security functionality of IT products and for assurance measures applied to these IT products during a security evaluation.
Common Criteria certified packages are available for Ubuntu 16.04 & 18.04 LTS. Later releases have not been evaluated against this standard.
For more information on the Common Criteria certification on Ubuntu see the Common Criteria Guide.