Frequently Asked QuestionsAbout Asset Guard

Asset Guard is an on-premises unified compliance operations platform that brings STIGs, assets, findings, vulnerability scans, remediation, POA&Ms, evidence, assignments, and eMASS preparation into a single system. It is designed to help cybersecurity teams manage the operational work between identifying a compliance issue and documenting, remediating, and preparing that work for submission or update in eMASS.

Unlike a standalone checklist viewer, Asset Guard connects compliance requirements to the systems and assets they affect, giving teams a centralized workspace for managing remediation and compliance activities.

Yes. Asset Guard supports DISA Security Technical Implementation Guides (STIGs) throughout the compliance workflow.

Users can import and maintain STIGs, associate applicable STIGs with systems and assets, create and manage checklists, review individual STIG findings, update finding status and documentation, and track compliance across the environment.

Asset Guard also connects STIG findings to assets, remediation activities, POA&Ms, evidence, and assigned personnel so teams can manage the work that results from a STIG assessment rather than treating each checklist as an isolated file.

Yes. Asset Guard includes native Plan of Action and Milestones (POA&M) management for tracking vulnerabilities through remediation.

Users can create POA&M items from findings, create them manually, manage remediation details and milestones, assign responsible personnel, track status, maintain supporting evidence, and prepare POA&M information for downstream reporting and eMASS workflows.

This allows teams to manage the day-to-day remediation process in the same platform where the underlying assets, findings, vulnerability information, and supporting documentation are maintained.

No. Asset Guard is not an eMASS replacement.

eMASS remains the government system used for authorization and RMF package management. Asset Guard supports the operational compliance work that occurs before information is entered into or updated in eMASS.

Teams can use Asset Guard to manage STIG findings, vulnerability information, application-security findings, remediation activities, POA&Ms, milestones, evidence, assignments, and asset-level compliance and then prepare that information for eMASS workflows.

Yes. Asset Guard is designed for on-premises and disconnected environments, including air-gapped networks.

The application can be deployed within the customer’s own infrastructure using a containerized deployment model, allowing STIGs, findings, POA&Ms, vulnerability information, evidence, and other compliance data to remain within the organization’s controlled environment.

This deployment model makes Asset Guard well suited for government, defense, contractor, and other security-sensitive environments where dependence on a cloud-hosted compliance platform may not be appropriate.

Yes. Asset Guard supports the import and management of supported ACAS vulnerability scan data.

Asset Guard processes imported vulnerability information so teams can maintain ACAS findings alongside systems, assets, STIG findings, remediation activities, POA&Ms, and compliance evidence.

Asset Guard is not a vulnerability scanner and does not replace ACAS.

Yes. Asset Guard supports Fortify and supported Static Application Security Testing (SAST) information as part of its application-security workflow.

Fortify findings can be associated with software assets and maintained alongside STIG findings, assets, POA&Ms, remediation activities, and compliance evidence.

For organizations managing both infrastructure and application-security requirements, this provides a common operational workspace instead of keeping application-security findings separate from the broader compliance process.

Asset Guard does not replace Fortify and does not perform static application security testing.

Asset Guard is designed for organizations responsible for managing government and defense cybersecurity compliance across systems, assets, and authorization boundaries.

Typical users include:

• Information Systems Security Managers (ISSMs)
• Information Systems Security Officers (ISSOs)
• System administrators
• Cybersecurity teams
• Application security teams
• Program leadership
• Government organizations
• Defense contractors
• RMF and compliance personnel

Role-based access allows organizations to provide different levels of visibility and management authority based on each user’s responsibility.

Yes. Asset Guard is designed to manage STIG findings across multiple systems, individual assets, and groups of assets.

Organizations can define systems and authorization boundaries, maintain the assets within those boundaries, associate applicable STIGs with those assets, and manage the resulting findings from a centralized workspace.

Asset Groups allow teams to organize assets with similar compliance requirements and manage common STIG and remediation activities more efficiently while retaining visibility into the individual assets affected.

This is particularly useful when the same STIG applies across many servers, workstations, network devices, applications, or other assets.

Yes. Asset Guard includes STIG Compare capabilities for analyzing changes between STIG releases.

When a new STIG version is introduced, teams can review changes between releases, identify added, modified, or removed requirements, examine version history, and determine which assets and findings may be affected.

Asset Guard connects those STIG changes to the operational environment so users can move from identifying a DISA STIG update to reviewing the specific systems, assets, and findings that may require attention.

This helps organizations manage STIG updates as an ongoing compliance process instead of manually comparing individual STIG releases and checklist files.