diff --git a/roles/security_scap_stig/files/banners/issue b/roles/security_scap_stig/files/banners/issue
new file mode 100644
index 0000000..42b3729
--- /dev/null
+++ b/roles/security_scap_stig/files/banners/issue
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
diff --git a/roles/security_scap_stig/files/banners/issue.net b/roles/security_scap_stig/files/banners/issue.net
new file mode 100644
index 0000000..42b3729
--- /dev/null
+++ b/roles/security_scap_stig/files/banners/issue.net
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
diff --git a/roles/security_scap_stig/files/banners/motd b/roles/security_scap_stig/files/banners/motd
new file mode 100644
index 0000000..42b3729
--- /dev/null
+++ b/roles/security_scap_stig/files/banners/motd
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
diff --git a/roles/security_scap_stig/files/modprobe/cramfs.conf b/roles/security_scap_stig/files/modprobe/cramfs.conf
new file mode 100644
index 0000000..b77c93a
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/cramfs.conf
@@ -0,0 +1 @@
+install cramfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/dccp.conf b/roles/security_scap_stig/files/modprobe/dccp.conf
new file mode 100644
index 0000000..d453550
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/dccp.conf
@@ -0,0 +1 @@
+install dccp /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/freevxfs.conf b/roles/security_scap_stig/files/modprobe/freevxfs.conf
new file mode 100644
index 0000000..72d4aec
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/freevxfs.conf
@@ -0,0 +1 @@
+install freevxfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/hfs.conf b/roles/security_scap_stig/files/modprobe/hfs.conf
new file mode 100644
index 0000000..a991f49
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/hfs.conf
@@ -0,0 +1 @@
+install hfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/hfsplus.conf b/roles/security_scap_stig/files/modprobe/hfsplus.conf
new file mode 100644
index 0000000..9cba83f
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/hfsplus.conf
@@ -0,0 +1 @@
+install hfsplus /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/jffs2.conf b/roles/security_scap_stig/files/modprobe/jffs2.conf
new file mode 100644
index 0000000..63360f3
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/jffs2.conf
@@ -0,0 +1 @@
+install jffs2 /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/rds.conf b/roles/security_scap_stig/files/modprobe/rds.conf
new file mode 100644
index 0000000..650abee
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/rds.conf
@@ -0,0 +1 @@
+install rds /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/sctp.conf b/roles/security_scap_stig/files/modprobe/sctp.conf
new file mode 100644
index 0000000..960a200
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/sctp.conf
@@ -0,0 +1 @@
+install sctp /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/squashfs.conf b/roles/security_scap_stig/files/modprobe/squashfs.conf
new file mode 100644
index 0000000..c177037
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/squashfs.conf
@@ -0,0 +1 @@
+install squashfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/tipc.conf b/roles/security_scap_stig/files/modprobe/tipc.conf
new file mode 100644
index 0000000..260e2ad
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/tipc.conf
@@ -0,0 +1 @@
+install tipc /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/udf.conf b/roles/security_scap_stig/files/modprobe/udf.conf
new file mode 100644
index 0000000..4894688
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/udf.conf
@@ -0,0 +1 @@
+install udf /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/usb_storage.conf b/roles/security_scap_stig/files/modprobe/usb_storage.conf
new file mode 100644
index 0000000..38a1e49
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/usb_storage.conf
@@ -0,0 +1 @@
+install usb-storage /bin/true
diff --git a/roles/security_scap_stig/tasks/main.yml b/roles/security_scap_stig/tasks/main.yml
new file mode 100644
index 0000000..fce8692
--- /dev/null
+++ b/roles/security_scap_stig/tasks/main.yml
@@ -0,0 +1,110 @@
+---
+# SCAP/STIG baseline hardening — port of Modules/Security/secharden-scap-stig.sh.
+
+# --- GRUB permission hardening (skip on Raspberry Pi) ---
+- name: Harden /boot/grub/grub.cfg permissions (non-Pi only)
+  ansible.builtin.file:
+    path: /boot/grub/grub.cfg
+    owner: root
+    group: root
+    mode: "0400"
+  when: not (is_raspi | bool)
+  failed_when: false
+
+# --- Disable and purge autofs ---
+- name: Disable autofs
+  ansible.builtin.systemd:
+    name: autofs
+    enabled: false
+    state: stopped
+  failed_when: false
+
+- name: Purge autofs package
+  ansible.builtin.apt:
+    name: autofs
+    state: absent
+    purge: true
+  failed_when: false
+
+# --- Kernel module blacklisting (modprobe.d) ---
+- name: Deploy modprobe blacklists
+  ansible.builtin.copy:
+    src: "modprobe/{{ item }}"
+    dest: "/etc/modprobe.d/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  loop:
+    - usb_storage.conf
+    - dccp.conf
+    - rds.conf
+    - sctp.conf
+    - tipc.conf
+    - cramfs.conf
+    - freevxfs.conf
+    - hfs.conf
+    - hfsplus.conf
+    - jffs2.conf
+    - squashfs.conf
+    - udf.conf
+
+# --- Login banners ---
+- name: Deploy login banners
+  ansible.builtin.copy:
+    src: "banners/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  loop:
+    - {src: issue, dest: /etc/issue}
+    - {src: issue.net, dest: /etc/issue.net}
+    - {src: motd, dest: /etc/motd}
+
+# --- cron permissions ---
+- name: Remove /etc/cron.deny if present
+  ansible.builtin.file:
+    path: /etc/cron.deny
+    state: absent
+
+- name: Ensure /etc/cron.allow exists with STIG permissions
+  ansible.builtin.file:
+    path: /etc/cron.allow
+    state: touch
+    owner: root
+    group: root
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve
+
+- name: Harden cron system paths
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    mode: "{{ item.mode }}"
+    owner: root
+    group: root
+  loop:
+    - {path: /etc/crontab, mode: "0600"}
+    - {path: /etc/cron.hourly, mode: "0700"}
+    - {path: /etc/cron.daily, mode: "0700"}
+    - {path: /etc/cron.weekly, mode: "0700"}
+    - {path: /etc/cron.monthly, mode: "0700"}
+    - {path: /etc/cron.d, mode: "0700"}
+
+# --- at permissions ---
+- name: Remove /etc/at.deny if present
+  ansible.builtin.file:
+    path: /etc/at.deny
+    state: absent
+
+- name: Ensure /etc/at.allow exists with STIG permissions
+  ansible.builtin.file:
+    path: /etc/at.allow
+    state: touch
+    owner: root
+    group: root
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve