WhatAreOrganizationalSettings

What Is a PowerSTIG Organizational Setting?

A PowerSTIG Organizational Setting (often referred to as OrgSettings) is a mechanism used by PowerSTIG DSC composite resources to apply organization‑specific value overrides to DISA STIG rules without disabling those rules.

Organizational settings allow an organization to remain STIG‑compliant while tailoring certain rule values to meet internal policies, operational requirements, or approved risk decisions.

---

Why Organizational Settings Exist

Many DISA STIG rules define allowable ranges or acceptable values instead of a single fixed setting. Examples include:

• Maximum or minimum numeric values
• Enabled vs disabled feature states
• Approved paths, file extensions, or configuration options

If an organization needs a value that differs from the STIG default—but still falls within the approved guidance—Organizational Settings are the correct mechanism to use.

Without Organizational Settings, teams would be forced to either:

• Skip the rule entirely, or
• Modify the STIG content itself (which breaks audit traceability)

---

How Organizational Settings Work in PowerSTIG

Organizational settings are supplied to a PowerSTIG resource through the OrgSettings parameter, either as:

• A PowerShell object (hashtable), or
• A file‑based definition loaded into an object (commonly a .psd1 file)

Each organizational setting is mapped to a short STIG rule ID (V-xxxxx) and provides a value that overrides the default STIG value for that rule.

At compile time, PowerSTIG:

1. Loads the STIG data for the specified Technology, TechnologyVersion, and StigVersion
2. Merges any provided OrgSettings values over the default STIG values
3. Produces a final, deterministic configuration that is enforced by DSC

---

Example: Organizational Settings via Hashtable

$MyOrgAdobeSettings = @{
    'V-99999' = @{ Value = 'Disabled' }
    'V-88888' = @{ Value = 15 }
}

Adobe AdobeBaseline
{
    AdobeApp    = 'AcrobatReader'
    StigVersion = [Version]'2.1'
    OrgSettings = $MyOrgAdobeSettings
}