// the take
SIMP is a Puppet-based system hardening and compliance automation stack built by the NSA, aimed at sysadmins who need RHEL/CentOS systems locked down to DISA STIG and similar policy baselines. This specific GitHub repo isn't the project itself — it's a landing page that points to ~100 separate component repos under the `simp` org where the actual Puppet modules live.
The modular design — one Puppet module per concern (iptables, auditd, SELinux, PAM, krb5, etc.) — lets you pull in only what you need instead of one monolithic catalog. Compliance mapping is a real asset: modules like pupmod-simp-compliance_markup and the InSpec STIG profile encode actual DISA/NIST controls rather than generic 'hardening' guesses. GPG-signed RPM releases and a dedicated release key show they treat supply-chain integrity seriously for a security product.
This repo contains no code — directory tree is just a README, LICENSE, and a GPG key file; anyone landing here has to go dig through dozens of other repos to find anything to actually install. Last push to this repo was 2019, and it still points at CentOS 6/7-era release tarballs and ISOs, so it reads as abandoned even if some component modules are maintained elsewhere. Puppet itself is a declining choice for new infrastructure work, and adopting SIMP means buying into Puppet's agent/master model plus ~100 interdependent modules — a heavy commitment for what you get. No indication of Debian/Ubuntu support; this is RHEL-family only.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →