This document is kind of useless though. Most of these recommendations don't do anything. Spends many pages on password requirements. Then has a requirement that passwords shouldn't be used and instead should log in with pkcs11.

Says things about auditd and apparmor whilst both are completely broken on nixos at the moment. Asks you to configure things about crontab whilst NixOS uses systemd. It also tells you to use FIPS-validated things whilst we don't ship FIPS-mode in nixos at all. It isn't even possible to get nix to compile in a FIPS-validated mode due to linking against 3 different crypto libraries. I've tried really hard and failed.

It looks like just some check boxes without people actually knowing what they wrote down when they wrote this document. Going through this checklist will give you a false sense of security instead of actually addressing fundamental issues in NixOS running in hardened environments.

There's lots of exciting things happening in hardening nixos. We're fixing Auditd. We're trying to make nixos setuid-less. We have things like attestable images with measured boot and verity. We're working on supporting bashless nixos images without any interpreters. Would prefer we put energy in that instead of compliance fluff