ArcGIS Server Security Technical Implementation Guide: Does it exist? At the Fed conference this past Feb, there was an announcement that an ArcGIS DISA STIG would be released in July of 2015. Was that released, and if so, where is it?
im not sure of ant July release, but in case your haven't looked at what's here
I wonder if this is what they were talking about (I wasn't there)
ArcGIS Security—Trust ArcGIS | ArcGIS
Looks interesting and I plan to look at it more myself.
edit...and another topic in the above