@bbbourq good luck!

And yes, you can absolutely use Ansible for applying a good chunk of required STIG configurations. Definitely be careful, though, as it's easy to break a system if you try to apply everything all at once. Definitely a viable approach for VM templates which all have the same starting configuration though.

Check out https://www.open-scap.org/security-policies/scap-security-guide/, if you haven't already.