STIGs are probably too tight. Sometimes they assume that you aren't networked.

CIS Benchmarks are consensus-driven and are a good starting place.