CKL vs CKLB: STIG checklist file formatsGuide

The short answer

.ckl is the checklist format written by DISA STIG Viewer 2.x. It is an XML file. .cklb is the format written by STIG Viewer 3. It is a JSON file. Both hold the same thing — a STIG, the asset it was assessed on, and a status and comments for every requirement — just serialized differently.

STIG Viewer 3 opens .cklb files and imports .ckl files, so .ckl remains the most portable choice. Every checklist in the STIG checklist index downloads as a .ckl.

Side by side

• Written by: .ckl — STIG Viewer 2.x · .cklb — STIG Viewer 3.x
• Encoding: .ckl — XML · .cklb — JSON
• Opens in STIG Viewer 3: .ckl — yes, via import · .cklb — yes, natively
• Opens in STIG Viewer 2.x: .ckl — yes · .cklb — no
• Tool support: .ckl — the long-standing format most scripts, scanners, and import tools accept · .cklb — newer; check that your tool supports it before standardizing on it

Which one should you use?

If everything in your workflow — STIG Viewer, your scanner, and your ATO tooling — supports .cklb, use it. Otherwise keep .ckl as the exchange format: STIG Viewer 3 can import it and save it as .cklb whenever you need to.

Automated results from SCAP Compliance Checker (SCC) can be exported as checklists too, so a scan of a SCAP benchmark can pre-fill most of a checklist before the manual review.

Converting between them

Going the other way (.cklb to .ckl) needs STIG Viewer 3 export support or a conversion script, because STIG Viewer 2.x cannot read .cklb.

1. Open STIG Viewer 3.
2. Import the .ckl checklist.
3. Save it — STIG Viewer 3 writes .cklb.