View any DISA STIG online — every STIG check with its check text, fix text, and severity — then download the .ckl to finish in DISA STIG Viewer 2.x or 3.x.
What DISA STIG Viewer is
STIG Viewer is DISA's desktop application for reading STIGs and filling in STIG checklists. Version 2.x saves checklists as .ckl (XML); STIG Viewer 3 saves them as .cklb (JSON) and can import older .ckl files — see CKL vs CKLB. DISA publishes both on the DoD Cyber Exchange SRG/STIG tools page.
To read a STIG in the desktop viewer you first download the STIG package from DISA, unzip it, and import the XCCDF file. That is fine for the one STIG you are assessing, but slow when you only need to look something up.
Viewing STIGs online with STIG Vault
STIG Vault is an online STIG viewer for the whole DISA library: nothing to install, no zip files, and every release already imported. Open any STIG from the A–Z list of STIG checklists and you get:
- Every STIG check in the release — V-number, rule title, severity (CAT I, II, or III), discussion, check text, and fix text — with a page of its own for each check.
- Search across every STIG at once with Search, including exact "quoted phrases".
- Version history — every earlier release stays available, and STIG Compare shows exactly which checks were added, removed, or changed.
- The matching SCAP benchmark for automated scanning, from the SCAP Repository.
- A .ckl download of the checklist, ready to open in STIG Viewer.
Online viewer or desktop STIG Viewer?
- Looking something up — what a V-number requires, how to fix it, which STIGs mention a setting: use the online viewer.
- Comparing releases — what changed between V2R8 and V2R9: use STIG Compare.
- Recording your assessment — statuses, finding details, comments, and the checklist you hand to an assessor: use DISA STIG Viewer, starting from the .ckl you download here.
From STIG Vault to STIG Viewer in four steps
- Find your STIG in the A–Z list or with Search.
- Pick the version and release you are assessing against (the current release is selected by default).
- Select CKL to download the checklist.
- Open the .ckl in STIG Viewer 2.x, or import it into STIG Viewer 3, and set each check to Open, Not a Finding, Not Applicable, or Not Reviewed.
Frequently asked questions
Is there an online STIG Viewer?
Yes. STIG Vault shows every DISA STIG in the browser — each STIG check with its severity, check text, and fix text — with search across the whole library and version comparison. Recording checklist statuses is still done in DISA STIG Viewer.
Where do I download DISA STIG Viewer?
DISA publishes STIG Viewer 2.x and STIG Viewer 3 on the SRG/STIG tools page of the DoD Cyber Exchange (cyber.mil).
Can STIG Viewer 3 open a .ckl file?
Yes. STIG Viewer 3 imports .ckl checklists from STIG Viewer 2.x and saves them in its own .cklb format.
Does STIG Viewer show SCAP benchmarks?
No. STIG Viewer is for the manual STIG checklist. SCAP benchmarks are run by a scanner such as DISA's SCAP Compliance Checker (SCC); STIG Vault shows each benchmark's rules and check logic in the SCAP Repository.