Windows Server 2016
DISA sunset release, dated January 15, 2025. Included for testing and historical review.
STIG Checklist EditorINDEPENDENT PROJECTReview STIGs
without the grind.
A fully browser-based editor for DoD STIG checklists. Try three preloaded checklists, or import your own Cyber Exchange ZIP. Review rules, record evidence, and export CKL or STIG Viewer 3 CKLB files. No installation, account, or checklist upload to a server is needed.
Launch live demoGo WebAssemblyRuns in your browserCKL + CKLB exportReact/TypeScript UI
ONE FINDING AT A TIMEILLUSTRATIVE REVIEW · SAMPLE DATA
REVIEW NOTE
Access control
Review access against the intended privilege boundary.
Open the working browser demo ↗Three preloaded checklists. Review, edit, export.REVIEW NOTE
Audit records
Attach evidence that audit records are retained and protected.
Open the working browser demo ↗Three preloaded checklists. Review, edit, export.REVIEW NOTE
Configuration
Record the approved setting and the evidence used to verify it.
Open the working browser demo ↗Three preloaded checklists. Review, edit, export.READY TO TRYThree checklists.
Three checklists.
No setup.
Windows Server 2016 opens on first visit. Switch checklists using the demo selector; save your changes before loading a fresh copy. These are complete published STIG rules, not simulated rule text.
Red Hat Enterprise Linux 9
Published benchmark dated September 30, 2026. Every rule starts Not Reviewed.
Palo Alto Firewall
Application Layer Gateway (ALG) checklist dated April 2, 2025, from the sunset Palo Alto package. Device management and IDPS are separate STIGs.
Pinned demo releases retrieved October 18, 2026. Check the DISA catalog for the appropriate baseline for a real assessment. Release sources and checksums.
Open the checklist editor
AI contribution: AI-assisted implementation and usability iteration. How I work with AI
01 / WHY IT EXISTSSTIG review is
STIG review is
bookkeeping-heavy.
Reviewing STIGs normally means STIG Viewer plus manual bookkeeping: fragile unsaved work, format churn between JSON, CKL, and CKLB, and matching hosts to the right STIGs by hand. This editor makes the whole loop one keyboard-driven tool.
Real packages, direct
Imports STIG XCCDF XML straight from Cyber Exchange ZIP packages — profile selection, resolved values, and readable rendering of rich check and fix content, as a cancellable background job.
Four-state workflow
Open, Closed, Not Applicable, and Not Reviewed — with Findings, Comments, reviewer fields, and backend-authored guidance when evidence is missing or inconsistent.
Formats assessors accept
Saves editable checklist JSON and exports classic CKL plus STIG Viewer 3 CKLB 1.0 — with real target-asset metadata carried into every format.
Your review stays in your browser
The Go backend runs as WebAssembly in a Web Worker. Imported packages and findings are processed locally. Use a manual host profile; the app does not inspect your OS or installed software.
Keyboard-first review
Multi-rule selection, batch status changes, batch Findings and Comments with explicit Keep, Append, or Replace modes, column sorting, and browser keyboard shortcuts.
Keep multiple assets together
Switch between independent checklists without losing edits. Download or reopen a complete workspace backup, with browser-local recovery on reload. Browser storage is best-effort and can be evicted.
Correct a batch in one step
Undo and redo review, evidence and target changes, with separate session history for each checklist. A batch edit is one undo step.
Find unfinished review work
See unreviewed rules, open high-severity findings, missing evidence or reviewer details, and export errors. Jump directly to the rule or target that needs attention.
02 / WORKFLOWChoose, review,
Choose, review,
save, export.
The editor walks the full checklist lifecycle without leaving the app.
STEP 01 Choose a preloaded checklist
Start immediately with Windows Server 2016, RHEL 9, or Palo Alto Firewall (ALG). All rules begin Not Reviewed, with fictitious targets clearly marked as demo data.
STEP 02 Or import your own package
Manually download a ZIP from the DISA Cyber Exchange catalog, then choose Import STIG. Select an XCCDF profile and follow the cancellable import progress. No proxy or automatic DoD download is required.
STEP 03 Review with states and evidence
Work the queue with four review states, findings, comments, and batch actions — sorted and filtered your way.
STEP 04 Save and export
Save the editable JSON working copy, then export CKL or CKLB for the ATO package.
STATUSPublic testingGo WebAssemblyStatic browser appReact/TypeScript UICKL + CKLB 1.0No account required
03 / GET IN TOUCHTry it.
Send testing feedback Try it.
Tell me what breaks.
The live demo is open for user testing. Synthetic exports were checked in DISA STIG Viewer 3.8.1 on Linux; this is not a DISA certification. Send feedback about imports, review workflows, or exports. The source repository remains private.