A standalone desktop app for macOS, Windows, and Linux. View, assess, and export DISA STIG checklists — no Java, no VS Code required.
DISA releases updated STIGs regularly. Manually re-triaging every rule from scratch takes hours — and risks losing prior work when rules are rewritten or renumbered.
The Upgrade Wizard carries your completed findings forward to a new STIG version automatically. It identifies which rules changed, which are new, which were removed, and flags anything that needs re-review before you sign off.
Pick your completed checklist and the new STIG version (XCCDF benchmark or blank CKLB).
See exactly what carried cleanly, what changed, what’s new, and what was removed — before touching a file.
Choose whether to reset changed rules, add upgrade notes to comments, and generate a markdown diff report.
The upgraded checklist and optional report are written to disk. Your source file is never modified.
Download the 14-day trial for your OS and install it. Double-click any .cklb file and it opens automatically.
Import an XCCDF benchmark from public.cyber.mil to generate a blank checklist, or open an existing CKL or CKLB.
Import SARIF, SCAP results, or dependency audits to auto-populate findings. Use the built-in repo scanner for additional checks.
Export CKL for eMASS, CSV for briefings, POA&M for remediation tracking, or a full evidence package ZIP.
DISA’s STIG Viewer is a standalone Java app from another era — slow to launch, limited in features, and disconnected from the rest of your workflow. STIG Workbench is a modern native desktop application that handles the full assessment lifecycle in one place.
Work through rules with keyboard shortcuts, triage with inline dropdowns, carry findings forward when STIG versions update, and export everything your ATO package needs.
Runs on macOS, Windows, and Linux. No Java, no VS Code, no browser. Opens .cklb files by default.
Map CodeQL, Semgrep, and Bandit findings directly to STIG rules via CWE IDs. Stop copy-pasting.
Carry completed findings to a new STIG version automatically. Change detection flags only what needs re-review.