A free replacement for DISA STIG Viewer

Summary

DISA STIG Viewer is the tool almost everyone doing STIG work uses, because it is the one that is provided. It opens a checklist. It does not show you what you have, tell you which checklists are out of date, read both checklist formats in one version, or put your eMASS POA&M beside the findings you are editing.

STIGreviewer does all of that, and it is free, permanently. It opens and edits CKL and CKLB checklists in one application, loads hundreds of them at once into an inventory, flags the ones built on superseded STIGs, shows what changed between STIG versions, updates a checklist to the new version in one click, and checks every checklist you have open against rules your organization sets. This paper describes what it does, how it handles your data, and where it stops and STIG Solution’s paid tools begin.

The problem

Anyone who has done real STIG work knows the friction:

• One version of STIG Viewer for CKL files and a different version for CKLB, because a single tool can’t handle both.
• No inventory. Files are opened one at a time, with no way to see what you have at a glance.
• When a new STIG version is released, no easy way to know which checklists are out of date.
• The eMASS POA&M lives in a spreadsheet in another window, so every finding means switching back and forth.
• No way to see what actually changed between STIG versions without comparing them by hand.

None of this is the cyber security work. It is the overhead of the tool. STIGreviewer is the answer to a simple question: what would DISA STIG Viewer look like if it were designed by the people who actually used it?

What it does

Your whole inventory, both formats

STIGreviewer edits CKL and CKLB checklists in a single application. Load individual files, whole folders, or ZIP archives (including nested ZIPs), or drag and drop them, and see a full inventory of every checklist you have open without opening them one at a time. Your last session reopens automatically.

Your own STIG library

Hold DISA STIG XML locally. The library drives new checklist creation and version updates, and STIGreviewer compares it against your inventory to show instantly which checklists have a newer STIG version available, and which are built on a STIG you don’t hold.

What changed, and a one-click update

Load the STIG revisions file that STIG Solution publishes free every quarter and see exactly what changed between versions of a checklist. When you are ready, update the checklist to the latest STIG version in a single click: no manual migration, no copy and paste. A CKL converts to CKLB the same way.

Create checklists from SCAP results

Create new checklists from DISA STIG XML, or from SCAP (XCCDF) scan results, rather than starting from a blank file.

The eMASS POA&M beside your checklists

Load the eMASS POA&M export alongside your checklists and see which findings already have a POA&M entry as you edit, without switching to a spreadsheet.

The things you would otherwise do by hand

• Reusable notes for a STIG, loaded in every checklist for that STIG.
• Combine selected checklists into a single file, such as every STIG for one host, and split a multi-STIG checklist back into one file per STIG. Either way, you choose whether to unload the originals and whether to delete them from disk.
• Evaluate-STIG answer files, opened, created, and edited beside the checklist you are reviewing instead of hand-editing XML. They stay separate files, so editing one never touches your CKL or CKLB.
• Export for reporting: PDF for a printable report, Word for something editable, Excel or CSV for analysis. Exporting is separate from saving; the checklist on disk is kept current by autosave.

A quality gate before a reviewer sees it

Load your checklists and STIGreviewer checks them against rules you set, showing green, amber, or red across everything you have open, with the detail a click away. It flags:

• Outdated STIG versions: checklists built on a STIG that has since been superseded.
• STIGs missing from your library: checklists built on a STIG you don’t hold, so you know whether there is anything to compare against before you verify or update.
• Missing host information: exactly which fields are missing on which hosts. You choose what counts as required: hostname, IP address, MAC address, FQDN.
• Severity overrides, where your rules don’t permit them.

Business Rules set the standard once (which host fields are mandatory, whether severity overrides are permitted, what counts toward completion) and every checklist you open is measured against it. That is the difference between a house style and a rule that actually holds.

AI that leaves the judgment with you

AI in STIGreviewer is opt-in throughout. Until a provider is connected, none of its controls appear.

• It drafts; you decide. Auto-fill drafts finding details, comments, and notes. Nothing it produces reaches a checklist on its own: you click Add or Apply. It removes the blank page; the call stays yours.
• One exception, named. Optionally, it can fill Finding Details the moment you set a status, for working through items in bulk. That setting writes directly and overwrites the field, so it ships switched off.
• You choose where it runs. Connect OpenAI, Azure OpenAI, Claude, or Ollama. With a cloud provider, the checklist content you send goes to that provider under your own account. With Ollama on your own machine, nothing leaves the computer.
• STIG Solution is never in the middle. There is no STIG Solution AI service and nothing is routed through us. Your API key is kept in your operating system’s secure storage, not in the application’s settings.

Side by side with DISA STIG Viewer

	DISA STIG Viewer	STIGreviewer
CKL and CKLB in one application	Separate versions	Yes
Checklist inventory at a glance	One file at a time	Yes
See which checklists are out of date	Manual comparison	Yes
eMASS POA&M alongside your checklists	No	Yes
See what changed between STIG versions	Manual comparison	Yes
Single-click version update	No	Yes
Single-click CKL to CKLB conversion	No	Yes
Runs on macOS	Windows and Linux only	Yes
Price	Free	Free

Accessibility

STIGreviewer has 28 themes across light, dark, mid-contrast, and high-contrast families, including high-contrast options that meet WCAG AA for low-vision use.

Where STIGreviewer fits

STIGreviewer edits and validates checklists, one checklist at a time, and it is free with no catch. When the unit of work becomes the whole package, STIG Solution’s paid applications take over:

• STIGrevolution does the checklist work in bulk, across hundreds of checklists at once, and runs the package around them: analysis across the whole set, eMASS POA&M updates generated from the results, and the Assessment Procedure (AP) results that go with them.
• NESSviewer does the same for Nessus and ACAS scan data, from scan status and software lists to the baseline and the POA&M.

A capable free tool is deliberate. STIGreviewer is not a trial or a limited edition of anything; the paid applications do a different job.

Deployment and data handling

• Free, with nothing to activate. No license key, no trial period, no activation, and no limit on the number of computers you install it on.
• Nothing sent to STIG Solution. STIGreviewer has no license check, and your checklists stay on your machine. It reaches out only if you connect an AI provider, and then only to that provider.
• A signed installer. STIGreviewer installs from a signed MSIX on Windows 10 version 1809 or later, Windows 11, or Windows Server 2019 or later, 64-bit, and uninstalls completely. It deploys through the tooling your organization already uses. On macOS it installs from a signed .pkg.

Use is subject to the STIGreviewer EULA, at stigsolution.com/eula/stigreviewer/.

About STIG Solution

STIG Solution LLC builds tools for the people accountable for RMF packages on DoD and federal systems: STIGreviewer, a free replacement for DISA STIG Viewer; STIGrevolution, for working checklists at the scale of a whole package; and NESSviewer, for turning Nessus scan data into package artifacts. We also publish a STIG revisions file every quarter, free, at stigsolution.com/free-resources/.

Questions, a demonstration, or licensing: mail@stigsolution.com. Documentation is at stigsolution.com/docs/.

This paper describes STIGreviewer as of October 2026. STIG Solution is not affiliated with or endorsed by DISA or the U.S. Department of Defense. Nessus and ACAS are products of Tenable, Inc.; eMASS is a Department of Defense system. © 2026 STIG Solution LLC.