Generate a DISA STIG checklist from XCCDF.

The checklists in stig-baselines are not hand-authored. They are generated from official DISA XCCDF sources, committed to the repository, and rebuildable offline with two make targets.

What a CKL is

A .ckl checklist file is what DISA STIG Viewer opens. Each rule the STIG defines becomes a VULN entry in the checklist, carrying the full rule text, the check procedure, and the fix — and starting at status Not_Reviewed. Working the checklist means changing that status per rule: Open, NotAFinding, Not_Applicable, or leaving it for review — with findings and comments filling in the why. The saved file is the evidence artifact auditors and eMASS workflows consume.

What the repo ships

Every input is committed. Nothing is fetched at build time.

Baseline checklists — ready to open: RHEL 7/8/9 (OS STIG), Firefox, merged RHEL + Firefox combinations (the plus_ baselines show both STIGs in one checklist with the viewer's STIG dropdown), and ESXi 6.7 / vCenter 6.7.
Official DISA sources — the original XCCDF benchmarks (sources/scap/), the original DISA zip bundles with their PDFs (sources/zips/), the CKL schema, and the build tools themselves. The provenance is the point: you can diff a generated checklist against the DISA input that produced it.
Per-revision downloads — the repository serves every maintained revision, so a pinned environment can pull the exact one it was assessed against.

Regenerate and validate

# build the baseline CKLs from the committed XCCDF sources
make baselines

# validate every generated file against the CKL schema
make validate

Requirements on the machine: python3 (3.9+, standard library only), xmllint for validation, and GNU make. The build invokes bash tools/build.sh directly, so executable bits do not matter. For air-gapped transfer, make dist produces a clean archive of the committed tree plus a .sha256 sidecar for the integrity check on the destination.

Open it in STIG Viewer

DISA STIG Viewer 3.x (Java 17+) opens the file directly: File > Open, pick the platform's baseline. On the merged baselines, the STIG dropdown switches between the OS and Firefox rule sets. The installer is DoD-gated, so side-load it — the checklist itself carries no such dependency. Fill in the ASSET tab once (hostname, IP, FQDN) and save; the viewer assigns the asset key on first save.

The honest gap: Not_Reviewed is not an assessment. The generator sets that status deliberately — a generated checklist is a starting artifact with every rule's content and check procedure in place, not a finding. The assessment is the human work in the Viewer, and the automation paths (OpenSCAP, Nessus) that fill some of it in are the subject of the next tutorial.

Source and related work

github.com/dmrobbi/stig-baselines — the repository (MIT); baseline directory and docs in the tree.
docs/SCANNING.md — the full scanning workflow, including the offline and air-gapped sections this page compresses.
Three ways to work a STIG checklist — the next step once a checklist exists.