What is STIG checklist management software?

Software that tracks which DISA STIGs apply to a system, holds the per-rule status and comments for each checklist, merges catalog updates without losing completed work, and connects checklist findings to the RMF controls and POA&M items they bear on. STIG Viewer edits one checklist file; checklist management software holds the whole estate and its history.

Is CertiField a STIG Viewer alternative?

They solve different problems. STIG Viewer is a local editor for a single CKL or CKLB file. CertiField holds checklists for the whole system, ranks which STIGs apply against actual inventory, merges catalog updates into existing checklists so completed work survives, and carries findings through to controls and POA&M. Teams typically keep STIG Viewer for spot edits and use CertiField as the system of work.

What happens when DISA releases a new STIG version?

The catalog sync merges the update into existing per-project checklists rather than replacing them, so the status, comments and findings already recorded survive the release. Sync is administrator-triggered rather than running on a timer, because a change to your assessment surface should be a decision someone made.

DISA STIGs

STIG checklist management, without losing the work on every release.

There are several hundred DISA STIGs. A given system is subject to a small fraction of them, and the expensive part is not filling in the checklist — it is knowing which ones apply, and not starting over when DISA publishes a new version.

CKL · CKLB
Catalog sync
Applicability ranking
Merge on update
Offline bundles

Ref: S-11
Kind: Applicability
Ranked against: real inventory

Which STIGs apply is a ranking problem, not a questionnaire.

Applicability should come from what the system actually runs — imported inventory plus the technologies your team recorded by hand — rather than from a form somebody filled in at kickoff and nobody revisited. When inventory drifts, applicability is re-derived.

And it arrives as a ranked suggestion a cyber engineer confirms, not a verdict. Nobody should be told a STIG applies; they should be told it probably applies, and why.

STIG applicability suggestions ranked per technology. Windows Server, Red Hat Enterprise Linux, Windows 11, Microsoft Defender, Azure SQL Database, Docker Engine, Cisco Catalyst, Ubuntu Server and VMware ESXi each show a rule count broken down into high, medium and low severity. — 667 suggested rules across the 26 technologies this system runs, each split by severity and each pending a human decision to accept or dismiss. System · STIG Suggestions

Ref: S-12
Kind: The three failures

Three ways checklist management goes wrong.

Guessing high

Claim more STIGs apply than really do, then mark most not-applicable. Enormously expensive, and it buries the ones that genuinely apply in noise.

Guessing low

A technology enters the inventory during a refresh, nobody re-derives applicability, and a STIG that should have been assessed simply never was. Nothing flags it.

Losing work on update

DISA publishes a new version and it replaces the checklist you already worked through. Status, comments and findings gone. This is a merge problem, not a replace problem.

Ref: S-13
Kind: Decisions
Dismissal: recorded with a reason

A dismissal is a decision, not a filter.

"This STIG does not apply to this system" is a judgment with an author and a reason. It should be stored as one — not applied as a view filter the next person does not know about, and cannot audit.

The same holds for a false-positive call on a scan finding. If that judgment lives on a row the next import recreates, it dies with the row and the finding silently returns unflagged. Decisions have to be keyed on what survives.

Ref: S-14
Kind: Disconnected

And in an enclave that cannot reach Cyber.mil.

Catalog bundles export and import by hand, and they carry the applicability relevance profiles with them — so a disconnected deployment running with AI switched off still gets ranking of the same quality. Isolation should not be the degraded mode.

See it against your inventory Read the longer version

Next step

See what your RMF process looks like when the package keeps up with the system.

Request a demo Explore the product