Home Uncategorized

How do I convert CKL and CKLB checklists?

Last updated on Nov 09, 2026

Short answer

CKL and CKLB are two file formats for the same kind of thing, a STIG checklist. A .ckl file is XML (the STIG Viewer 2.x format) and a .cklb file is JSON (the STIG Viewer 3.x format), as DISA explains in its SRG/STIG Tools FAQ. The most direct documented way to convert between them is DISA's own desktop STIG Viewer 3.x: import the CKL, then save as CKLB, or export a CKLB as "CKL (SV v2 format)" (STIG Viewer 3.x User Guide V1R8, 13 Aug 2026). STIG Manager can also import one format and export the other.

STIGViewer.com is a separate MoxyWolf website for browsing DISA STIGs. It is not DISA's desktop STIG Viewer application. STIGViewer.com's documented downloads generate benchmark content from a STIG you select; they are not a conversion of an uploaded assessed checklist. This article does not describe an assessed-checklist conversion or repair workflow for STIGViewer.com. Its download formats are also different structures: json is not CKLB, and cklb-workforce can be a JSON envelope (checklist plus workforce mapping) or, when workforce content is gated, plain CKLB. Callers should check the workforce entitlement and source response headers and the actual response shape (Choose a STIG export format, updated 16 Sep 2026).

Scope and prerequisites

This article covers the following, checked in November 2026:

Before you start, you need a copy of the checklist, the tool you plan to use, and the exact format your destination expects. Ask the receiving system's administrator, or check its current documentation, for the expected file type and schema. A file extension alone does not guarantee a file will import.

How to tell CKL from CKLB

Open the file in a plain text editor and look at the first characters.

  • A CKL file is XML. It usually begins with <?xml and has a <CHECKLIST> root with <ASSET> and <STIGS> sections, where each <iSTIG> holds <VULN> elements with a <STATUS>, as seen in the STIG Manager CKL writer. Statuses look like NotAFinding, Open, Not_Applicable, Not_Reviewed.
  • A CKLB file is JSON. It begins with { and has keys such as target_data and stigs, with each STIG holding a rules list (same source). Statuses look like not_a_finding, open, not_applicable, not_reviewed (STIG Manager status mapping).

DISA publishes a "Stig Viewer 3 CKLB JSON Schema" on the SRG/STIG Tools page (listed as updated 10 Jan 2024). Use it if you need to validate a CKLB file.

Option 1: DISA STIG Viewer 3.x

According to the User Guide V1R8:

CKL to CKLB:

  1. Copy the original .ckl to a backup folder.
  2. In STIG Viewer 3.x, click the hamburger menu and select Import V2 Checklist. You can select several 2.x checklists at once.
  3. Open the imported checklist and review it.
  4. Save it from the Save button or the hamburger menu (Save, Save As). STIG Viewer 3 saves checklists as .cklb.

CKLB to CKL:

  1. Open the checklist in STIG Viewer 3.x.
  2. Click the Export icon.
  3. Choose CKL (SV v2 format). The guide lists HTML, CSV, CMRS XML, CKL (SV v2 format), and CKLB as export formats.
  4. Keep all fields included unless you have a reason to exclude some. The export dialog lets you exclude fields, which would leave them out of the file.

The export section of the guide includes the note "CKLB format can now be imported into eMASS." The same note appears in User Guide V1R5 (11 Feb 2025, printed pp. 65-66) and in V1R8 (13 Aug 2026, pp. 71-72). That is DISA's documented statement as of those dates. It does not tell you what your specific eMASS deployment, package, or submission workflow requires, so confirm with your ISSM or eMASS administrator, and test with a non-sensitive sample in an authorized test destination, before submitting a CKLB instead of a CKL. Older forum or GitHub discussions about eMASS and CKLB predate this documentation and should not override it.

Option 2: STIG Manager

STIG Manager parses imported checklists into its database and generates new files on demand. It does not keep the original file (STIG Manager User Guide). CKLB import and export were added as a "provisional" feature in release 1.3.10 (23 Aug 2023), and the current client labels the import button Import CKL(B) or XCCDF... (source). The export options include CKLB and CKLB (multi-STIG) (source).

Note that parts of the published STIG Manager documentation still describe only .ckl and XCCDF, so menu labels on your deployment may differ. A general workflow:

  1. Import the checklist into a Collection (Collection Management, Assets panel, import button).
  2. Confirm the Asset and STIG revision matched as expected. STIG Manager matches Assets using the checklist host name and asset metadata (see "ckl-processing" in the user guide).
  3. Export from the Asset Review workspace Checklist menu, or export an archive for several Assets.

Because the output is regenerated, review the Collection's import options and compare the result against your original.

What SAF CLI and PowerStig do (and do not) document

As of the SAF CLI README (v1.8.0, Nov 2026), there is no documented command that converts CKL to CKLB or CKLB to CKL. The documented checklist commands are saf convert ckl2hdf (input is "Checklist XML File"), saf convert hdf2ckl (outputs a CKL), and saf convert ckl2POAM (SAF CLI README). In a February 2026 heimdall2 discussion, a maintainer said MITRE is "looking into supporting CKLB" but was not actively working on it. That issue was still open in November 2026. Separately from the SAF CLI, MITRE's hdf-libs v3 library (v3.7.2, released 7 Oct 2026, npm package @mitre/hdf-converters v3 line) documents CKLB-to-HDF (convertCklbToHdf) and HDF-to-CKLB (convertHdfToCklb) converters alongside its CKL ones; this is a developer library, not a documented SAF CLI 1.8.0 command, so test any output with a non-sensitive sample before relying on it.

PowerStig's New-StigCheckList produces .ckl files. An April 2026 PowerStig request proposes a CKL-to-CKLB conversion script, but it was still open with no merged feature as of November 2026.

Preserve your data

  • Back up originals and work on copies. Never overwrite the only copy.
  • Count statuses before and after. The authoritative counts are the ones the source and destination tools report. For an independent check, parse the file rather than searching text, because line-based searches miscount compact or wrapped XML. This Python 3 sketch counts one status per VULN (CKL) or per rule (CKLB), using the structure in the STIG Manager 1.6.18 writers linked above. It is not part of any STIG product; adapt it if your files differ.
import sys, json, collections
import xml.etree.ElementTree as ET
path = sys.argv[1]
counts = collections.Counter()
if path.lower().endswith(".cklb"):
    data = json.load(open(path, encoding="utf-8"))
    for stig in data.get("stigs", []):
        for rule in stig.get("rules", []):
            counts[rule.get("status")] += 1
else:
    for vuln in ET.parse(path).getroot().iter("VULN"):
        counts[(vuln.findtext("STATUS") or "").strip()] += 1
print(dict(counts), "total:", sum(counts.values()))

Run it as python3 count.py original.ckl and python3 count.py converted.cklb, then compare totals and each status, remembering the spelling differs between formats.

  • Spot check text fields: finding details, comments, severity overrides, and asset data (host name, IP, MAC, role).
  • Check the STIG version and release in both files match.
  • Test the import with a non-sensitive sample in an authorized test destination before sending the real file. Avoid trial uploads to production.

Troubleshooting

  • The destination rejects the file. Confirm it expects XML CKL or JSON CKLB, and which schema version. Re-export in the expected format.
  • Statuses changed to Not Reviewed. Some tools map unknown or unsupported results to Not Reviewed (STIG Manager does this for several result types, per its status table). Compare your counts.
  • Rules missing after import. Check for a STIG revision mismatch between the checklist and the tool's library.
  • A command fails on a .cklb. SAF ckl2hdf and ckl2POAM are documented for CKL input. Use a CKL or check the current README.

Sources