Home Uncategorized

Does eMASS accept CKLB checklists?

Last updated on Nov 09, 2026

Short answer

Current DISA documentation says yes. The STIG Viewer 3.x User Guide, V1R8 (13 August 2026), section 5.7 (printed page 72), states: "CKLB format can now be imported into eMASS." The same note has appeared since at least V1R5 (11 February 2025), printed page 66. The public eMASS REST API specification maintained by MITRE (v3.22) also lists a device scan type, disaStigViewerCklCklb, that accepts ".ckl or .cklb" files.

That note is DISA's wording in its STIG Viewer guide, and it is not the same as a guarantee for your eMASS deployment or upload workflow. We could not find a public, eMASS-owned user guide for the web interface, and individual eMASS instances, component policies, and upload paths can differ. Confirm with your own eMASS instance before you rely on CKLB alone, and keep a CKL copy as a fallback.

Scope and prerequisites

This article covers:

  • DISA's desktop STIG Viewer 3.x, as described in the User Guide V1R8 (13 August 2026). The latest release notes we found are for STIG Viewer 3.8.0, which do not mention CKLB or eMASS.
  • The eMASS REST API specification as published in mitre/emass_client (API v3.22), checked November 2026.
  • Format details from STIG Manager 1.6.18 source code (released 2 November 2026).

STIGViewer.com is a separate MoxyWolf website for browsing published DISA STIGs. It is not DISA's desktop STIG Viewer application. According to its export format article (updated 16 September 2026), STIGViewer.com's documented downloads generate benchmark content from a STIG you select; they are not a conversion of an uploaded assessed checklist. This article does not describe an assessed-checklist conversion or repair workflow for STIGViewer.com, and none of the steps below depend on it.

You will need DISA STIG Viewer 3.x installed, your completed checklist, and access to your eMASS instance.

Some history

When STIG Viewer 3 first shipped, compatibility was unclear. In an August 2023 comment on STIG Manager issue 1050, a STIG Manager maintainer wrote that DISA had published no supporting resources for the new format and that the team had "no idea if other .ckl-consuming systems, like eMASS support it." Since then, DISA has published a CKLB JSON schema (listed as updated 10 January 2024) and added the eMASS note to the user guide (present in V1R5, February 2025, and still in V1R8, August 2026). The 2023 comment is history. It does not override the newer DISA documentation.

How to confirm for your eMASS instance

  1. Check the eMASS help or user guide available inside your instance or through your DoD component. These are generally not public.
  2. Ask your ISSM or eMASS administrator which checklist formats your instance and your program accept for STIG artifacts. Local policy may require one format.
  3. If you upload through the API or a tool built on it, check the scan type. The API documentation says .ckl or .cklb files are accepted when scanType is disaStigViewerCklCklb. Your instance's API version may differ from v3.22.
  4. Test safely. Ask your administrator for an authorized test destination (for example, a test system record or training instance, if your organization provides one) and use a non-sensitive sample checklist. Confirm the results appear as expected there before uploading real checklists to production records.

Keep both formats

The safest approach is to keep your CKLB as the working file and export a CKL alongside it. According to the User Guide V1R8, section 5.7:

  1. Open the checklist in STIG Viewer 3.x.
  2. Click the Export icon.
  3. Choose a format. The listed options are HTML, CSV, CMRS XML, CKL (SV v2 format), and CKLB.
  4. Leave the fields selected (any field not highlighted is excluded from the export), then export.

Tell CKL and CKLB apart by content

Do not trust the file extension alone. Open the file in a text editor or look at the first few lines:

head -c 300 mychecklist.ckl
  • A CKL is XML. It usually starts with <?xml and uses the nesting <CHECKLIST><STIGS><iSTIG><VULN>, with a <STATUS> element per rule (STIG Manager 1.6.18 docs). DISA's FAQ on the SRG/STIG Tools page confirms the older format was XML.
  • A CKLB is JSON, per the same DISA FAQ. It starts with {. In STIG Manager 1.6.18's CKLB export code, top-level keys include target_data and stigs, and each STIG has a rules list with a status field.

Status values are spelled differently. Per STIG Manager 1.6.18's result mapping, CKL uses NotAFinding, Open, Not_Applicable, Not_Reviewed, and CKLB uses not_a_finding, open, not_applicable, not_reviewed. For the authoritative structure, compare against DISA's CKLB JSON schema.

Preserve your data

Before and after any export or upload:

  1. Back up the original CKLB, unchanged, in a separate folder.
  2. Record counts by status. The authoritative counts are the ones your source and destination tools report: in STIG Viewer, note the totals for Open, Not a Finding, Not Applicable, and Not Reviewed, and after upload use what eMASS shows. As an independent check, parse the file structure rather than searching text. These Python one-liners are examples written for this article, not DISA commands, and assume the structures described above:
python3 -c "import sys,collections,xml.etree.ElementTree as E; print(collections.Counter((v.findtext('STATUS') or '').strip() for v in E.parse(sys.argv[1]).iter('VULN')))" mychecklist.ckl
python3 -c "import sys,json,collections; d=json.load(open(sys.argv[1])); print(collections.Counter(r.get('status') for s in d['stigs'] for r in s['rules']))" mychecklist.cklb

Avoid relying on grep text-pattern counts. They depend on formatting (compact, wrapped, or reindented XML and JSON can change the result) and are at best a rough cross-check, never proof that two files match. If the totals do not add up to the number of rules the tool shows, stop and investigate.

  1. Compare the counts on the exported CKL with the original CKLB. They should match.
  2. Spot-check a few rules for Finding Details, Comments, and target data (host name, IP, MAC, FQDN).
  3. After upload, compare what eMASS shows with your recorded counts.

Troubleshooting

  • eMASS rejects the CKLB. Do not assume the file is corrupt. Confirm with your administrator that your instance accepts CKLB, then try the CKL (SV v2 format) export.
  • Upload succeeds but results look empty or wrong. Re-check status counts in the source file, confirm target data is filled in, and ask your administrator how your instance matches checklists to assets.
  • API upload fails. Confirm the scanType value and that your instance's API version supports it. Compare against your instance's API documentation, not only the public spec.
  • You downloaded a "cklb" file from STIGViewer.com. That download is a CKLB checklist document generated from the STIG you selected, not your assessment. The json download is a different structure from CKLB, and cklb-workforce can return a JSON envelope rather than a bare CKLB document (STIGViewer.com export formats). Do not upload these in place of your completed checklist.
  • A different tool rejects your file. Check that tool's documentation for the exact schema it expects. A .cklb extension on a file that is really XML (or the reverse) will fail.

Sources