Home Uncategorized

Why does a CKLB import show no reviewed results?

Last updated on Nov 09, 2026

Short answer

When a .cklb file imports without errors but shows zero reviewed rules, the receiving tool usually could not match or accept the rules in the file. The common causes are: the rule identifier field the tool reads is missing or different, the STIG benchmark or revision is not loaded in the tool, the status values are not ones the tool recognizes, or import settings tell the tool to skip unreviewed rules. Inspect the file's JSON, compare it to what the receiving tool expects, and check that tool's version and release notes.

This article is about tools that import checklists, such as STIG Manager. STIGViewer.com (a MoxyWolf website for browsing STIGs) is not DISA's desktop STIG Viewer application. STIGViewer.com's documented downloads (Choose a STIG export format) generate benchmark content from a STIG you select; they are not a conversion of an uploaded assessed checklist. This article does not describe an assessed-checklist conversion or repair workflow for STIGViewer.com.

Scope and versions covered

A dated example (2024, since changed)

In STIG Manager issue 1206, opened 1 February 2024, a user on an older STIG Manager deployment reported that .cklb imports showed zero results with no error, even though DISA STIG Viewer 3 showed 29 reviewed rules. The files had been converted from .ckl to .cklb in STIG Viewer 3.

A maintainer explained that those STIG Viewer .cklb files lacked a rule_id_src property on each rule, which is the field STIG Manager used to identify rules. The suggested workaround was to export .ckl instead. On 28 February 2024 the maintainer said that release 1.4.3 handled these files, and the issue was closed. The matching parser change, a fallback to rule_id, is dated the same day. The 1.4.3 release notes do not list it by name.

That workaround was later reverted on 26 August 2025, and the revert shipped in STIG Manager 1.5.12. So the fallback existed only in releases from 1.4.3 up to 1.5.11. Releases 1.5.12 through 1.6.18 (the latest reviewed) do not accept CKLB rules that lack rule_id_src; check release notes for any later version. STIG Manager 1.6.18 bundles stig-manager-client-modules 1.6.8 (per its client package-lock.json). In that 1.6.8 parser, a CKLB rule without rule_id_src, or with an unrecognized status, is skipped without an error. We could not confirm whether current DISA STIG Viewer releases still write files without rule_id_src, so check your own file rather than assuming the 2024 behavior applies.

Before you start

  1. Make a copy of the original .cklb and work only on copies. If you test an import, use an authorized test collection or instance and a non-sensitive sample where possible.
  2. Open the original in DISA STIG Viewer 3.x and record the counts of Not a Finding, Open, Not Applicable, and Not Reviewed. The user guide V1R8 (section 5.4.1) lists these four statuses.
  3. Note the receiving tool's exact version.

Step 1: Confirm it is really a CKLB

DISA's SRG/STIG Tools page says .cklb is JSON, not XML. Open the file in a plain text editor:

  • A .cklb starts with { and contains keys such as "target_data" and "stigs".
  • A .ckl starts with <?xml or <CHECKLIST>.

If the extension and content disagree, rename nothing yet. Find out which format the receiving tool expects. Also note that STIGViewer.com's json download is a different structure from CKLB, and its cklb-workforce download can be a JSON envelope or, when workforce content is gated, plain CKLB, so check the entitlement and source response headers and the actual response shape (export formats article). STIGViewer.com downloads are benchmark content, not your review results.

Step 2: Inspect the fields the importer reads

For STIG Manager 1.6.18, the bundled client-modules 1.6.8 parser reads these fields. A trimmed example (values are illustrative):

{
  "target_data": { "host_name": "web01" },
  "stigs": [
    {
      "stig_id": "Example_STIG",
      "version": "2",
      "release_info": "Release: 3 Benchmark Date: ...",
      "rules": [
        {
          "rule_id_src": "SV-000000r000000_rule",
          "rule_id": "SV-000000r000000",
          "status": "not_a_finding",
          "finding_details": "...",
          "comments": "..."
        }
      ]
    }
  ]
}

Check that:

  • Every rule has a non-empty rule_id_src. If only rule_id is present, STIG Manager releases 1.5.12 through 1.6.18 (the latest reviewed) skip the rule. Do not assume an upgrade will fix an older file that lacks this field.
  • status is one of not_a_finding, open, not_applicable, or not_reviewed. Other values are dropped.
  • target_data.host_name is present. STIG Manager rejects the file without it.
  • stig_id, version, and the "Release:" text in release_info identify a STIG revision that is installed in the receiving tool.

For any other tool, compare against that tool's documentation and DISA's "STIG Viewer 3 CKLB JSON Schema" listed on the SRG/STIG Tools page (dated 10 January 2024). Check the exact schema, not just the extension.

Step 3: Check benchmark and asset matching

The STIG Manager user guide says reviews can be rejected for rules not assigned to the asset or for STIG versions not loaded into STIG Manager. It also says asset names must match exactly, imports from the Collection Dashboard do not create new assets or STIG assignments, and only the latest file is imported when several cover the same asset and STIG. Select the file in the import summary to see rejected reviews, and ask an administrator to install the needed STIG revision if it is missing.

Step 4: Check import options

STIG Manager collection import options control unreviewed rules. Per the user guide, "Include Unreviewed Rules" defaults to "Having Comments", so not_reviewed rules without detail or comment text are not imported. "Never" skips them entirely. If your checklist is mostly unreviewed, an empty result can be expected behavior. Collection owners can lock these options.

Step 5: Check the version and release notes

Compare your deployment's version with the current releases. The reporter in issue 1206 was on an older release. Read release notes between your version and the latest for CKL/CKLB parser changes.

Verify after import

  • Compare the tool's counts of Not a Finding, Open, Not Applicable, and Not Reviewed against the counts you recorded.
  • Spot-check several rules for matching finding details and comments.
  • Keep the original file until the counts match.

A note on eMASS

DISA's STIG Viewer 3.x User Guide V1R8 (13 August 2026, section 5.7, printed page 72) states "CKLB format can now be imported into eMASS." The same note appeared in earlier editions, including V1R5 (11 February 2025). We could not review public eMASS documentation, so confirm with your eMASS administrator or instance guidance which format and fields your workflow accepts, and test with a non-sensitive sample in an authorized test destination rather than a production upload.

Sources