Home Uncategorized

Can checklist exports from different tools use the same structure?

Last updated on Nov 09, 2026

Short answer

Not reliably. Two files with the same extension (.ckl, .cklb, or .csv) can be structured differently depending on which tool and version produced them. Before converting anything, find out exactly which format and schema the receiving system expects, then compare your export against it.

A public example: in a STIG Manager issue opened June 16, 2026, a user asked whether STIG Manager's CKL and CKLB exports could match STIG Viewer's. A project collaborator replied that the two STIG Viewer versions tested (2.18 and 3.6) also produced inconsistent .ckl files, and that most differences looked minor, such as self-closing tags or attribute ordering (comment, June 16, 2026). The user then clarified on June 23, 2026 that their RMF tool only ingests .csv files, so the real need was matching STIG Manager CSV exports to STIG Viewer 3 CSV exports. As of November 9, 2026, the issue is open with no announced change.

The lesson: confirm the destination's required format first.

Scope and prerequisites

This article covers:

STIGViewer.com (the MoxyWolf website for browsing STIG content) is not DISA's desktop STIG Viewer. Its documented downloads generate benchmark content from a STIG you select; they are not a conversion of an uploaded assessed checklist. This article does not describe an assessed-checklist conversion or repair workflow for STIGViewer.com. Its formats differ too: json is not CKLB, and cklb-workforce can be a JSON envelope or, when gated, plain CKLB, so check the workforce headers and the actual response shape (Choose a STIG export format).

You need your export files, a text editor, and the receiving system's import documentation.

How the formats differ by tool

Format What it is Where it comes from
CKL XML checklist STIG Viewer 3.x exports "CKL (SV v2 format)" (User Guide V1R8). STIG Manager exports single-STIG or multi-STIG .ckl archives (STIG Manager user guide). SAF CLI hdf2ckl writes a "DISA checklist file" from HDF (SAF README).
CKLB JSON checklist introduced with STIG Viewer 3 DISA says the format "is now a JSON file and no longer an XML" (SRG/STIG Tools FAQ) and publishes a CKLB JSON Schema on the STIGs Document Library. STIG Manager added CKLB import and export in August 2023 and labeled it provisional and "subject to change without notice" (STIG Manager What's New).
CSV Spreadsheet text, columns vary by tool STIG Viewer 3.x exports checklist CSV, and its CSV import requires 12 exact headers (User Guide V1R8, section 5.6.3.1). STIG Manager CSV exports come from report and dashboard panels, such as Findings and metrics (user guide). SAF hdf2csv lets you choose fields with --fields (SAF README).
XCCDF XML results STIG Manager imports and exports XCCDF (user guide). SAF has hdf2xccdf and xccdf_results2hdf, and the README notes the latter "only supports native OpenSCAP and SCC output" (SAF README).
HDF MITRE's JSON results format Produced and read by SAF CLI and Heimdall (SAF README).

The STIG Viewer 3.x CSV import headers are: Benchmark ID, Rule ID, Status, Comments, Finding Details, Severity Override, Severity Override Reason, FQDN, IP Address, MAC Address, Host Name, Technology Area. All 12 must be present (order does not matter), and renaming any header causes the import to fail (User Guide V1R8). We could not find public documentation saying that STIG Manager's CSV exports use these headers, so assume they do not until you have checked.

Step by step: match an export to a destination

  1. Get the destination's spec. Find the receiving system's current import documentation, a sample file it accepts, or ask its administrator. Write down the format (CKL, CKLB, CSV, XCCDF), the exact column or field names, and the allowed status values.
  2. Back up the originals. Copy every source file to a read-only folder before you edit or convert anything.
  3. Identify what you actually have. Open the file in a text editor. Don't rely on the file extension:
    • A CKL is XML. It typically starts with <?xml and contains elements such as <CHECKLIST>, <ASSET>, <STIGS>, <iSTIG>, and <VULN>. STIG Manager builds its .ckl output with this structure (AssetService.js).
    • A CKLB is JSON. It starts with { and uses lowercase keys such as "target_data" and "stigs" (AssetService.js).
    • A CSV is plain text with a header row. Compare that row with the destination's required headers. In the 2086 issue, a file labeled CKLB turned out to be a STIG Viewer 3 .ckl (collaborator comment).
  4. Map fields explicitly. List each destination field beside its source field, and mark any gaps.
  5. Normalize values. STIG Viewer 3.x CSV import accepts only Open, Not A Finding, Not Applicable, or Not Reviewed as Status values. It treats values like "Pass" or "Fail" as invalid, and blank Status cells become Not Reviewed (User Guide V1R8, Table 5-1). Other destinations may use different values.
  6. Convert only with documented tools. For HDF workflows, these commands come from the SAF CLI 1.8.0 README: 
    saf convert ckl2hdf -i ckl_results.xml -o output-hdf-name.json
saf convert hdf2csv -i rhel7-results.json -o rhel7.csv --fields "Results Set,Status,ID,Title,Severity"
    That five-field hdf2csv example is not a ready-made match for STIG Viewer 3.x's 12-header CSV import (User Guide V1R8, section 5.6.3). Map and validate columns before any import. The README describes ckl2hdf input as a "Checklist XML File" and does not document CKLB input (SAF README). Separately, MITRE's hdf-libs library (v3.7.2, October 7, 2026) includes cklb-to-hdf and hdf-to-cklb converters (hdf-libs), but that is a developer library, not a documented SAF CLI command. Confirm flags with saf convert <command> --help.
  7. Test first with a non-sensitive sample in an authorized test destination, not a casual production upload.

Verify nothing was lost

Before and after every conversion or import, record:

  • The total number of rules per STIG and asset.
  • Counts of Open, Not A Finding, Not Applicable, and Not Reviewed.
  • That comments, finding details, and severity overrides survive on sample rules.
  • That host name, IP, FQDN, and MAC are correct.

If any count changes, stop and restore from backup. STIG Manager says it does not keep the files you import. It parses them and stores the reviews (user guide), so keep your own copies.

Troubleshooting

  • The import fails on headers. Compare headers exactly with the destination's spec. The STIG Viewer 3.x CSV import rejects renamed or missing headers (User Guide V1R8).
  • "Rules could not be matched." In STIG Viewer 3.x CSV import, this indicates a wrong Benchmark ID (User Guide V1R8, Table 5-1).
  • The file opens but no results appear. Confirm the expected format (XML vs. JSON) and STIG version.
  • eMASS. DISA's STIG Viewer 3.x User Guide states "CKLB format can now be imported into eMASS" in V1R5 (11 February 2025, pages 65 to 66) and again in V1R8 (13 August 2026). That is DISA's general statement. Your eMASS deployment or workflow may still specify a format, so confirm with its current guidance or administrator.

Sources