Home Uncategorized

Why does a CKLB file fail in the SAF CLI ckl2POAM command?

Last updated on Nov 09, 2026

Short answer

The MITRE SAF CLI command saf convert ckl2POAM reads DISA checklists in the older XML .ckl format. A .cklb file is JSON, so the command cannot parse it. In SAF CLI 1.8.0 (released November 2, 2026), the ckl2POAM source code runs every input through an XML parser and expects a CHECKLIST root element. A JSON file has no such element.

A documented route is to get an XML .ckl copy of the checklist first, and then run the command on that copy. DISA's desktop STIG Viewer 3.x can export a checklist as "CKL (SV v2 format)" (STIG Viewer 3.x User Guide V1R8, section 5.7).

Note: STIGViewer.com is a MoxyWolf website for browsing DISA STIGs. It is not DISA's desktop STIG Viewer application. STIGViewer.com's documented downloads generate benchmark content from a STIG you select (Choose a STIG export format, updated September 16, 2026). They are not a conversion of an uploaded assessed checklist, and this article does not describe an assessed-checklist conversion or repair workflow for STIGViewer.com. Its cklb download is CKLB (JSON), so ckl2POAM can't read it either. Its json download has a different structure from CKLB. Its cklb-workforce download can be a JSON envelope (checklist plus workforce mapping) or, when workforce content is gated, plain CKLB, so check the entitlement and source response headers and the actual response shape.

Scope and versions covered

Other versions may differ. Run saf convert ckl2POAM -h to see your version's help.

The reported problem (April 2024)

In SAF issue #2444, opened April 1, 2024, a user running STIG Viewer 3.2 passed a .cklb file to saf convert ckl2POAM and got An error occurred parsing the file: null. On April 25, 2024, a MITRE SAF contributor replied that SAF, at that time, "currently do[es] not support CKLB (the json CKL format)" and that the team had started exploring support. As of November 9, 2026, the issue is still open, and no fix has been linked to it.

A separate Heimdall2 issue #7733, opened February 26, 2026 and still open, asks for CKL/CKLB conversion in the SAF CLI.

Newer releases may print a different error. The cause is the same: the input is not XML.

What the command accepts today

The SAF CLI README (CKL to POA&M section) describes the command as "Translate DISA Checklist CKL file(s) to POA&M files." The usage line is:

saf convert ckl2POAM -i <disa-checklist> -o <poam-output-folder> [-h] [-O <office/org>] [-d <device-name>] [-s <num-rows>]

The README example uses a .ckl input, and the README does not mention .cklb anywhere in the convert commands. The related saf convert ckl2hdf command is described in the same README as taking a "Checklist XML File," so converting a CKLB to HDF is not a documented SAF CLI 1.8.0 route either. SAF 1.8.0 also has no HDF-to-POA&M command. Separately, MITRE's hdf-libs repository includes CKLB-to-HDF (convertCklbToHdf) and HDF-to-CKLB (convertHdfToCklb) converters in its v3 @mitre/hdf-converters library (v3.7.2, October 7, 2026). That is a developer library, not a documented SAF CLI 1.8.0 command, and this article has not tested it with ckl2POAM.

Step 1: Check what the file actually contains

Look at the contents, not just the extension.

On Linux or macOS:

head -c 300 yourfile.cklb

In PowerShell:

Get-Content yourfile.cklb -TotalCount 5

What to look for:

  • XML CKL: the text begins with < (often <?xml ...?>) and contains a <CHECKLIST> element with <STIGS>, <iSTIG>, and <VULN> entries. This is the structure ckl2POAM reads, per the 1.8.0 source.
  • JSON CKLB: the first non-blank character is {. DISA publishes a "Stig Viewer 3 CKLB JSON Schema" in the STIGs Document Library (listed as updated January 10, 2024).

Step 2: Back up and record your counts

Before you convert anything:

  1. Copy the original .cklb to a safe location. Work only on copies.
  2. Open the checklist in STIG Viewer 3.x and write down the totals for Open, Not a Finding, Not Applicable, and Not Reviewed, plus the target data (host name, IP, and so on).

Step 3: Export an XML CKL from DISA STIG Viewer 3.x

The STIG Viewer 3.x User Guide V1R8, section 5.7 "Exporting Checklist Data," says:

  1. Open the checklist and click the Export icon.
  2. In the pop-up, pick the format. The listed formats are HTML, CSV, CMRS XML, CKL (SV v2 format), and CKLB.
  3. Choose which fields to include. Fields that are not highlighted are left out of the export, so keep all fields selected.

Use a current STIG Viewer 3.x release and read its release notes for any checklist export changes (for example, the STIG Viewer 3.8.0 release notes). Then check the exported CKL against the original, as in Step 4.

Step 4: Check the CKL, then run ckl2POAM

Compare status counts in the exported CKL with Step 2. The authoritative counts come from STIG Viewer itself or from structured XML parsing. For example, this Python one-liner (a generic illustration, not part of SAF) counts the <STATUS> of each <VULN>:

python3 -c "import sys,collections,xml.etree.ElementTree as E; print(collections.Counter(v.findtext('STATUS') for v in E.parse(sys.argv[1]).getroot().iter('VULN')))" exported.ckl

A text search such as grep -o '<STATUS>Open</STATUS>' exported.ckl | wc -l is only a rough cross-check. It depends on formatting (whitespace, line wrapping, compact XML), so a match is not proof that the file is complete. The status values Open, NotAFinding, Not_Applicable, and Not_Reviewed come from the SAF STIG type definitions. If the counts don't match, stop and find out why.

Then run the documented command on the .ckl copy, for example:

saf convert ckl2POAM -i exported.ckl -o poam-output -d "example-device"

Replace example-device with your real device name. Run this on a non-sensitive sample or a copy first, and only upload results to a destination you are authorized to use.

Review the generated POA&M

The output is a draft spreadsheet, not an approved POA&M. In SAF 1.8.0 (command source, helper source):

  • It writes one .xlsm workbook per input file, named after the input with a date and time stamp, based on a built-in template.
  • It writes items for rules marked Open and also Not_Applicable (marked "Not Applicable"). It skips NotAFinding and Not_Reviewed. Item counts should match Open plus Not_Applicable.
  • Every item gets a default Scheduled Completion Date of one year from the day you run the command, and Resources Required is set to "NA".
  • Severity and the risk fields (likelihood, impact, residual risk) come from the rule's original Severity. Any severity override recorded in the checklist is not used for those mappings.
  • Blank rows (-s, default 4) are left between items for milestones. Milestones are not filled in.

Before you treat the output as usable, review applicability (especially Not Applicable items), ownership and office/org, completion dates, milestones, severity overrides and risk ratings, and fit with your organization's required POA&M template.

Troubleshooting

  • "An error occurred parsing the file" or a similar error on a .cklb: the input is JSON. Export a CKL as in Step 3.
  • The .ckl fails too: open it and confirm it starts with XML and has a <CHECKLIST> root. A renamed .cklb is still JSON.
  • Unexpected item count: Not Reviewed and NotAFinding rules are skipped, and Not_Applicable rules are included. Also confirm no fields were left out during export.
  • Missing host or target details: fill in target data in STIG Viewer before exporting, or use -d and -O so you aren't prompted for each file.
  • Third-party CKLB-to-CKL scripts: these are not MITRE or DISA tools. If you use one, test it on a non-sensitive copy and compare counts.

Check the receiving system

Confirm the exact format and template your destination (for example, your eMASS instance or your organization's POA&M process) expects, using its current documentation or its administrator. DISA's STIG Viewer 3.x User Guide says "CKLB format can now be imported into eMASS." The note appears in the export section (section 5.8, printed pages 65-66) of V1R5 (February 11, 2025) and is still there in V1R8 (August 13, 2026). That is about eMASS checklist import, not what ckl2POAM accepts or your deployment's POA&M workflow. Public eMASS documentation wasn't available to check, so confirm your instance's current requirements before you submit.

Sources