Home STIG questions

STIG questions

Answers to common STIG, SCAP and STIG Viewer questions.
By Andy Pandy
• 7 articles

Does V-222437 require the last logon date and time to stay on screen?

V-222437 is a low severity rule in the Application Security and Development (ASD) STIG. It asks the application to show users when their account last logged on successfully. The goal is simple. If someone else used the account, the user can notice and report it. The rule does not set a display time. A message at logon, such as a banner or a toast, can satisfy the check as written. Confirm the approach with your assessor before you mark the rule Not a Finding. What the rule says - Rule: V-222437, SV-222437r987626_rule, STIG ID APSC-DV-000580. - Benchmark: ASD STIG Version 6, Release 5, published 2026-08-25. - Requirement: The application must display the time and date of the user's last successful logon. - Fix text: Design and configure the application to display the date and time when the user was last successfully granted access. - Related IDs: CCI-000052 and the legacy ID V-69355. How an assessor checks it The check text describes a short test. 1. Log on as a test user and use the application. 2. Note the date and time you were granted access. 3. Log out. 4. Log on again as the same user. 5. Look for the previous logon date and time in the user interface. If the date and time are not displayed in the user interface, it is a finding. If the application has no user interface, the rule is not applicable. Choosing a display style - Persistent field. A "Last logon" line in a header or profile menu is the easiest to verify. The user can see it any time. - Notice at logon. A toast or dialog meets the wording of the check if it appears right after logon and shows the correct previous date and time. If it disappears quickly, the assessor may miss it. Consider a dialog the user must dismiss, or keep the value in a profile page as well. - Show the previous session. Show the last successful logon before the current one, not the current logon time. Document your decision Write down how the application meets the rule in the checklist comments. Include a screenshot of the notice. This helps the next review go faster. Sources - V-222437 in the ASD STIG V6R5 (cyber.trackr.live) - A similar question about STIG ID APP3660 (Stack Overflow)

Last updated on Nov 10, 2026

Is there a STIG and SCAP benchmark for Amazon Linux 2023?

Amazon Linux 2023 (AL2023) has its own DISA STIG. You no longer need to borrow the RHEL 9 STIG for it. This article lists what is available and how to use it with STIG Viewer. The STIG - Name: Amazon Linux 2023 Security Technical Implementation Guide. - Current release: Version 1, Release 5. The benchmark date is 2026-08-20, and DISA released it on 30 Sep 2026. - Size: 187 rules. 21 are high severity, 163 are medium and 3 are low. - History: Version 1, Release 1 has a benchmark date of July 2025. Releases 2, 3 and 4 were released in January, April and July 2026. Download the STIG from the DISA STIG library, then add it to STIG Viewer and create a checklist from it. Scanning SCAP Compliance Checker (SCC) 5.15 lists "Add support for Amazon Linux 2023" in its release notes. The SCC readme says the Linux RPM installer covers RHEL, Oracle Linux, SUSE and Amazon Linux. 1. Install SCC 5.15 or later on the AL2023 host. 2. Run a scan with the Amazon Linux 2023 content. 3. In STIG Viewer, open your AL2023 checklist. 4. Click the Import icon and select Import XCCDF or CMRS Results. 5. Load the XCCDF results file and review the match summary. 6. Click Complete Import. Common problems - Results match on Rule ID but not revision. The scan content and the checklist come from different STIG releases. Build the checklist from the release that matches your SCAP content, or check Include loosely matched results. - You scanned with RHEL 9 content. Older workarounds used RHEL 9 content on AL2023. Those results use RHEL rule IDs, so they will not match an AL2023 checklist. Rescan with AL2023 content. - OpenSCAP users. Check whether your SCAP Security Guide version includes an AL2023 STIG profile before you rely on it. Sources - Amazon Linux 2023 STIG V1R5 (cyber.trackr.live) - Amazon Linux 2023 STIG release list (cyber.trackr.live) - SCC 5.15 Release Notes (DISA) - SCC 5.15 Readme (DISA) - STIG Viewer 3.x User Guide, V1R7 (DISA) - SCAP Benchmark request: AL2023 (NIWC Atlantic) - Looking for updated SSG for Amazon Linux 2 and Amazon Linux 2023 (Server Fault)

Last updated on Nov 10, 2026

What does "Include loosely matched results" mean in STIG Viewer?

When you import scan results or another checklist, STIG Viewer 3.x compares each incoming result with the rules in your checklist. It matches on the Rule ID and on the revision number. This article explains the import summary and when to use loose matching. How matching works A Rule ID looks like SV-222437r987626_rule. The part before the "r" identifies the rule. The number after the "r" is the revision. The revision can change from one STIG release to the next. The import summary shows three groups: - Exact matches. The Rule ID and the revision both match. These import by default. - Loose matches. The Rule ID matches but the revision does not. These are skipped unless you check Include loosely matched results. - No match. No rule in the checklist has that Rule ID. Click Show to list them. Steps 1. Open the checklist. 2. Click Import. Select Import XCCDF or CMRS Results for scan output, or Import Checklist Data for another checklist. 3. Select the file and click Load. 4. Read the summary counts. 5. To import only exact matches, click Complete Import. 6. To import loose matches too, check Include loosely matched results, then click Complete Import. When to use loose matching Loose matching helps when you move results to a newer STIG release. Most rules keep the same intent between releases. Still, a changed revision can mean the check or fix text changed. After the import, review each loosely matched rule against the new check text. Importing checklist data Import Checklist Data brings in Status, Comments, Finding Details and Target Data. If incoming rules have Comments or Finding Details, you choose Replace existing, Append to existing or Ignore incoming. You can also choose to include or exclude the incoming target data. Sources - STIG Viewer 3.x User Guide, V1R7 (DISA) - inspec2xccdf does not generate benchmark metadata that matches DISA's (MITRE SAF) - Derive revision metadata from the supplied benchmark (UDS)

Last updated on Nov 10, 2026

Why do OpenSCAP results import into STIG Viewer as Not Reviewed?

This article is for users who scan with OpenSCAP (oscap, oscap-podman or oscap-docker) and import the results into a STIG Viewer 3.x checklist. The common symptom is an import that finishes but leaves every rule as Not Reviewed. Some users see "Error parsing XCCDF" instead. The usual cause SCAP Security Guide (SSG) 0.1.78 changed the STIG reference URL in its content. Older OpenSCAP releases did not recognize the new URL. When you used the --stig-viewer option, the output file had no rule results that mapped to DISA rule IDs. SSG 0.1.77 results still imported. Users reported the same problem with SSG 0.1.79 on RHEL 8 and RHEL 9, and with container scans. OpenSCAP fixed this in 1.3.13 for RHEL 8 and RHEL 9 and in 1.4.3 for RHEL 10. Newer releases include the fix. Steps 1. Check your OpenSCAP version with oscap --version. 2. If it is older than 1.3.13 (or 1.4.3 on the 1.4 line), update the openscap-scanner package. If an update is not available yet, scan with SSG 0.1.77 content as a short-term workaround. 3. Run the scan again with the STIG profile and the --stig-viewer option. 4. In STIG Viewer, open the checklist. Click the Import icon and select Import XCCDF or CMRS Results. 5. Select the new results file and click Load. 6. Read the summary. It shows how many results match on Rule ID and revision, how many match only on Rule ID, and how many did not match at all. 7. Click Complete Import. Common problems - Results match on Rule ID but not revision. The scan content and the checklist use different STIG releases. Check Include loosely matched results before you click Complete Import, or build the checklist from the same STIG release as the scan content. - Many results did not match a Rule ID. Click Show to list them. Make sure the checklist uses the STIG for the scanned operating system. - The file still has no results. Open the XML and look for rule-result elements. If there are none, the scanner output is the problem, not STIG Viewer. Sources - STIG Viewer 3.x User Guide, V1R7 (DISA) - SSG 0.1.78 and 0.1.79 results incompatibility with DISA STIG Viewer (ComplianceAsCode) - Unable to import XCCDF from OSCAP scan jobs using SSG v0.1.78 (ComplianceAsCode) - Can no longer import my Oscap results into STIG Viewer (OpenSCAP) - Add new STIG URL, the OpenSCAP fix - OpenSCAP 1.3.13 release

Last updated on Nov 10, 2026

What is the difference between DISA STIGs and CIS Benchmarks?

DISA STIGs and CIS Benchmarks are both security configuration baselines. They come from different authors and are required in different settings. If a contract, authorizing official or auditor names one, use that one. Who writes them - DISA STIGs. The Defense Information Systems Agency publishes Security Technical Implementation Guides. They are released with a public domain license and are used by public and private organizations. - CIS Benchmarks. The Center for Internet Security builds them with a community of experts. They are vendor agnostic and consensus based. Both are widely used to support compliance programs such as PCI DSS, HIPAA, SOC 2 and NIST. How they differ in practice - Format and tools. DISA publishes STIGs in XCCDF format. DISA STIG Viewer opens them, builds checklists and imports SCAP or XCCDF scan results. STIG Viewer also displays CCI references when a STIG includes them. - Same setting, different value. Scanning projects such as ComplianceAsCode keep one library of technical rules. A STIG profile and a CIS profile group those rules and can set different values for the same setting, such as minimum password length. - Separate profiles. A single SCAP data stream can hold both. Run oscap info on the file to list its profiles, for example a CIS profile and a DISA STIG profile. - Separate automation. Ansible Lockdown ships separate CIS and STIG roles. Its audit content is tied to each benchmark release. Choosing one 1. Check your contract, system security plan or audit scope. If you support a DOD system, ask whether STIGs are required. 2. If nothing is required, pick the baseline your scanner and remediation tools support for your platform. 3. Do not mix profiles on one system unless you track which requirement each setting satisfies. Sources - Ansible Lockdown: Introduction - ComplianceAsCode developer guide: Introduction - OpenSCAP 1.3 User Manual - STIG Viewer 3.x User Guide, V1R7 (DISA) - Difference between hardening guides (CIS, NSA, DISA) (Security Stack Exchange) - Question about the recommendations included in SSG (ComplianceAsCode discussion) - Best Source of Security Configuration Guidance (Security Stack Exchange)

Last updated on Nov 11, 2026

Why is my SCAP or automation content behind the latest STIG release?

Scanning and hardening projects update their content after DISA publishes a new STIG release. That means your SCAP profile or Ansible role can trail the latest STIG by one or more releases. Match your checklist to the release your content targets, or plan for loosely matched results. Example As of 30 Sep 2026, DISA's latest releases include: - Canonical Ubuntu 22.04 LTS: Version 2 Release 10 (V2R10). - Canonical Ubuntu 24.04 LTS: Version 1 Release 7 (V1R7). - Red Hat Enterprise Linux 9: Version 2 Release 10 (V2R10). - Red Hat Enterprise Linux 10: Version 1 Release 3 (V1R3). The ComplianceAsCode v0.1.82 release notes from 1 Sep 2026 update RHEL 9 to V2R9 and RHEL 10 to V1R2. Content from that release is one release behind for both. Ansible Lockdown aims to merge a new tagged release 2 to 4 weeks after a new benchmark comes out. Steps 1. Find the release your content targets. Check the project's release notes, or the benchmark version in the profile or branch name. 2. Look up DISA's latest release for the same product in a STIG catalog. 3. Download the STIG release that matches your scan content and build your checklist from it. Iron Bank's guide notes that the STIG version must match the version of the SCAP profile. 4. Import the XCCDF results. STIG Viewer reports results that match Rule ID and revision, results that match Rule ID only, and results that match nothing. 5. If you must use the newest checklist, review the results that match on Rule ID only before you accept them. Common problems - Many results land as Not Reviewed. The Rule IDs or revisions differ between the scan content and the checklist. Build the checklist from the matching release. - A whole release is missing. Some projects skip releases or are still working on them. Ask in the project's discussion forum. Related - What does "Include loosely matched results" mean in STIG Viewer? - Why do OpenSCAP results import into STIG Viewer as Not Reviewed? Sources - DISA STIG catalog (cyber.trackr.live) - Ansible Lockdown: Introduction - Platform One Iron Bank: STIG Viewer tutorial - STIG Viewer 3.x User Guide, V1R7 (DISA) - ComplianceAsCode/content v0.1.82 release - Canonical Ubuntu 22.04 LTS STIG version V2R3 not latest (ComplianceAsCode discussion) - Specific STIG version and release (ComplianceAsCode discussion)

Last updated on Nov 11, 2026

Why won't DISA STIG Viewer open, and can I run it on a Mac?

If DISA STIG Viewer will not start, first check which version you have. STIG Viewer 3.x replaces STIG Viewer 2.x, and the 3.x User Guide only describes Windows and Linux packages. There is no macOS package in that guide. Use STIG Viewer 3.x Many launch problems come from running an old 2.x JAR file with a modern Java install. Errors such as "Could not find or load main class" or a missing JavaFX class point to this. DISA now publishes 3.x as a Windows or Linux package instead. 1. Go to the Cyber Exchange website, then SRGs/STIGs, More, SRG/STIG Tools. 2. Download STIG Viewer 3.x-Win64, STIG Viewer 3.x-Linux or the Windows MSI package. 3. Check the download against the published SHA256, SHA384 or SHA512 hash values. 4. Extract every file from the ZIP to your local disk. The standalone app does not run from inside the ZIP. 5. For the MSI, open the enclosed .msi file. Installing it needs administrator rights. Common problems - Nothing happens on Windows. Windows may mark the download as coming from the internet. Ask your administrator first. If approved, open the file's Properties, check Unblock on the General tab and select OK. The PowerShell Unblock-File cmdlet does the same. - "Operation Not Permitted" or "cannot open shared object file" on Linux. The File Access Policy Daemon (fapolicyd) can block the app. Unzip it to a shared folder such as /opt/stigviewer, add that folder with sudo fapolicyd-cli --file add /opt/stigviewer, then run sudo fapolicyd-cli --update. - "Unable to access jarfile". Java cannot find the file at the path you typed. Run the command from the folder that holds the file, or give the full path. Then move to 3.x. - Not sure you have the latest release. Open the hamburger menu, then Help, then Check for Updates. Options on a Mac - Run the Windows or Linux build in a virtual machine, or on a separate Windows or Linux computer. - If you only need to read STIG requirements, the STIGViewer website shows the full DISA catalog in any browser at no cost. It does not replace the DISA desktop app for building and editing checklists. Related - Find a STIG in the catalog Sources - STIG Viewer 3.x User Guide, V1R7 (DISA) - STIGViewer home page - Running STIGViewer on a Mac (Stack Overflow) - STIGViewer 2.18 will not open (Stack Overflow)

Last updated on Nov 11, 2026