View, edit, and export DISA STIG checklists without leaving your editor. Built to replace the legacy Java STIG Viewer with a modern, keyboard-driven experience.
Install STIG Workbench from the VS Code Marketplace. Open any .cklb file and the editor activates automatically.
Import an XCCDF benchmark from public.cyber.mil to generate a blank checklist, or import an existing CKL.
Import SARIF results from CodeQL, Semgrep, or Bandit. Run dependency audits. Use the built-in repo scanner for quick checks.
Export CKL for eMASS, summary CSV for briefings, POA&M for remediation tracking, or a full evidence package zip.
DISA's STIG Viewer served its purpose, but it's a standalone Java app from another era. STIG Workbench brings the full assessment workflow into the editor you already live in.
Work through rules with keyboard shortcuts, triage with inline dropdowns, merge findings when STIG versions update, and export everything your ATO package needs — without switching windows.
Custom editor, undo/redo, themes, keyboard navigation — it works like any other VS Code editor.
Map CodeQL, Semgrep, and Bandit findings directly to STIG rules via CWE IDs. Stop copy-pasting.
Bundle the checklist, CKL export, CSV summary, POA&M, and attached artifacts into a single zip.