STIG Checker

Free Department of Defense checklists, in plain English, scanned on your own computer.

Hosted on GitHub Pages · MIT licence

The US Department of Defense publishes free STIG checklists. This site explains them and helps you check your PC.

If you look after a Mac or Windows PC, you can read the matching DoD checklist here in plain English, then download a scanner that runs only on your machine.

Try a simple first scan Or load the full checklist See an example run Essays on my site Reviews No account · nothing uploaded

Demo — try a simple first scan

The US Department of Defense publishes free STIG checklists — ranked settings that lock down a common system. Anyone may download them.

This tool checks your Mac or Windows PC against the matching checklist and lists configuration gaps in plain English: settings that do not yet match the checklist.

Today the download finds misses and writes a report (including a PDF). After a scan, the local program can draft Plan of Action and Milestones entries and candidate fix scripts. Those stay drafts until a named person approves them; applying a script is a separate command-line step, dry-run by default, and refused in CI. This website does not change settings.

For a first demo, use CAT I only. Those are the most serious items, and the list is short.

Pick the computer you will scan. The next page shows only CAT I rules. Nothing downloads until you ask.

The checklists are free

The US Department of Defense publishes STIGs for Windows, macOS, Linux, databases and hundreds of other systems. Anyone may download them.

They are written for auditors

Each guide is a few hundred rules. Applying one means reading every line, ranking the risk, and turning it into a change on a real machine.

This tool does the interpreting

No account, nothing to buy. You read the checklist here, then run a scanner on your own computer.

See an example first — no scan required

A static walk-through uses labeled sample data so you can see the path before you pick a computer. Longer essays live on hsaxena.com, not on this product site.

What is a STIG?

A STIG (Security Technical Implementation Guide) is a checklist the Defense Information Systems Agency (DISA) writes for the Department of Defense. Each one locks down a named product. A typical desk guide has on the order of one or two hundred settings, ranked by how serious a miss would be: CAT I first, then II, then III. DISA releases many of these guides at public.cyber.mil. This site is not a DISA product.

A long checklist of settings becomes a ranked CAT I, II and III plan, then a check of your own computer.

What this tool does

This page never scans. You pick a computer, choose rules, download a program, approve each check on that machine, and get a report.

  1. 1
    Pick MacBook or WindowsLoad the matching validated checklist.
  2. 2
    Read the rules in plain EnglishWhat it asks, how serious, and whether a machine can check it.
  3. 3
    Choose what to scanTick all of them, the serious ones, or a short first pass.
  4. 4
    Download a local scannerA zip for that computer, already pointed at your selection.
  5. 5
    Approve every checkOn your machine, read each command and type your name.
  6. 6
    Get a report and PDFPass, fail, and a remaining-risk story you can hand over.
Five product steps: this website, select rules, download a scanner, approve and scan on your computer, then read the results.
  1. 1 · This website Pick Mac or Windows at stig.hsaxena.com.
  2. 2 · Select Tick the rules to put in the scanner.
  3. 3 · Download Save a zip built for that selection.
  4. 4 · Approve & scan Open it on your computer and type your name.
  5. 5 · Results A local report and PDF.

Which computer are you securing?

Pick one to load its checklist. Servers, Linux and databases stay on the command line — this page is for a desk Mac or Windows PC.

Loading the catalogue…

Site activity

—Site visitors

People who opened this site (GoatCounter).

Approximate public GoatCounter total. Not Department of Defense adoption, and not a count of people who downloaded or ran the scanner. A fuller path breakdown is on the public GoatCounter page if that site is viewable.

Technical notes

This page is static GitHub Pages: it lists STIGs and explanations this repository already ships. Browsers cannot download the official zip from dl.dod.cyber.mil (the host blocks the request — CORS — and many networks block it too). The official package is fetched later, on your machine, by the scanner (or by python3 -m stigprep fetch), and is checked against the pinned SHA-256 when one is recorded and always against the validated rule count. If that host is blocked, use public.cyber.mil/stigs/downloads. Public site: https://stig.hsaxena.com. Two scoped totals, not one ambiguous number: this project explains 1,440 rules across seven STIGs, and ships check packs for five of those guides totaling 1,338 rules (SQL Server is explained but has no check pack).