U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Checklist Repository

The National Checklist Program (NCP), defined by the NIST SP 800-70, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

NCP provides metadata and links to checklists of various formats including checklists that conform to the Security Content Automation Protocol (SCAP). SCAP enables validated security products to automatically perform configuration checking using NCP checklists. For more information relating to the NCP please visit the information page or the glossary of terms.

Search for Checklists using the fields below. The keyword search will search across the name, and summary.

There are 868 matching records. Displaying matches 1 through 20.

Name (Version) Target Authority Last Modified Resources
Cisco IOS XR Router STIG (Y26M01) Cisco IOS XR
Defense Information Systems Agency
02/17/2026 Standalone XCCDF 1.1.4 - Cisco IOS XR Router STIG
Axonius Federal Systems Ax-OS STIG (Ver 1, Rel 2) Axonius Federal Systems Ax-OS
Defense Information Systems Agency
02/17/2026 Standalone XCCDF 1.1.4 - Axonius Federal Systems Ax-OS STIG - Ver 1, Rel 2
Apple iOS/iPadOS 26 STIG (Ver 1, Rel 2) Apple iOS 26
Apple iPadOS 26.0.0
Defense Information Systems Agency
02/17/2026 Standalone XCCDF 1.1.4 - Apple iOS/iPadOS 26 STIG - Ver 1, Rel 2
Cisco IOS XE Switch STIG (Y26M01) Cisco IOS XE
Defense Information Systems Agency
02/17/2026 Standalone XCCDF 1.1.4 - Cisco IOS XE Switch STIG
Cisco NX OS Switch STIG (Y26M01) Cisco NX-OS
Defense Information Systems Agency
02/17/2026 Standalone XCCDF 1.1.4 - Cisco NX OS Switch STIG
Amazon Linux 2023 (Ver 1, Rel 2) Amazon Linux
Defense Information Systems Agency
02/17/2026 Standalone XCCDF 1.1.4 - Amazon Linux 2023 STIG - Ver 1, Rel 2
Microsoft IIS 8.5 STIG (Y23M10) IIS 8.5
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Microsoft Windows 2012 and 2012 R2 STIG (Ver 3, Rel 6) Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Microsoft Windows Defender Firewall with Advanced Security STIG (Ver 2, Rel 2) Windows Firewall
Defense Information Systems Agency
02/13/2026 SCAP 1.2 Content - Microsoft Windows Defender Firewall with Advanced Security STIG Benchmark - Ver 2, Rel 3
Automated Content - SCC 5.14 Windows
GPOs - Group Policy Objects (GPOs) - January 2026
Intune Policies - Intune Policy - January 2026
Standalone XCCDF 1.1.4 - Microsoft Windows Defender Firewall with Advanced Security STIG - Ver 2, Rel 2
Microsoft SQL Server 2022 (Y26M01) Microsoft SQL Server 2022
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Standalone XCCDF 1.1.4 - Microsoft SQL Server 2022 STIG
Microsoft SQL Server 2016 (Y26M01) Microsoft SQL Server 2016
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Standalone XCCDF 1.1.4 - Microsoft SQL Server 2016 STIG
Microsoft Windows Server Domain Name System STIG (Ver 2, Rel 3) Microsoft Active Directory
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Standalone XCCDF 1.1.4 - Microsoft Windows Server DNS STIG - Ver 2, Rel 3
Microsoft One Drive for Business 2016 STIG (Version 2, Release 4) Microsoft One Drive for Business 2016
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Microsoft IIS 10.0 Server STIG (Y26M01) Microsoft IIS 10
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Standalone XCCDF 1.1.4 - Microsoft IIS 10.0 STIG
Microsoft Windows 11 STIG (Ver 2, Rel 7) Microsoft Windows 11
Defense Information Systems Agency
02/13/2026 SCAP 1.3 Content - Microsoft Windows 11 STIG SCAP Benchmark - Ver 2, Rel 7
Automated Content - SCC 5.14 Windows
GPOs - Group Policy Objects (GPOs) - January 2026
Intune Policies - Intune Policy - January 2026
Standalone XCCDF 1.1.4 - Microsoft Windows 11 STIG for Chef - Ver 1, Rel 3
Standalone XCCDF 1.1.4 - Microsoft Windows 11 STIG - Ver 2, Rel 6
Microsoft Windows 10 STIG (Version 3, Release 7) Microsoft Windows 10
Defense Information Systems Agency
02/13/2026 SCAP 1.3 Content - Sunset-Microsoft Windows 10 STIG SCAP Benchmark - Ver 3, Rel 7
Automated Content - SCC 5.14 Windows
GPOs - Group Policy Objects (GPOs) - January 2026
Intune Policies - Intune Policy - January 2026
Standalone XCCDF 1.1.4 - Sunset - Microsoft Windows 10 STIG - Ver 2, Rel 9
Standalone XCCDF 1.1.4 - Sunset-Microsoft Windows 10 STIG - Ver 3, Rel 6
Microsoft Windows Server 2022 (Ver 2, Rel 7) Microsoft Windows Server 2022
Defense Information Systems Agency
02/13/2026 SCAP 1.3 Content - Microsoft Windows Server 2022 STIG SCAP Benchmark - Ver 2, Rel 7
Automated Content - SCC 5.14 Windows
GPOs - Group Policy Objects (GPOs) - January 2026
Standalone XCCDF 1.1.4 - Windows Server 2022 STIG with Ansible - Ver 1, Rel 1
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2022 STIG for Chef - Ver 1, Rel 1
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2022 STIG - Ver 2, Rel 7
Microsoft Windows Server 2019 (Ver 3, Rel 7) Microsoft Windows Server 2019
Defense Information Systems Agency
02/13/2026 SCAP 1.3 Content - Microsoft Windows Server 2019 STIG SCAP Benchmark Ver 3, Rel 7
Automated Content - SCC 5.14 Windows
GPOs - Group Policy Objects (GPOs) - January 2026
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2019 STIG for Chef - Ver 1, Rel 2
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2019 STIG - Ver 3, Rel 7
Microsoft Windows Server 2016 STIG (Version 2, Release 10) Microsoft Windows Server 2016
Defense Information Systems Agency
02/13/2026 SCAP 1.3 Content - Sunset - Microsoft Windows Server 2016 STIG Benchmark - Ver 2, Rel 8
Automated Content - SCC 5.14 Windows
Standalone XCCDF 1.1.4 - Sunset - Microsoft Windows Server 2016 STIG for Chef - Ver 1, Rel 3
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2016 STIG for PowerShell DSC - Ver 1, Rel 3
Standalone XCCDF 1.1.4 - Sunset - Microsoft Windows Server 2016 STIG - Ver 2, Rel 10
Microsoft Defender for Endpoint STIG (Version 1, Release 2) Microsoft Windows Defender
Defense Information Systems Agency
02/13/2026 Automated Content - SCC 5.14 Windows
Standalone XCCDF 1.1.4 - Microsoft Defender for Endpoint STIG, Ver 1, Rel 2
* This checklist is still undergoing review for inclusion into the NCP.