U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Checklist Repository

The National Checklist Program (NCP), defined by the NIST SP 800-70, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

NCP provides metadata and links to checklists of various formats including checklists that conform to the Security Content Automation Protocol (SCAP). SCAP enables validated security products to automatically perform configuration checking using NCP checklists. For more information relating to the NCP please visit the information page or the glossary of terms.
Please note that the current search fields have been adjusted to reflect NIST SP 800-70 Revision 4.

Search for Checklists using the fields below. The keyword search will search across the name, and summary.

There are 832 matching records. Displaying matches 81 through 100.

Name (Version) Target Authority Last Modified Resources
Apache Server 2.4 Windows STIG (Y25M04) Apache HTTP Server 2.4.0
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - Apache Server 2.4 Windows STIG
Juniper EX Series Switches STIG (Y25M04) Juniper EX2300
Juniper EX3400
Juniper EX4100
Juniper EX4300
Juniper EX4600
Juniper EX4650
Juniper EX9200
Juniper EX9250
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - Juniper EX Series Switches STIG
CloudLinux AlmaLinux OS 9 STIG (Ver 1, Rel 2) AlmaLinux OS 9
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - CloudLinux AlmaLinux OS 9 STIG - Ver 1, Rel 2
Canonical Ubuntu 20.04 LTS STIG (Ver 2, Rel 3) Canonical Ubuntu 20.04 LTS
Defense Information Systems Agency
04/09/2025 SCAP 1.3 Content - Canonical Ubuntu 20.04 LTS STIG SCAP Benchmark - Ver 2, Rel 3
SCAP 1.2 Content - Sunset - Canonical Ubuntu 20.04 LTS STIG Benchmark - Ver 1, Rel 9
Automated Content - SCC 5.10.2 Ubuntu 18/20 AMD64
Automated Content - SCC 5.10.2 Ubuntu 20/Raspios-bulleye Aarch64
Automated Content - SCC 5.10.2 Ubuntu 22 AMD64
Standalone XCCDF 1.1.4 - Canonical Ubuntu 20.04 LTS STIG for Ansible - Ver 1, Rel 11
Standalone XCCDF 1.1.4 - Canonical Ubuntu 20.04 LTS STIG - Ver 2, Rel 2
Apache Tomcat Application Server 9 STIG (Ver 3, Rel 2) Apache Tomcat 9.0
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - Apache Tomcat Application Server 9 STIG - Ver 3, Rel 2
Apple macOS 15 (Sequoia) STIG (Ver 1, Rel 3) Apple MacOS 15.0
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - Apple macOS 15 (Sequoia) STIG - Ver 1, Rel 3
Apple iOS/iPadOS 18 STIG (Ver 1, Rel 3) Apple iPadOS 18.0
Apple iPhone OS 18.0
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - Apple iOS-iPadOS 18 STIG - Ver 1, Rel 3
Apache Server 2.4 UNIX STIG (Y25M04) Apache HTTP Server 2.4.0
Defense Information Systems Agency
04/09/2025 Standalone XCCDF 1.1.4 - Apache Server 2.4 Unix STIG
Apache 2.2 STIG - UNIX (Version 1, Release 11) Apache HTTP Server 2.2
Defense Information Systems Agency
04/07/2025 Standalone XCCDF 1.1.4 - Sunset - Apache 2.2 STIG UNIX - Ver 1, Rel 11
Apache 2.2 STIG - Windows (Version 1, Release 13) Apache HTTP Server 2.2
Defense Information Systems Agency
04/07/2025 Standalone XCCDF 1.1.4 - Sunset - Apache 2.2 STIG Windows - Ver 1, Rel 13
Canonical Ubuntu 18.04 LTS STIG (Ver 2, Rel 15) Canonical Ubuntu Linux 18.04 LTS
Defense Information Systems Agency
03/31/2025 SCAP 1.3 Content - Sunset - Canonical Ubuntu 18.04 LTS STIG Benchmark - Ver 2, Rel 12
SCAP 1.2 Content - Sunset - Canonical Ubuntu 18.04 LTS STIG Benchmark - Ver 2, Rel 11
Automated Content - SCC 5.10.2 Ubuntu 18/20 AMD64
Automated Content - SCC 5.10.2 Ubuntu 20/Raspios-bulleye Aarch64
Automated Content - SCC 5.10.2 Ubuntu 22 AMD64
Standalone XCCDF 1.1.4 - Sunset - Canonical Ubuntu 18.04 LTS STIG - Ver 2, Rel 15
Solaris 11 (SPARC and x86) Manual STIG (Ver 3, Rel 2) Sun Solaris
Defense Information Systems Agency
03/31/2025 SCAP 1.3 Content - Solaris 11 SPARC STIG Benchmark - Ver 3, Rel 2
SCAP 1.3 Content - Solaris 11 x86 STIG Benchmark - Ver 3, Rel 2
SCAP 1.2 Content - Sunset - Solaris 11 SPARC STIG Benchmark - Ver 2, Rel 4
Automated Content - SCC 5.10.2 Solaris 11 i386
Automated Content - SCC 5.10.2 Solaris 11 SPARC
Standalone XCCDF 1.1.4 - Solaris 11 SPARC STIG - Ver 3, Rel 2
Standalone XCCDF 1.1.4 - Solaris 11 x86 STIG - Ver 3, Rel 2
Canonical Ubuntu 18.04 LTS for Ansible (Version 2, Release 13) Canonical Ubuntu 18.04 LTS for Ansible
Defense Information Systems Agency
03/31/2025 Automated Content - SCC 5.10.2 Ubuntu 18/20 AMD64
Automated Content - SCC 5.10.2 Ubuntu 20/Raspios-bulleye Aarch64
Automated Content - SCC 5.10.2 Ubuntu 22 AMD64
Standalone XCCDF 1.1.4 - Sunset - Canonical Ubuntu 18.04 LTS STIG for Ansible - Ver 2, Rel 13
Red Hat 7 STIG (Ver 3, Rel 15) Red Hat Enterprise Linux 7.0
Defense Information Systems Agency
03/31/2025 SCAP 1.3 Content - Sunset - Red Hat Enterprise Linux 7 STIG Benchmark - Ver 3, Rel 15
Automated Content - SCC 5.10.2 RHEL 7/Oracle Linux 7/SLES12/SLES 15 x86 64
Automated Content - SCC 5.10.2 RHEL 8/Oracle Linux 8 Aarch64
Automated Content - SCC 5.10.2 RHEL 8/Oracle Linux 8 x86 64
Automated Content - SCC 5.10.2 RHEL 9/Oracle Linux 9 x86 64
Standalone XCCDF 1.1.4 - Sunset - Red Hat Enterprise Linux 7 STIG for Ansible - Ver 3, Rel 14
Standalone XCCDF 1.1.4 - Sunset - Red Hat Enterprise Linux 7 STIG - Ver 3, Rel 15
Standalone XCCDF 1.1.4 - Sunset - Red Hat Enterprise Linux 7 STIG for Chef - Ver 3, Rel 8
Entra ID - SCuBA (1.5) Microsoft Azure Active Directory
Cybersecurity and Infrastructure Security Agency (CISA)
03/27/2025 Machine-Readable Format - Microsoft Entra ID - GitHub
Prose - Microsoft Entra ID - SCuBA
Microsoft Power Platform - SCuBA (1.5.0) Microsoft Power Apps
Cybersecurity and Infrastructure Security Agency (CISA)
03/27/2025 Machine-Readable Format - Microsoft Power Platform - GitHub
Prose - Microsoft Power Platform
Microsoft Exchange Online - SCuBA (1.5.0) Microsoft Exchange Online
Cybersecurity and Infrastructure Security Agency (CISA)
03/27/2025 Machine-Readable Format - Microsoft Exchange Online - GitHub Markdown
Prose - Microsoft Exchange Online
Microsoft Defender for Office 365 - SCuBA (1.5.0) Microsoft Windows Defender
Cybersecurity and Infrastructure Security Agency (CISA)
03/27/2025 Prose - CISA GitHub for ScubaGear - MSFT Defender
Prose - Microsoft Defender for Office 365
Microsoft Power BI - SCuBA (1.5.0) Microsoft Power Apps
Cybersecurity and Infrastructure Security Agency (CISA)
03/27/2025 Machine-Readable Format - Microsoft Power BI GitHub Mark down
Prose - Microsoft Power BI
SharePoint and OneDrive - SCuBA (1.5.0) Microsoft OneDrive
Microsoft SharePoint Online
Cybersecurity and Infrastructure Security Agency (CISA)
03/27/2025 Machine-Readable Format - Microsoft SharePoint & OneDrive GitHub
Prose - Microsoft SharePoint & OneDrive
* This checklist is still undergoing review for inclusion into the NCP.