National Checklist Program Repository

The National Checklist Program (NCP), defined by the NIST SP 800-70, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

NCP provides metadata and links to checklists of various formats including checklists that conform to the Security Content Automation Protocol (SCAP). SCAP enables validated security products to automatically perform configuration checking using NCP checklists. For more information relating to the NCP please visit the information page or the glossary of terms.
Please note that the current search fields have been adjusted to reflect NIST SP 800-70 Revision 4.

Search for Checklists using the fields below. The keyword search will search across the name, and summary.

There are 533 matching records. Displaying matches 1 through 20.

Name (Version) Target Authority Last Modified Resources
Microsoft Outlook 2016 STIG (Version 2, Release 1) Microsoft Outlook 2016
Defense Information Systems Agency
01/19/2021 Standalone XCCDF 1.1.4 - Microsoft Outlook 2016 STIG - Ver 2, Rel 1
Apple macOS 11 STIG (Ver 1, Rel 1) Apple macOS 11.0 (Big Sur)
Defense Information Systems Agency
01/19/2021 Standalone XCCDF 1.1.4 - Apple macOS 11 STIG - Ver 1, Rel 1
VMWare Workspace ONE UEM STIG (Ver 1, Rel 1) Workspace ONE Unified Endpoint Management
Defense Information Systems Agency
01/12/2021 Standalone XCCDF 1.1.4 - VMWare Workspace ONE UEM STIG - Ver 1, Rel 1
Vanguard Compliance Manager z/OS RACF Checklist for completing a manual SRR Audit for Stig (6.47-8.1) IBM z/OS Version 2, Release 3
IBM z/OS Version 2, Release 4
Vanguard Integrity Professionals, Inc.
01/04/2021 ZIP - Vanguard z/OS RACF Checklist 6.47/8.1 PDF version
ZIP - Vanguard z/OS RACF Checklist 6.47/8.1 XML version
Samsung Android 11 Knox 3.x (Ver 1, Rel 1) Google Android 11.0
Defense Information Systems Agency
12/23/2020 Standalone XCCDF 1.1.4 - Samsung Android 11 Knox 3.x
CIS Apache Tomcat 9 Benchmark (1.1.0) Apache Tomcat 9.0
Center for Internet Security (CIS)
12/22/2020 Prose - Apache Tomcat 9 Benchmark v1.1.0
Catalina Guidance (Revision 2) Apple OS X 10.15
NIST, macOS Security Compliance Project
12/17/2020 SCAP 1.3 Content - Catalina Guidance
Windows 10 STIG (Version 2, Release 1) Microsoft Windows 10
Defense Information Systems Agency
12/17/2020 SCAP 1.2 Content - Microsoft Windows 10 STIG Benchmark - Ver 2, Rel 1
GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Windows 10 STIG - Ver 2, Rel 1
Motorola Android 9.x STIG (Ver 1, Rel 1) Google Android 9.x
Defense Information Systems Agency
12/14/2020 Standalone XCCDF 1.1.4 - Motorola Android 9.x STIG
Big Sur Guidance (Revision 1) Apple macOS 11.0 (Big Sur)
NIST, macOS Security Compliance Project
12/10/2020 SCAP 1.3 Content - Big Sur Guidance
Windows Firewall STIG and Advanced Security STIG (version 1, release 7) windows firewall
Defense Information Systems Agency
12/04/2020 SCAP 1.2 Content - Microsoft Windows Firewall STIG Benchmark - Ver 1, Rel 7
GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Windows Firewall STIG and Advanced Security STIG - Ver 1, Rel 7
Google Chrome Browser STIG for Windows (Version 2, Release 1) Google Chrome 33
Defense Information Systems Agency
12/04/2020 SCAP 1.2 Content - Google Chrome for Windows STIG Benchmark - Ver 2, Rel 1
GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Google Chrome STIG - Ver 2, Rel 1
Microsoft Office System 2016 STIG (Version 1, Release 4) Microsoft Office 2016
Defense Information Systems Agency
12/04/2020 GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Office System 2016 STIG - Ver 1, Rel 1
Microsoft Windows Server 2019 (Ver 2, Rel 1) Microsoft Windows Server 2019
Defense Information Systems Agency
12/04/2020 SCAP 1.2 Content - Microsoft Windows Server 2019 STIG Benchmark - Ver 2, Rel 1
GPOs - Group Policy Objects (GPOs) - November 2020
Machine-Readable Format - Microsoft Windows Server 2019 STIG for Chef - Ver 1, Rel 2
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2019 STIG - Ver 2, Rel 1
Microsoft Office 365 ProPlus STIG (Ver 2, Rel 1) Microsoft Office 365 ProPlus
Defense Information Systems Agency
12/04/2020 GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Office 365 ProPlus STIG - Ver 2, Rel 1
Microsoft Office System 2013 STIG (Version 2, Release 1) Office System 2013
Defense Information Systems Agency
12/04/2020 GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Office System 2013 STIG - Ver 2, Rel 1
Internet Explorer 11 STIG (Version 1, Release 19) Microsoft Internet Explorer 11
Defense Information Systems Agency
12/04/2020 SCAP 1.2 Content - Microsoft Internet Explorer 11 STIG Benchmark - Ver 1, Rel 15
GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Internet Explorer 11 STIG - Ver 1, Rel 19
Adobe Acrobat Pro DC Continuous Track STIG (Ver 1, Rel 2) Adobe Acrobat Pro DC Continuous Track
Defense Information Systems Agency
12/04/2020 GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Adobe Acrobat Pro DC Continuous Track STIG - Ver 1, Rel 2
Microsoft Windows Server 2016 STIG (Version 2, Release 1) Microsoft Windows Server 2016
Defense Information Systems Agency
12/03/2020 SCAP 1.2 Content - Microsoft Windows Server 2016 STIG Benchmark - Ver 2, Rel 1
GPOs - Group Policy Objects (GPOs) - November 2020
Machine-Readable Format - Microsoft Windows Server 2016 STIG for Chef - Ver 1, Rel 3
Machine-Readable Format - Microsoft Windows Server 2016 STIG for PowerShell DSC - Ver 1, Rel 3
Standalone XCCDF 1.1.4 - Microsoft Windows Server 2016 STIG - Ver 2, Rel 1
Windows Server 2012 / 2012 R2 STIG (Version 3, Release 1) Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Defense Information Systems Agency
12/03/2020 SCAP 1.2 Content - Microsoft Windows Server 2012 and 2012 R2 DC STIG Benchmark - Ver 3, Rel 1
SCAP 1.2 Content - Microsoft Windows Server 2012 and 2012 R2 MS STIG Benchmark - Ver 3, Rel 1
GPOs - Group Policy Objects (GPOs) - November 2020
Standalone XCCDF 1.1.4 - Microsoft Windows 2012 and 2012 R2 DC STIG - Ver 3, Rel 1
Standalone XCCDF 1.1.4 - Microsoft Windows 2012 and 2012 R2 MS STIG - Ver 3, Rel 1
* This checklist is still undergoing review for inclusion into the NCP.