IAVM Analysis

I have worked on a couple of tasks just recently where I have had to perform one form of IAVM analysis or another. Typically in the past, I perform the application development interview for the GOTS application. In the past, I have used the JTF-GNO site (linked off of DISA's site) in order to find detailed information on the particular IAVM.  However, I've noticed recently that not only does one need a CAC, but now you have to come from a .mil domain.  So, my question is:  besides the actual STIGs, where else can you get good information on particular IAVMs?  CAC-enabled sites are ok.