| MS.DEFENDER.1.1v1 - The standard and strict preset security policies SHALL be enabled. | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.1.2v1 - All users SHALL be added to Exchange Online Protection (EOP) in either the standard or strict preset security policy. | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.1.3v1 - All users SHALL be added to Defender for Office 365 protection in either the standard or strict preset security policy. | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.1.4v1 - Sensitive accounts SHALL be added to Exchange Online Protection in the strict preset security policy. | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.1.5v1 - Sensitive accounts SHALL be added to Defender for Office 365 protection in the strict preset security policy. | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.2.1v1 - User impersonation protection SHOULD be enabled for sensitive accounts in both the standard and strict preset policies. | SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.2.2v1 - Domain impersonation protection SHOULD be enabled for domains owned by the agency in both the standard and strict preset policies. | SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.2.3v1 - Domain impersonation protection SHOULD be added for important partners in both the standard and strict preset policies. | SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.3.1v1 - Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams. | SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.4.1v2 - A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency, blocking at a minimum: credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN). | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.DEFENDER.4.2v1 - The custom policy SHOULD be applied to Exchange, OneDrive, SharePoint, Teams chat, and Devices. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.DEFENDER.4.3v1 - The action for the custom policy SHOULD be set to block sharing sensitive information with everyone. | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.DEFENDER.4.4v1 - Notifications to inform users and help educate them on the proper use of sensitive information SHOULD be enabled in the custom policy. | AWARENESS AND TRAINING |
| MS.DEFENDER.4.5v1 - A list of apps that are restricted from accessing files protected by DLP policy SHOULD be defined. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.DEFENDER.4.6v1 - The custom policy SHOULD include an action to block access to sensitive | ACCESS CONTROL |
| MS.DEFENDER.5.1v1 - At a minimum, the alerts required by the CISA M365 Secure Configuration Baseline for Exchange Online SHALL be enabled. | SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.5.2v1 - The alerts SHOULD be sent to a monitored address or incorporated into a Security Information and Event Management (SIEM). | SYSTEM AND INFORMATION INTEGRITY |
| MS.DEFENDER.6.1v1 - Unified Audit logging SHALL be enabled. | AUDIT AND ACCOUNTABILITY |
| MS.DEFENDER.6.3v1 - Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31. | AUDIT AND ACCOUNTABILITY |
