| MS.EXO.1.1v2 - Automatic forwarding to external domains SHALL be disabled. | ACCESS CONTROL |
| MS.EXO.2.2v2 - An SPF policy SHALL be published for each domain that fails all non-approved senders. | ACCESS CONTROL |
| MS.EXO.3.1v1 - DKIM SHOULD be enabled for all domains. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.4.1v1 - A DMARC policy SHALL be published for every second-level domain. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.4.2v1 - The DMARC message rejection option SHALL be p=reject. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.4.3v1 - The DMARC point of contact for aggregate reports SHALL include `[email protected]`. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.4.4v1 - An agency point of contact SHOULD be included for aggregate and failure reports. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.5.1v1 - SMTP AUTH SHALL be disabled. | CONFIGURATION MANAGEMENT |
| MS.EXO.6.1v1 - Contact folders SHALL NOT be shared with all domains. | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.6.2v1 - Calendar details SHALL NOT be shared with all domains. | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.7.1v1 - External sender warnings SHALL be implemented. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.8.1v2 - A DLP solution SHALL be used. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.8.2v2 - The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.8.3v1 - The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.8.4v1 - At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email. | SYSTEM AND COMMUNICATIONS PROTECTION |
| MS.EXO.9.1v2 - Emails SHALL be filtered by attachment file types. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.9.2v1 - The attachment filter SHOULD attempt to determine the true file type and assess the file extension. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.9.3v2 - Disallowed file types SHALL be determined and enforced. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.9.4v1 - If a third-party filtering solution is used, it SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.9.5v1 - At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe). | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.10.1v1 - Emails SHALL be scanned for malware. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.10.2v1 - Emails identified as containing malware SHALL be quarantined or dropped. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.10.3v1 - Email scanning SHALL be capable of reviewing emails after delivery. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.11.1v1 - Impersonation protection checks SHOULD be used. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.11.2v1 - User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. | AWARENESS AND TRAINING, SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.11.3v1 - The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.12.1v1 - IP allow lists SHOULD NOT be created. | ACCESS CONTROL |
| MS.EXO.12.2v1 - Safe lists SHOULD NOT be enabled. | ACCESS CONTROL |
| MS.EXO.13.1v1 - Mailbox auditing SHALL be enabled. | AUDIT AND ACCOUNTABILITY |
| MS.EXO.14.1v2 - A spam filter SHALL be enabled. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.14.2v1 - Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.14.3v1 - Allowed domains SHALL NOT be added to inbound anti-spam protection policies. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.14.4v1 - If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.15.1v1 - URL comparison with a block-list SHOULD be enabled. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.15.2v1 - Direct download links SHOULD be scanned for malware. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.15.3v1 - User click tracking SHOULD be enabled. | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.16.1v1 - At a minimum, the following alerts SHALL be enabled: | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.16.2v1 - The alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. | SYSTEM AND INFORMATION INTEGRITY |
| MS.EXO.17.1v1 - Unified Audit logging SHALL be enabled. | AUDIT AND ACCOUNTABILITY |
| MS.EXO.17.3v1 - Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C). | AUDIT AND ACCOUNTABILITY |
