1.1 Ensure access to SharePointEmailws.asmx is limited to only the server farm account

800-53|CM-6b.

CSCv6|5.1

1.2 Ensure that the SharePoint Central Administration Site is TLS-enabled - HTTPS

800-53|SC-8

CSCv6|14.2

CSCv7|14.4

1.2 Ensure that the SharePoint Central Administration Site is TLS-enabled - Port 443

1.3 Ensure specific whitelisted IP addresses, IP address ranges, and/or domains are set

800-53|SC-7(5)

CSCv6|14

1.4 Ensure that the underlying Internet Information Services (IIS) Authentication module is set to use Kerberos as its Authentication Provider

800-53|SC-13

CSCv6|16.9

2.1 Ensure 'Blocked File Types' is configured to match the enterprise blacklist

800-53|SC-18(3)

CSCv6|8

2.2 Ensure the SharePoint farm service account (database access account) is configured with the minimum privileges for the local server.

800-53|AC-2c.

2.3 Ensure the SharePoint setup account is configured with the minimum privileges in Active Directory.

800-53|AC-6

2.6 Ensure a separate organizational unit (OU) in Active Directory exists for SharePoint 2019 objects.

800-53|CM-6

2.7 Ensure the SharePoint Central Administration site is not accessible from Extranet or Internet connections

800-53|SC-7(11)

CSCv6|9.4

2.9 Ensure that the SharePoint Online Web Part Gallery component is configured with limited access

3.1 Ensure a secondary SharePoint site collection administrator has been defined on each site collection.

800-53|IA-2(1)

800-53|SC-5

CSCv6|5

3.2 Ensure SharePoint implements an information system isolation boundary that minimizes the number of non-security functions included within the boundary containing security functions.

800-53|SC-7(15)

CSCv6|11.7

CSCv7|11.7

3.3 Ensure SharePoint implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.

3.4 Ensure SharePoint identifies data type, specification, and usage when transferring information between different security domains so policy restrictions may be applied.

800-53|SC-16

3.5 Ensure that SharePoint specific malware (i.e. anti-virus) protection software is integrated and configured - Attempt to clean

800-53|AU-3

800-53|SI-3

800-53|SI-5

CSCv6|8.1

CSCv7|8.1

CSCv7|8.6

3.5 Ensure that SharePoint specific malware (i.e. anti-virus) protection software is integrated and configured - Download Scan

3.5 Ensure that SharePoint specific malware (i.e. anti-virus) protection software is integrated and configured - Upload Scan

3.6 Ensure that SharePoint is configured with 'Strict' browser file handling settings

CSCv6|6

3.7 Ensure that SharePoint is set to reject or delay network traffic generated above configurable traffic volume thresholds - Connection Timeout

800-53|AC-12

CSCv6|9

3.7 Ensure that SharePoint is set to reject or delay network traffic generated above configurable traffic volume thresholds - Max Bandwidth

3.7 Ensure that SharePoint is set to reject or delay network traffic generated above configurable traffic volume thresholds - Max Connections

3.8 Ensure that On-Premise SharePoint servers is configured without OneDrive redirection linkages.

CSCv6|13

3.9 Ensure that SharePoint application servers are protected by a reverse proxy

800-53|SI-4

CSCv6|12

3.10 Ensure SharePoint database servers are segregated from application server and placed in a secure zone.

CSCv6|9.5

CSCv7|12.2

3.11 Ensure that the SharePoint Central Administration interface is not hosted in the DMZ.

4.1 Ensure SharePoint displays an approved system use notification message or banner before granting access to the system.

800-53|AC-8a.

CSCv6|16

4.2 Ensure claims-based authentication is used for all web applications and zones of a SharePoint 2019 farm

800-53|IA-2

4.3 Ensure Windows Authentication uses Kerberos and not the NT Lan Manager (NTLM) authentication protocol

4.4 Ensure Anonymous authentication is denied

800-53|AC-3

5.1 Ensure that auditable events and diagnostic tracking settings within the SharePoint system is consistent with the organization's security plans

800-53|AU-12c.

5.2 Ensure that remote sessions for accessing security functions and security-relevant information are audited

800-53|IA-5

6.2 Ensure SharePoint is configured with HTTPS connections

6.3 Ensure that SharePoint user sessions are terminated upon user logoff and when the idle time limit is exceeded

CSCv6|3.1

7.1 Ensure that the MaxZoneParts setting for Web Parts is configured

CSCv6|18

7.2 Ensure that the SafeControls list is set to the minimum set of controls needed for your sites

800-53|SC-18b.

7.3 Ensure compilation or scripting of database pages via the PageParserPaths elements is not allowed

800-53|SI-11a.

7.4 Ensure the SharePoint CallStack and AllowPageLevelTrace 'SafeMode' parameters are set to false - AllowPageLevelTrace

CSCv6|18.5

7.4 Ensure the SharePoint CallStack and AllowPageLevelTrace 'SafeMode' parameters are set to false - CallStack

CIS_Microsoft_SharePoint_2019_OS_v1.0.0_Level_1.audit from CIS Microsoft SharePoint 2019 Benchmark v1.0.0

Detections

Analytics

CIS Microsoft SharePoint 2019 OS v1.0.0

Audit Details

File Details

Audit Changelog

Revision 1.11

Miscellaneous

Revision 1.10

Miscellaneous

Revision 1.9

Miscellaneous

Revision 1.8

Miscellaneous

Added

Revision 1.7

Miscellaneous

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Miscellaneous

Detections

Analytics

CIS Microsoft SharePoint 2019 OS v1.0.0 Download File

Audit Details

File Details

Audit Changelog

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Added

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Functional Update

Miscellaneous

CIS Microsoft SharePoint 2019 OS v1.0.0