1.1 Ensure Web Content Is on Non-System Partition

800-53|CM-6b.

CSCv6|3.1

1.2 Ensure 'host headers' are on all sites

1.3 Ensure 'directory browsing' is set to disabled

800-53|CM-7b.

CSCv6|9.1

1.4 Ensure 'application pool identity' is configured for all application pools

800-53|AC-6

1.5 Ensure 'unique application pools' is set for sites

800-53|SC-39

1.6 Ensure 'application pool identity' is configured for anonymous user identity

2.1 Ensure 'global authorization rule' is set to restrict access

800-53|AC-3

2.2 Ensure Access to Sensitive Site Features Is Restricted To Authenticated Principals Only - Applications

800-53|AC-6(3)

2.2 Ensure Access to Sensitive Site Features Is Restricted To Authenticated Principals Only - Default

2.3 Ensure 'forms authentication' require SSL - Applications

800-53|SC-8(1)

2.3 Ensure 'forms authentication' require SSL - Default

2.3 Ensure 'forms authentication' require SSL - Not Enabled

2.5 Ensure 'cookie protection mode' is configured for forms authentication - Applications

800-53|SC-28(1)

CSCv6|13.2

2.5 Ensure 'cookie protection mode' is configured for forms authentication - Default

2.5 Ensure 'cookie protection mode' is configured for forms authentication - Not Enabled

2.6 Ensure transport layer security for 'basic authentication' is configured

800-53|IA-5(1)(c)

CSCv6|16.13

CSCv6|16.14

2.7 Ensure 'passwordFormat' is not set to clear

2.7 Ensure 'passwordFormat' is not set to clear - Applications

2.7 Ensure 'passwordFormat' is not set to clear - Default

3.1 Ensure 'deployment method retail' is set

3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely - Applications

800-53|SI-11a.

3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely - Default

3.8 Configure MachineKey Validation Method - .Net 3.5 - Applications

3.8 Configure MachineKey Validation Method - .Net 3.5 - Default

3.9 Ensure 'MachineKey validation method - .Net 4.5' is configured

3.9 Ensure 'MachineKey validation method - .Net 4.5' is configured - Applications

3.9 Ensure 'MachineKey validation method - .Net 4.5' is configured - Default

3.10 Ensure global .NET trust level is configured

3.10 Ensure global .NET trust level is configured - Applications

3.10 Ensure global .NET trust level is configured - Default

4.5 Ensure Double-Encoded Requests will be Rejected - Applications

4.5 Ensure Double-Encoded Requests will be Rejected - Default

4.6 Ensure 'HTTP Trace Method' is disabled - Applications

4.6 Ensure 'HTTP Trace Method' is disabled - Default

4.7 Ensure Unlisted File Extensions are not allowed - Applications

800-53|CM-7(4)

4.7 Ensure Unlisted File Extensions are not allowed - Default

4.8 Ensure Handler is not granted Write and Script/Execute - Applications

4.8 Ensure Handler is not granted Write and Script/Execute - Default

4.9 Ensure 'notListedIsapisAllowed' is set to false

800-53|SC-18b.

4.10 Ensure 'notListedCgisAllowed' is set to false

4.11 Ensure 'Dynamic IP Address Restrictions' is enabled

4.11 Ensure 'Dynamic IP Address Restrictions' is enabled - Deny By Conccurent Requests

800-53|SC-5

4.11 Ensure 'Dynamic IP Address Restrictions' is enabled - Deny By Request Rate

4.11 Ensure 'Dynamic IP Address Restrictions' is enabled - Not Logging Only Mode

5.1 Ensure Default IIS web log location is moved

800-53|AU-9

5.2 Ensure Advanced IIS logging is enabled

800-53|AU-12c.

6.1 Ensure FTP requests are encrypted - Control Channel

6.1 Ensure FTP requests are encrypted - Control Channel Default

6.1 Ensure FTP requests are encrypted - Control Channel Sites

6.1 Ensure FTP requests are encrypted - Data Channel Default

6.1 Ensure FTP requests are encrypted - Data Channel Sites

800-53|SC-13

7.2 Ensure SSLv2 is disabled - Key does not exist

7.4 Ensure TLS 1.0 is enabled - DisabledByDefault

7.7 Ensure NULL Cipher Suites is disabled

7.9 Ensure RC2 Cipher Suites is disabled - RC2 40/128

7.9 Ensure RC2 Cipher Suites is disabled - RC2 56/128

7.10 Ensure RC4 Cipher Suites is disabled - RC4 40/128

7.10 Ensure RC4 Cipher Suites is disabled - RC4 56/128

7.10 Ensure RC4 Cipher Suites is disabled - RC4 64/128

7.10 Ensure RC4 Cipher Suites is disabled - RC4 128/128

7.11 Ensure Triple DES Cipher Suite is configured

7.12 Ensure AES 128/128 Cipher Suite is configured

7.13 Ensure AES 256/256 Cipher Suite is enabled - Enabled

7.13 Ensure AES 256/256 Cipher Suite is enabled - Key not found

CIS Security Benchmark For Microsoft IIS 7.0/7.5 v1.8.0 Level I.

Revision 1.11

Mar 29, 2022

Informational Update

Miscellaneous