DISA_STIG_SharePoint_2010_v1r9.audit from DISA SharePoint 2010 v1r9

SHPT-00-000007 - SharePoint must support the requirement to initiate a session lock after an organizationally defined time period of system or application inactivity has transpired.

800-53|AC-11a.

CAT|II

CCI|CCI-000057

Rule-ID|SV-37638r2_rule

STIG-ID|SHPT-00-000007

Vuln-ID|V-27965

SHPT-00-000009 - SharePoint information management policies must be created, configured, and maintained to support the use of organizationally defined security attributes.

800-53|CM-1a.1.

CCI|CCI-000287

Rule-ID|SV-40023r2_rule

STIG-ID|SHPT-00-000009

Vuln-ID|V-30364

SHPT-00-000010 - SharePoint must maintain and support the use of organizationally defined security attributes to stored information - Document Library'

800-53|AC-16(1)

CCI|CCI-002272

Rule-ID|SV-36059r2_rule

STIG-ID|SHPT-00-000010

Vuln-ID|V-27968

SHPT-00-000010 - SharePoint must maintain and support the use of organizationally defined security attributes to stored information.

SHPT-00-000040 - SharePoint must allow authorized users to associate security attributes with information.

800-53|AC-16(4)

CCI|CCI-002289

Rule-ID|SV-36067r3_rule

STIG-ID|SHPT-00-000040

Vuln-ID|V-27974

SHPT-00-000100 - SharePoint must enforce dual authorization, based on organizational policies and procedures for organizationally defined privileged commands.

800-53|AC-3(2)

CCI|CCI-000021

Rule-ID|SV-36114r2_rule

STIG-ID|SHPT-00-000100

Vuln-ID|V-27996

SHPT-00-000127 - The 'Automatically delete the site collection if use is not confirmed' property must not be enabled for web applications.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-38109r2_rule

STIG-ID|SHPT-00-000127

Vuln-ID|V-29363

SHPT-00-000130 - For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed must not be installed in the DMZ.

800-53|AC-4

CCI|CCI-001414

Rule-ID|SV-36120r2_rule

STIG-ID|SHPT-00-000130

Vuln-ID|V-28217

SHPT-00-000165 - SharePoint must enable IRM to bind attributes to information to facilitate the organization's established information flow policy as needed.

800-53|AC-4(18)

CAT|III

CCI|CCI-002210

Rule-ID|SV-36418r2_rule

STIG-ID|SHPT-00-000165

Vuln-ID|V-28230

SHPT-00-000190 - SharePoint must enforce organizational requirements to implement separation of duties through assigned information access authorizations.

800-53|AC-5c.

CCI|CCI-002220

Rule-ID|SV-37759r2_rule

STIG-ID|SHPT-00-000190

Vuln-ID|V-28241

SHPT-00-000191 - SharePoint farm service account (Database Access account) must be configured with minimum privileges in Active Directory (AD).

800-53|AC-6

CCI|CCI-000225

Rule-ID|SV-37832r2_rule

STIG-ID|SHPT-00-000191

Vuln-ID|V-29306

SHPT-00-000193 - The SharePoint setup user domain account must be configured with the minimum privileges in Active Directory.

Rule-ID|SV-38299r2_rule

STIG-ID|SHPT-00-000193

Vuln-ID|V-29399

SHPT-00-000195 - The SharePoint setup user domain account must be configured with the minimum privileges for the local server.

Rule-ID|SV-40025r2_rule

STIG-ID|SHPT-00-000195

Vuln-ID|V-30366

SHPT-00-000197 - A secondary site collection administrator must be defined when creating a new site collection.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-38149r2_rule

STIG-ID|SHPT-00-000197

Vuln-ID|V-29373

SHPT-00-000199 - SharePoint service accounts must be configured for separation of duties.

Rule-ID|SV-38296r2_rule

STIG-ID|SHPT-00-000199

Vuln-ID|V-29398

SHPT-00-000210 - Timer job retries for automatic password change on Managed Accounts must meet DoD password retry policy.

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-37975r2_rule

STIG-ID|SHPT-00-000210

Vuln-ID|V-28249

SHPT-00-000235 - SharePoint clients must be configured to display an approved system use notification message or banner before granting access to the system.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-36428r2_rule

STIG-ID|SHPT-00-000235

Vuln-ID|V-28252

SHPT-00-000240 - SharePoint must retain the notification message or banner on the screen until users take explicit actions to log on to or further access.

800-53|AC-8b.

CCI|CCI-000050

Rule-ID|SV-36431r1_rule

STIG-ID|SHPT-00-000240

Vuln-ID|V-28254

SHPT-00-000245 - SharePoint must be configured to display the banner, when appropriate, before granting further access.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-36432r1_rule

STIG-ID|SHPT-00-000245

Vuln-ID|V-28256

SHPT-00-000315 - SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-37767r2_rule

STIG-ID|SHPT-00-000315

Vuln-ID|V-28114

SHPT-00-000405 - To support audit review, analysis, and reporting, SharePoint must integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

800-53|AU-6(1)

CCI|CCI-001864

Rule-ID|SV-36581r1_rule

STIG-ID|SHPT-00-000405

Vuln-ID|V-28184

SHPT-00-000430 - SharePoint must protect audit information from unauthorized access to the usage and health logs.

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-36596r2_rule

STIG-ID|SHPT-00-000430

Vuln-ID|V-28087

SHPT-00-000431 - SharePoint must protect audit information from unauthorized access to the trace data log files.

Rule-ID|SV-39935r2_rule

STIG-ID|SHPT-00-000431

Vuln-ID|V-30282

SHPT-00-000435 - SharePoint must protect audit information from unauthorized modification of usage and health data collection logs.

CCI|CCI-000163

Rule-ID|SV-36597r2_rule

STIG-ID|SHPT-00-000435

Vuln-ID|V-28089

SHPT-00-000436 - SharePoint must protect audit information from unauthorized modification to trace data logs.

Rule-ID|SV-39940r2_rule

STIG-ID|SHPT-00-000436

Vuln-ID|V-30287

SHPT-00-000440 - SharePoint must protect audit information from unauthorized deletion of usage and health logs.

CCI|CCI-000164

Rule-ID|SV-36598r2_rule

STIG-ID|SHPT-00-000440

Vuln-ID|V-28094

SHPT-00-000441 - SharePoint must protect audit information from unauthorized deletion of trace log files.

Rule-ID|SV-39943r2_rule

STIG-ID|SHPT-00-000441

Vuln-ID|V-30290

SHPT-00-000445 - SharePoint must protect audit tools from unauthorized access - 'Verify Site Collection Administrators'

CCI|CCI-001493

Rule-ID|SV-36599r2_rule

STIG-ID|SHPT-00-000445

Vuln-ID|V-28097

SHPT-00-000445 - SharePoint must protect audit tools from unauthorized access - 'Verify Users and Groups with Full Control'

SHPT-00-000465 - SharePoint must support the requirement that privileged access is further defined between audit-related privileges and other privileges.

800-53|AU-9(4)

CCI|CCI-001351

Rule-ID|SV-36578r2_rule

STIG-ID|SHPT-00-000465

Vuln-ID|V-28144

SHPT-00-000475 - To support the requirements and principles of least functionality; SharePoint must support the organizational requirement to provide only essential capabilities.

Rule-ID|SV-37768r1_rule

STIG-ID|SHPT-00-000475

Vuln-ID|V-28169

SHPT-00-000480 - When configuring Central Administration, the port number selected must comply with  DoD Ports and Protocol Management (PPSM) program requirements.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-37769r2_rule

STIG-ID|SHPT-00-000480

Vuln-ID|V-28170

SHPT-00-000495 - Backup of SharePoint system level files for critical systems must be performed when identified as required by the owning organization.

800-53|CP-9b.

CCI|CCI-000537

Rule-ID|SV-36698r1_rule

STIG-ID|SHPT-00-000495

Vuln-ID|V-28177

SHPT-00-000530 - The Central Administration Web Application must use Kerberos as the authentication provider.

800-53|IA-2(8)

CCI|CCI-001941

Rule-ID|SV-36726r2_rule

STIG-ID|SHPT-00-000530

Vuln-ID|V-28119

SHPT-00-000531 - SharePoint sites must not use NTLM - SharePoint sites must not use NTLM.

Rule-ID|SV-37822r3_rule

STIG-ID|SHPT-00-000531

Vuln-ID|V-29301

SHPT-00-000600 - SharePoint managed service accounts must be set to enable automatic password change.

800-53|IA-5(1)(d)

CCI|CCI-000199

Rule-ID|SV-37784r2_rule

STIG-ID|SHPT-00-000600

Vuln-ID|V-28138

SHPT-00-000640 - Applications must support organizational requirements to employ cryptographic mechanisms to protect information in storage.

800-53|SC-28(1)

CAT|I

CCI|CCI-002475

Rule-ID|SV-37792r2_rule

Detections

Analytics

Revision 1.2

May 6, 2020

Functional Update

Miscellaneous