| 1.1 Ensure access to SharePointEmailws.asmx is limited to only the server farm account | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.9 Set 'Automatically wrap text at <x> characters.' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.10 Set 'Block Trusted Zones' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.15 Set 'Do not allow Outlook object model scripts to run for public folders' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.19 Set 'Download full text of articles as HTML attachments' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.20 Set 'Encode attachments in UUENCODE format' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.27 Set 'Remove file extensions blocked as Level 2' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.29 Set 'Security Level' to 'Enabled:Never warn, disable all' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2 Ensure that MongoDB does not bypass authentication via the localhost exception | CIS MongoDB L1 Windows Audit v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.4 Ensure an industry standard authentication mechanism is used - clusterAuthMode | CIS MongoDB L2 Windows Audit v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.5 Ensure the SharePoint farm service account (database access account) is configured with the minimum privileges on the SQL server. | CIS Microsoft SharePoint 2019 DB v1.0.0 | MS_SQLDB | |
| 2.8 Set 'Enable RPC encryption' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.9 Set 'Enter the Secure Folder path' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.18 Set 'Suppress external signature services menu item' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 3.2 Ensure that MongoDB only listens for network connections on authorized interfaces | CIS MongoDB L1 Unix Audit v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.4 Ensure that each role for each MongoDB database is needed and grants only the necessary privileges | CIS MongoDB Database Audit L2 v1.0.0 | MongoDB | ACCESS CONTROL |
| 3.5 Ensure that SharePoint specific malware (i.e. anti-virus) protection software is integrated and configured - Download Scan | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 3.6 Review Superuser/Admin Roles - clusterAdmin | CIS MongoDB Database Audit L2 v1.0.0 | MongoDB | ACCESS CONTROL |
| 3.6 Review Superuser/Admin Roles - dbOwner | CIS MongoDB Database Audit L2 v1.0.0 | MongoDB | ACCESS CONTROL |
| 4.1 Ensure SharePoint displays an approved system use notification message or banner before granting access to the system. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | ACCESS CONTROL |
| 4.2.10 Ensure mutual TLS authentication is enabled | CIS IBM WebSphere Liberty v1.0.0 L2 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.15 Ensure that the Federal Information Processing Standards (FIPS) are used for the cryptographic modules | CIS IBM WebSphere Liberty v1.0.0 L2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.4 Ensure 'disableIssChecking' issuer claim is set to 'false' in the RP (Relying Party) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.9 Ensure 'tokenEndpointAuthMethodsSupported' is set to a valid authentication method in OIDC Provider (OP) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.18 Ensure 'disallowServeServletsByClassName' is 'disabled' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 4.4.21 Ensure 'default-error-page' is set for web applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | MEDIA PROTECTION |
| 5.1 Ensure that auditable events and diagnostic tracking settings within the SharePoint system is consistent with the organization's security plans | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 5.1.2 Configure 'Disable VBA for Office applications' - (User- level Configuration) | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.1.3 Configure 'Disable VBA for Office applications' - (Machine- level Configuration) | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.1.11 Set 'Configure Outlook object model prompt when reading address information: Guard behavior:' to 'Enabled:Automatically Deny' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.1.15 Set 'List of trusted add-ins and hashes' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | |
| 5.1.18 Set 'Restrict File Download: outlook.exe' to 'Enabled:True' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.1.21 Set 'Scripted Window Security Restrictions: outlook.exe' to 'Enabled:True' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.1.23 Set 'Suppress hyperlink warnings' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 5.2 Ensure that remote sessions for accessing security functions and security-relevant information are audited | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | |
| 5.2.2 Ensure 'establishTrustInClient' is 'Required' for the CSIv2 Authentication Layer - needsReview/Zech | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.3 Ensure that logging captures as much information as possible | CIS MongoDB L2 Unix Audit v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.3 Ensure that logging captures as much information as possible | CIS MongoDB L2 Windows Audit v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 5.3.1 Ensure filters are configured for Java serialization (JEP 290) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1 Ensure 'HttpsToken' is set in WS-Security policy | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1.17 Ensure the 'TRIGGER' Audit Option Is Enabled | CIS Oracle Server 12c DB Traditional Auditing v3.0.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 6.2 Set 'Add e-mail recipients to users' Safe Senders Lists' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 6.5 Ensure that the HTTP interface is disabled | CIS MongoDB L2 Windows Audit v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 6.6 Set 'Disable UI extending from documents and templates: Disallow in Outlook' to 'Enabled:True' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.17 Set 'Warn before switching dial- up connection' to 'Enabled:True' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 7.2 Ensure that database file permissions are set correctly | CIS MongoDB L1 Unix Audit v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 7.4 Ensure the 'addressIncludeList' attribute is set to a whitelist of IP addresses | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.4 Ensure the SharePoint CallStack and AllowPageLevelTrace 'SafeMode' parameters are set to false - AllowPageLevelTrace | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 7.4 Ensure the SharePoint CallStack and AllowPageLevelTrace 'SafeMode' parameters are set to false - CallStack | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 8.1 Ensure 'authentication' is set to 'true' to protect the metrics end point | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
