| 1.1 Ensure access to SharePointEmailws.asmx is limited to only the server farm account | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.3 Ensure specific whitelisted IP addresses, IP address ranges, and/or domains are set | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4 Ensure that the underlying Internet Information Services (IIS) Authentication module is set to use Kerberos as its Authentication Provider | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2 Ensure the SharePoint farm service account (database access account) is configured with the minimum privileges for the local server. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | ACCESS CONTROL |
| 2.3.12 Ensure 'REMOTE_LOGIN_PASSWORDFILE' Is Set To 'NONE' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS | OracleDB | ACCESS CONTROL |
| 2.3.12 Ensure 'REMOTE_LOGIN_PASSWORDFILE' Is Set To 'NONE' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS OracleDB | OracleDB | ACCESS CONTROL |
| 2.7 Ensure the SharePoint Central Administration site is not accessible from Extranet or Internet connections | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.9 Ensure that the SharePoint Online Web Part Gallery component is configured with limited access | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | ACCESS CONTROL |
| 3.3 Ensure SharePoint implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3.2 Include TSIG key in named.conf 'TSIG key 1 permissions' | CIS ISC BIND 9.0/9.5 v2.0.0 | Unix | |
| 3.4 Ensure SharePoint identifies data type, specification, and usage when transferring information between different security domains so policy restrictions may be applied. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.5 Ensure that SharePoint specific malware (i.e. anti-virus) protection software is integrated and configured - Download Scan | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 3.5 Ensure that SharePoint specific malware (i.e. anti-virus) protection software is integrated and configured - Upload Scan | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 3.6 Ensure that SharePoint is configured with 'Strict' browser file handling settings | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 3.8 Ensure that On-Premise SharePoint servers is configured without OneDrive redirection linkages. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 3.11 Ensure that the SharePoint Central Administration interface is not hosted in the DMZ. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | |
| 4.1 Ensure SharePoint displays an approved system use notification message or banner before granting access to the system. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | ACCESS CONTROL |
| 4.3 Ensure Windows Authentication uses Kerberos and not the NT Lan Manager (NTLM) authentication protocol | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4 Ensure Anonymous authentication is denied | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | ACCESS CONTROL |
| 5.1 Ensure that auditable events and diagnostic tracking settings within the SharePoint system is consistent with the organization's security plans | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 5.2 Ensure that remote sessions for accessing security functions and security-relevant information are audited | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | |
| 6.3 Ensure that SharePoint user sessions are terminated upon user logoff and when the idle time limit is exceeded | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | ACCESS CONTROL |
| 7.3 Ensure compilation or scripting of database pages via the PageParserPaths elements is not allowed | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 7.4 Ensure the SharePoint CallStack and AllowPageLevelTrace 'SafeMode' parameters are set to false - AllowPageLevelTrace | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 7.4 Ensure the SharePoint CallStack and AllowPageLevelTrace 'SafeMode' parameters are set to false - CallStack | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| DO0320-ORACLE11 - Application role permissions should not be assigned to the Oracle PUBLIC role - 'PUBLIC role has no granted roles' | DISA STIG Oracle 11 Instance v9r1 Database | OracleDB | ACCESS CONTROL |
| EX19-ED-000017 - Exchange must have accepted domains configured. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | ACCESS CONTROL |
| EX19-ED-000026 - The Exchange email diagnostic log level must be set to the lowest level. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-ED-000034 - Exchange message tracking logging must be enabled. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-ED-000044 - Exchange audit data must be protected against unauthorized access (read access). | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-ED-000053 - Exchange local machine policy must require signed scripts. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | CONFIGURATION MANAGEMENT |
| EX19-ED-000098 - Exchange internal send connectors must use domain security (mutual authentication Transport Layer Security). | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-ED-000099 - Exchange internet-facing receive connectors must offer Transport Layer Security (TLS) before using basic authentication. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-ED-000114 - Exchange send connector connections count must be limited. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-ED-000116 - Exchange send connectors delivery retries must be controlled. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-ED-000123 - Exchange messages with a blank sender field must be rejected. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| EX19-ED-000124 - Exchange messages with a blank sender field must be filtered. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| EX19-ED-000125 - Exchange filtered messages must be archived. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| EX19-ED-000236 - Exchange internal Send connectors must require encryption. | DISA Microsoft Exchange 2019 Edge Server STIG v2r2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000007 - Exchange must use encryption for Outlook Web App (OWA) access. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | ACCESS CONTROL |
| EX19-MB-000042 - Exchange circular logging must be disabled. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-MB-000053 - Exchange must protect audit data against unauthorized access. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-MB-000054 - Exchange must protect audit data against unauthorized deletion. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-MB-000058 - Exchange audit data must be on separate partitions. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| EX19-MB-000066 - The Exchange Post Office Protocol 3 (POP3) service must be disabled. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | CONFIGURATION MANAGEMENT |
| EX19-MB-000115 - Exchange mailboxes must be retained until backups are complete. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000116 - Exchange email forwarding must be restricted. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000123 - Exchange mail quota settings must not restrict sending mail. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000231 - Exchange must not send nondelivery reports to remote domains. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000283 - Exchange must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | CONFIGURATION MANAGEMENT |
