Home
Security Hardening
DISA STIG SharePoint 2013 V2R2

DISA STIG SharePoint 2013 V2R2

SP13-00-000045 – SharePoint must display an approved system use notification message or banner before granting access to the system.
Details Applications are required to display an approved system use notification message or banner before granting access to the system...
SP13-00-000055 – SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.
Details Audit records can be generated from various components within the information system, such as network interfaces, hard disks, modems,...
SP13-00-000060 – SharePoint must reject or delay, as defined by the organization, network traffic generated above configurable traffic volume thresholds – ConnectionTimeout
Details It is critical when a system is at risk of failing to process audit logs as required; actions are...
SP13-00-000065 – SharePoint must prevent the execution of prohibited mobile code.
Details Decisions regarding the utilization of mobile code within organizational information systems need to include evaluations that help determine the...
SP13-00-000155 – For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed, must not be installed in the DMZ.
Details Information flow control regulates where information is allowed to travel within an information system and between information systems (as...
SP13-00-000075 – SharePoint must use replay-resistant authentication mechanisms for network access to privileged accounts.
Details An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying...
SP13-00-000160 – The SharePoint farm service account (database access account) must be configured with minimum privileges in Active Directory (AD).
Details Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the...
SP13-00-000080 – SharePoint must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
Details Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization...
SP13-00-000085 – SharePoint must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Details Certain encryption types are no longer considered secure. This setting configures a minimum encryption type for SharePoint. Different versions...
SP13-00-000095 – SharePoint must employ NSA-approved cryptography to protect classified information.
Details Certain encryption types are no longer considered secure. This setting configures a minimum encryption type for SharePoint. Different versions...

Prev Next

DISA STIG SharePoint 2013 V2R2

SP13-00-000045 – SharePoint must display an approved system use notification message or banner before granting access to the system.

SP13-00-000055 – SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.

SP13-00-000060 – SharePoint must reject or delay, as defined by the organization, network traffic generated above configurable traffic volume thresholds – ConnectionTimeout

SP13-00-000065 – SharePoint must prevent the execution of prohibited mobile code.

SP13-00-000155 – For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed, must not be installed in the DMZ.

SP13-00-000075 – SharePoint must use replay-resistant authentication mechanisms for network access to privileged accounts.

SP13-00-000160 – The SharePoint farm service account (database access account) must be configured with minimum privileges in Active Directory (AD).

SP13-00-000080 – SharePoint must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

SP13-00-000085 – SharePoint must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

SP13-00-000095 – SharePoint must employ NSA-approved cryptography to protect classified information.