# stig_rules

vuln_id: V-223091
rule_id: SV-223091r879887_rule
severity: CAT II
title: XAML files must be disallowed (Internet zone).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow loading of XAML files' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow loading of XAML files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2402" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223092
rule_id: SV-223092r879887_rule
severity: CAT II
title: XAML files must be disallowed (Restricted Sites zone).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow loading of XAML files' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow loading of XAML files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2402" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223093
rule_id: SV-223093r879643_rule
severity: CAT II
title: Protected Mode must be enforced (Internet zone).
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off Protected Mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on Protected Mode. If you do not configure this policy, users will be able to turn on or off Protected Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Protected Mode' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Protected Mode' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2500" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223094
rule_id: SV-223094r879643_rule
severity: CAT II
title: Protected Mode must be enforced (Restricted Sites zone).
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off Protected Mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on Protected Mode. If you do not configure this policy, users will be able to turn on or off Protected Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Protected Mode' to 'Enabled' and select 'Enable', from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Protected Mode' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2500" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223095
rule_id: SV-223095r879587_rule
severity: CAT II
title: Pop-up Blocker must be enforced (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Use Pop-up Blocker' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Use Pop-up Blocker' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1809" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223096
rule_id: SV-223096r879587_rule
severity: CAT II
title: Pop-up Blocker must be enforced (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Use Pop-up Blocker' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Use Pop-up Blocker' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1809" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223097
rule_id: SV-223097r879534_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Websites in less privileged web content zones must be prevented from navigating into the Internet zone.

description:
  <VulnDiscussion>This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If "Prompt" is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2101" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223098
rule_id: SV-223098r879534_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone.

description:
  <VulnDiscussion>This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If Prompt is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2101" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223099
rule_id: SV-223099r879587_rule
severity: CAT II
title: Allow binary and script behaviors must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable this policy setting, binary and script behaviors are available.   If you select "Administrator approved" in the drop-down box, only the behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.    If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. If you do not configure this policy setting, binary and script behaviors are available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow binary and script behaviors' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow binary and script behaviors' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2000" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223100
rule_id: SV-223100r879587_rule
severity: CAT II
title: Automatic prompting for file downloads must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Automatic prompting for file downloads' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Automatic prompting for file downloads' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2200" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223101
rule_id: SV-223101r879627_rule
severity: CAT II
title: Internet Explorer Processes for MIME handling must be enforced. (Reserved)
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223102
rule_id: SV-223102r879627_rule
severity: CAT II
title: Internet Explorer Processes for MIME handling must be enforced (Explorer).
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to the organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223103
rule_id: SV-223103r879627_rule
severity: CAT II
title: Internet Explorer Processes for MIME handling must be enforced (iexplore).
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223104
rule_id: SV-223104r879627_rule
severity: CAT II
title: Internet Explorer Processes for MIME sniffing must be enforced (Reserved).
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends you configure this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223105
rule_id: SV-223105r879627_rule
severity: CAT II
title: Internet Explorer Processes for MIME sniffing must be enforced (Explorer).
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223106
rule_id: SV-223106r879627_rule
severity: CAT II
title: Internet Explorer Processes for MIME sniffing must be enforced (iexplore).
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223107
rule_id: SV-223107r879587_rule
severity: CAT II
title: Internet Explorer Processes for MK protocol must be enforced (Reserved).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends configuring this setting to "Enabled" to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223108
rule_id: SV-223108r879587_rule
severity: CAT II
title: Internet Explorer Processes for MK protocol must be enforced (Explorer).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to "Enabled" to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223109
rule_id: SV-223109r879587_rule
severity: CAT II
title: Internet Explorer Processes for MK protocol must be enforced (iexplore).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to "Enabled" to block the MK protocol unless specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223110
rule_id: SV-223110r879643_rule
severity: CAT II
title: Internet Explorer Processes for Zone Elevation must be enforced (Reserved).
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as "Enabled" in all environments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' must be 'Enabled'.  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223111
rule_id: SV-223111r879643_rule
severity: CAT II
title: Internet Explorer Processes for Zone Elevation must be enforced (Explorer).
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends configuring this setting as "Enabled" in all environments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223112
rule_id: SV-223112r879643_rule
severity: CAT II
title: Internet Explorer Processes for Zone Elevation must be enforced (iexplore).
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as "Enabled" in all environments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223113
rule_id: SV-223113r879587_rule
severity: CAT II
title: Internet Explorer Processes for Restrict File Download must be enforced (Reserved).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223114
rule_id: SV-223114r879587_rule
severity: CAT II
title: Internet Explorer Processes for Restrict File Download must be enforced (Explorer).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223115
rule_id: SV-223115r879587_rule
severity: CAT II
title: Internet Explorer Processes for Restrict File Download must be enforced (iexplore).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223116
rule_id: SV-223116r879587_rule
severity: CAT II
title: Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force the user to interact with a window containing malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows, and create windows that hide other windows. Recommend configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223117
rule_id: SV-223117r879587_rule
severity: CAT II
title: Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and create windows that hide other windows. This guide recommends configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value "explorer.exe is REG_SZ = 1, this is not a finding.


vuln_id: V-223118
rule_id: SV-223118r879587_rule
severity: CAT II
title: Internet Explorer Processes for restricting pop-up windows must be enforced (iexplore).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and create windows that hide other windows. This guide recommends configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223119
rule_id: SV-223119r879887_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone).

description:
  <VulnDiscussion>This policy setting allows you to manage whether .NET Framework-reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components not signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components not signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2004" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223120
rule_id: SV-223120r879887_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  .NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone).

description:
  <VulnDiscussion>This policy setting allows you to manage whether .NET Framework-reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious content hosted on a website to take advantage of these components. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will execute signed managed components.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2001" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223121
rule_id: SV-223121r879587_rule
severity: CAT II
title: Scripting of Java applets must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select "Prompt" in the drop-down box, users are queried to choose whether to allow scripts to access applets. If you disable this policy setting, scripts are prevented from accessing applets. If you do not configure this policy setting, scripts can access applets automatically without user intervention. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Scripting of Java applets' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Scripting of Java applets' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1402" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223122
rule_id: SV-223122r879587_rule
severity: CAT II
title: AutoComplete feature for forms must be disallowed.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might not be protected as rigorously as required by organizational policy. If you enable this setting, the user is not presented with suggested matches when filling in forms. If you disable this setting, the user is presented with suggested possible matches when filling forms. If you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms. To display this option, the user opens the Internet Options dialog box, clicks the "Contents" tab, and clicks the "Settings" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Disable AutoComplete for forms' to 'Enabled'.

check_text:
  The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Disable AutoComplete for forms' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "Use FormSuggest" is REG_SZ = no, this is not a finding.


vuln_id: V-223123
rule_id: SV-223123r879587_rule
severity: CAT II
title: Crash Detection management must be enforced.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The 'Turn off Crash Detection' policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from the computer's memory. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier, where Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off Crash Detection' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off Crash Detection' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key:HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: If the value "NoCrashDetection" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223124
rule_id: SV-223124r879587_rule
severity: CAT II
title: Turn on the auto-complete feature for user names and passwords on forms must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls automatic completion of fields in forms on web pages. It is possible that malware could be developed which would be able to extract the cached user names and passwords from the currently logged on user, which an attacker could then use to compromise that user's online accounts.  If you enable this setting, the user cannot change the 'User name and passwords on forms' or 'prompt me to save passwords'. The Auto Complete feature for" User names and passwords on forms" will be turned on. If you disable this setting, the user cannot change the 'User name and passwords on forms' or 'prompt me to save passwords'. The Auto Complete feature for "User names and passwords on forms" is turned off. The user also cannot opt to be prompted to save passwords. If you do not configure this setting, the user has the freedom of turning on Auto Complete for "User name and passwords on forms", and the option of prompting to save passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn on the auto-complete feature for user names and passwords on forms' to 'Disabled'.

check_text:
  The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn on the auto-complete feature for user names and passwords on forms' must be 'Disabled'. 
  Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "FormSuggest Passwords" is REG_SZ = 'no', this is not a finding. AND Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "FormSuggest PW Ask" is REG_SZ = 'no', this is not a finding.


vuln_id: V-223125
rule_id: SV-223125r879627_rule
severity: CAT II
title: Managing SmartScreen Filter use must be enforced.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious websites. This policy setting allows users to enable the SmartScreen Filter, which will warn if the website being visited is known for fraudulent attempts to gather personal information through 'phishing' or is known to host malware. If you enable this setting the user will not be prompted to enable the SmartScreen Filter. It must be specified which mode the SmartScreen Filter uses: On or Off. If the feature is On, all website addresses not contained on the filters allow list, will be sent automatically to Microsoft without prompting the user. If this feature is set to Off, the feature will not run. If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is on the SIPRNet, this requirement is NA.

  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent Managing SmartScreen Filter" to "Enabled", and select "On" from the drop-down box.

check_text:
  If the system is on the SIPRNet, this requirement is NA.

  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent Managing SmartScreen Filter" must be "Enabled", and "On" selected from the drop-down box. 

  Procedure: Use the Windows Registry Editor to navigate to the following key:

  HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter 

  Criteria: If the value "EnabledV9" is "REG_DWORD = 1", this is not a finding.


vuln_id: V-223126
rule_id: SV-223126r879559_rule
severity: CAT II
title: Browser must retain history on exit.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Delete Browsing History on exit automatically deletes specified items when the last browser window closes.  Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures.  Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Allow deleting browsing history on exit' to 'Disabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Allow deleting browsing history on exit' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value "ClearBrowsingHistoryOnExit" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223127
rule_id: SV-223127r879559_rule
severity: CAT II
title: Deleting websites that the user has visited must be disallowed.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks "Delete". If you disable this policy setting, websites that the user has visited will be deleted when the user clicks "Delete". If you do not configure this policy setting, the user will be able to select whether to delete or preserve websites the user visited when the user clicks "Delete".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Prevent Deleting Web sites that the User has Visited' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Prevent Deleting Web sites that the User has Visited' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value "CleanHistory" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223128
rule_id: SV-223128r879554_rule
severity: CAT II
title: InPrivate Browsing must be disallowed.
cci: CCI-000166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser privacy easy by not storing history, cookies, temporary Internet files, or other data. If you enable this policy setting, InPrivate Browsing will be disabled. If you disable this policy setting, InPrivate Browsing will be available for use. If you do not configure this setting, InPrivate Browsing can be turned on or off through the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> 'Turn off InPrivate Browsing' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> 'Turn off InPrivate Browsing' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value "EnableInPrivateBrowsing" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223129
rule_id: SV-223129r879587_rule
severity: CAT II
title: Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser control is allowed. If you disable this policy setting, script access to the WebBrowser control is not allowed. If you do not configure this policy setting, script access to the WebBrowser control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1206" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223130
rule_id: SV-223130r879587_rule
severity: CAT II
title: When uploading files to a server, the local directory path must be excluded (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Include local path when user is uploading files to a server' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Include local path when user is uploading files to a server' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "160A" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223131
rule_id: SV-223131r879587_rule
severity: CAT II
title: Internet Explorer Processes for Notification Bars must be enforced (Reserved).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223132
rule_id: SV-223132r879887_rule
severity: CAT II
title: Security Warning for unsafe files must be set to prompt (Internet zone).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to "Enable", these files open without a security warning. If you set the drop-down box to " Prompt", a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Show security warning for potentially unsafe files' to 'Enabled', and select 'Prompt' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Show security warning for potentially unsafe files' must be 'Enabled', and 'Prompt' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1806" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223133
rule_id: SV-223133r879587_rule
severity: CAT II
title: Internet Explorer Processes for Notification Bars must be enforced (Explorer).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223134
rule_id: SV-223134r879630_rule
severity: CAT II
title: ActiveX controls without prompt property must be used in approved domains only (Internet zone).
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow only approved domains to use ActiveX controls without prompt' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> ' Allow only approved domains to use ActiveX controls without prompt' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "120b" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223135
rule_id: SV-223135r879587_rule
severity: CAT II
title: Internet Explorer Processes for Notification Bars must be enforced (iexplore).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223136
rule_id: SV-223136r879587_rule
severity: CAT II
title: Cross-Site Scripting Filter must be enforced (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Cross-Site Scripting Filter' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Cross-Site Scripting Filter' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1409" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223137
rule_id: SV-223137r879587_rule
severity: CAT II
title: Scripting of Internet Explorer WebBrowser Control must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether a page may control embedded WebBrowser Control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser Control is allowed. If you disable this policy setting, script access to the WebBrowser Control is not allowed. If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet Zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1206" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223138
rule_id: SV-223138r879587_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).

description:
  <VulnDiscussion>This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Include local path when user is uploading files to a server' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Include local path when user is uploading files to a server' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "160A" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223139
rule_id: SV-223139r879887_rule
severity: CAT II
title: Security Warning for unsafe files must be disallowed (Restricted Sites zone).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to "Enable", these files open without a security warning. If you set the drop-down box to "Prompt", a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Show security warning for potentially unsafe files' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Show security warning for potentially unsafe files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1806" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223140
rule_id: SV-223140r879630_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone).

description:
  <VulnDiscussion>This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow only approved domains to use ActiveX controls without prompt' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow only approved domains to use ActiveX controls without prompt' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "120b" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223141
rule_id: SV-223141r879587_rule
severity: CAT II
title: Cross-Site Scripting Filter property must be enforced (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Cross-Site Scripting Filter' to 'Enabled', and select 'Enable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Cross-Site Scripting Filter' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1409" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223142
rule_id: SV-223142r879573_rule
severity: CAT II
title: Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved).
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL   Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.


vuln_id: V-223143
rule_id: SV-223143r879587_rule
severity: CAT II
title: Status bar updates via script must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perform an undesirable action. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Allow updates to status bar via script' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Allow updates to status bar via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2103" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223144
rule_id: SV-223144r879887_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone).

description:
  <VulnDiscussion>Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components not signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components not signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2004" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223145
rule_id: SV-223145r879887_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  .NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone).

description:
  <VulnDiscussion>It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will not execute signed managed components.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2001" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223146
rule_id: SV-223146r879587_rule
severity: CAT II
title: Scriptlets must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow Scriptlets' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow Scriptlets' must be 'Enabled', and 'Disable' selected from the drop-down box.  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1209" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223147
rule_id: SV-223147r879587_rule
severity: CAT II
title: Status bar updates via script must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow updates to status bar via script' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow updates to status bar via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2103" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223148
rule_id: SV-223148r879887_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  When Enhanced Protected Mode is enabled, ActiveX controls must be disallowed to run in Protected Mode.

description:
  <VulnDiscussion>This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode. Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode. If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page 'Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled' to 'Enabled'.

check_text:
  Note: If McAfee ENS Web Control is being used, this is Not Applicable.

  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page 'Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "DisableEPMCompat" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223149
rule_id: SV-223149r879534_rule
severity: CAT II
title: Dragging of content from different domains across windows must be disallowed (Internet zone).
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog box.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains across windows' to 'Enabled', and select 'Disabled' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains across windows' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2709" is REG_DWORD = 3, this is not a finding.


vuln_id: V-250540
rule_id: SV-250540r942484_rule
severity: CAT II
title: Turn off Encryption Support must be enabled.
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match.

  Satisfies: SRG-APP-000514, SRG-APP-000555, SRG-APP-000625, SRG-APP-000630, SRG-APP-000635</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Advanced Page >> "Turn off Encryption Support" to "Enabled".

  Select only "Only use TLS 1.2" from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Advanced Page >> "Turn off Encryption Support" must be "Enabled".

  Verify the only option selected is "Only use TLS 1.2" from the drop-down box.

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!SecureProtocols.

  Criteria: If the value for "SecureProtocols" is not REG_DWORD = "2048", this is a finding.


vuln_id: V-250541
rule_id: SV-250541r942485_rule
severity: CAT II
title: Allow Fallback to SSL 3.0 (Internet Explorer) must be disabled.
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by blocking an insecure fallback to SSL when TLS 1.0 or greater fails.

  Satisfies: SRG-APP-000514, SRG-APP-000555, SRG-APP-000625, SRG-APP-000630, SRG-APP-000635</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> "Allow fallback to SSL 3.0 (Internet Explorer)" to "Enabled", and select "No Sites" from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> "Allow fallback to SSL 3.0 (Internet Explorer)" must be "Enabled", and "No Sites" selected from the drop-down box. If "Allow fallback to SSL 3.0 (Internet Explorer)" is not "Enabled" or any other drop-down option is selected, this is a finding. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. 

  Criteria: If the value "EnableSSL3Fallback" is REG_DWORD=0, this is not a finding.


vuln_id: V-252910
rule_id: SV-252910r942486_rule
severity: CAT I
title: The version of Internet Explorer running on the system must be a supported version.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.

  Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw).

  This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may depend on the Information Assurance Vulnerability Management (IAVM) process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For Windows 10 General Availability Channel, remove or disable the Internet Explorer 11 application.

  To disable Internet Explorer 11 as a standalone browser, set the policy value for "Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Disable Internet Explorer 11 as a standalone browser" to "Enabled" with the option value set to "Never" or "Once per user".

check_text:
  Internet Explorer 11 is no longer supported on Windows 10 General Availability Channel.

  If Internet Explorer 11 is installed and enabled on Windows 10 General Availability Channel, this is a finding.

  If Internet Explorer 11 is installed and enabled on an unsupported OS, this is a finding.


vuln_id: V-218786
rule_id: SV-218786r1022652_rule
severity: CAT II
title: Both the log file and Event Tracing for Windows (ETW) for the IIS 10.0 web server must be enabled.
cci: CCI-000139,CCI-001464,CCI-001851
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.

  In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.

  Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 server name.

  Click the "Logging" icon.

  Under Log Event Destination, select the "Both log file and ETW event" radio button.

  Under the "Actions" pane, click "Apply".

check_text:
  Note: If the server is hosting WSUS, this is Not Applicable.

  Open the IIS 10.0 Manager.
  Click the IIS 10.0 server name.
  Click the "Logging" icon.
  Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.

  If the "Both log file and ETW event" radio button is not selected, this is a finding.


vuln_id: V-218788
rule_id: SV-218788r1156543_rule
severity: CAT II
cci: CCI-000134
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 web server events.

description:
  <VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.

  Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.

  Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 web server IIS Manager.
  Click the IIS 10.0 web server name.
  Under "IIS", double-click the "Logging" icon.
  Verify the "Format:" under "Log File" is configured to "W3C".
  Select "Fields".
  Under "Custom Fields", click "Add Field...".
  For each field being added, give a name unique to what the field is capturing.
  Click on the "Source Type" drop-down list and select "Request Header".
  Click the "Source" drop-down list, and select "Connection".
  Click "OK" to add.

  Click the "Source Type" drop-down list, and select "Request Header".
  Click the "Source" drop-down list, and select "Warning".
  Click "OK" to add.
  Click "Apply" under the "Actions" pane.

check_text:
  Note: If the server is hosting WSUS, this is Not Applicable.

  Access the IIS 10.0 web server IIS Manager.
  Click the IIS 10.0 web server name.
  Under "IIS", double-click the "Logging" icon.
  Verify the "Format:" under "Log File" is configured to "W3C".
  Select "Fields".
  Under "Custom Fields", verify the following fields have been configured:
  Request Header >> Connection.
  Request Header >> Warning.
  If any of the above fields are not selected, this is a finding.


vuln_id: V-218789
rule_id: SV-218789r1156546_rule
severity: CAT II
cci: CCI-001487
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.

description:
  <VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.

  Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.

  Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 web server IIS Manager.
  Click the IIS 10.0 web server name.
  Under "IIS", double-click the "Logging" icon.
  Verify the "Format:" under "Log File" is configured to "W3C".
  Select "Fields".
  Under "Standard Fields", select "User Agent", "User Name", and "Referrer".
  Under "Custom Fields", select the following fields:
  Click the "Source Type" drop-down list, and select "Request Header".
  Click on "Source" drop-down, list and select "Authorization".
  Click "OK" to add.

  Click the "Source" drop-down list, and select "Content-Type".
  Click the "Source Type" drop-down list, and select "Response Header".
  Click "OK" to add.
  Click "OK".
  Click "Apply" under the "Actions" pane.

check_text:
  Note: If the server is hosting WSUS, this is Not Applicable.

  Access the IIS 10.0 web server IIS Manager.
  Click the IIS 10.0 web server name.
  Under "IIS", double-click the "Logging" icon.
  Verify the "Format:" under "Log File" is configured to "W3C".
  Select "Fields".
  Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected.
  Under "Custom Fields", verify the following field has been configured:
  Request Header >> Authorization.
  Response Header >> Content-Type.
  If any of the above fields are not selected, this is a finding.


vuln_id: V-218790
rule_id: SV-218790r1067580_rule
severity: CAT II
cci: CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The log information from the IIS 10.0 web server must be protected from unauthorized modification or deletion.

description:
  <VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the system administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.

  Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Click the "Logging" icon.

  Click "Browse" and navigate to the directory where the log files are stored.

  Right-click the log file directory to review and click "Properties".

  Click the "Security" tab.

  Set the log file permissions for the appropriate group(s).

  Click "OK".

  Select "Apply" in the "Actions" pane.

check_text:
  This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.

  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Click the "Logging" icon.

  Click "Browse" and navigate to the directory where the log files are stored.

  Right-click the log file directory to review.

  Click "Properties".

  Click the "Security" tab.

  Verify log file access is restricted as follows. Otherwise, this is a finding.
  SYSTEM - Full Control, This folder, subfolders and files
  Administrators - Full Control, This folder, subfolders and files

  Note:  A "Web Administrators", etc., type group that is an approved group of administrators is also allowed, and must be given "Full Control, This folder, subfolders and files" permissions.


vuln_id: V-218791
rule_id: SV-218791r960948_rule
severity: CAT II
cci: CCI-001348
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The log data and records from the IIS 10.0 web server must be backed up onto a different system or media.

description:
  <VulnDiscussion>Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system, or onto separate media than the system on which the web server is running, helps to ensure the log records will be retained in the event of a catastrophic system failure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure system backups to include the directory paths of all IIS 10.0 web server and website log files.

check_text:
  The IIS 10.0 web server and website log files should be backed up by the system backup.

  To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files.

  Open the IIS 10.0 Manager.

  Click the IIS 10.0 server name.

  Click the "Logging" icon.

  Under "Log File" >> "Directory" obtain the path of the log file.

  Once all locations are known, consult with the System Administrator to review the server's backup procedure and policy.

  Verify the paths of all log files are part of the system backup.
  Verify log files are backed up to an unrelated system or onto separate media on which the system the web server is running.

  If the paths of all log files are not part of the system backup and/or not backed up to a separate media, this is a finding.


vuln_id: V-218792
rule_id: SV-218792r960963_rule
severity: CAT II
title: The IIS 10.0 web server must not perform user management for hosted applications.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>User management and authentication can be an essential part of any application hosted by the web server. Along with authenticating users, the user management function must perform several other tasks enterprise-wide, such as password complexity, locking users after a configurable number of failed logons, and management of temporary and emergency accounts.

  The web server contains a minimal user management function, but the web server user management function does not offer enterprise-wide user management, and user management is not the primary function of the web server. User management for the hosted applications should be done through a facility built for enterprise-wide user management, such as LDAP and Active Directory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Reconfigure any hosted applications on the IIS 10.0 web server to perform user management outside the IIS 10.0 web server.

  Document how the hosted application user management is accomplished.

check_text:
  Interview the System Administrator about the role of the IIS 10.0 web server.

  If the IIS 10.0 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server.

  If the IIS 10.0 web server is not hosting an application, this is Not Applicable.

  If the IIS web server is performing user management for hosted applications, this is a finding.

  If the IIS 10.0 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server, this is a finding.


vuln_id: V-218793
rule_id: SV-218793r960963_rule
severity: CAT II
title: The IIS 10.0 web server must only contain functions necessary for operation.
fix_text: Remove all unapproved programs and roles from the production IIS 10.0 web server.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DoD system.

  The web server must provide the capability to disable, uninstall, or deactivate functionality and services deemed non-essential to the web server mission or that adversely impact server performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Click “Start”.

  Open Control Panel.

  Click “Programs”.

  Click “Programs and Features”.

  Review the installed programs. If any programs are installed other than those required for the IIS 10.0 web services, this is a finding.

  Note: If additional software is needed, supporting documentation must be signed by the ISSO.


vuln_id: V-218794
rule_id: SV-218794r960963_rule
severity: CAT II
title: The IIS 10.0 web server must not be both a website server and a proxy server.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that also proxy requests into an otherwise protected network is a common attack, making the attack anonymous.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.

  Under the IIS installed features, if "Application Request Routing Cache" is present, double-click the icon to open the feature.

  From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...".

  In the "Application Request Routing" settings window, remove the check from the "Enable proxy" check box.

  Click "Apply" in the "Actions" pane.

check_text:
  Open the IIS 10.0 Manager.

  Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.

  If, under the IIS installed features "Application Request Routing Cache" is not present, this is not a finding.

  If, under the IIS installed features "Application Request Routing Cache" is present, double-click the icon to open the feature.

  From the right "Actions" pane under "Proxy", select "Server Proxy Settings...".

  In the "Application Request Routing" settings window, verify whether "Enable proxy" is selected.

  If "Enable proxy" is selected under the "Application Request Routing" settings, this is a finding.

  If the server has been approved to be a Proxy server, this requirement is Not Applicable.


vuln_id: V-218795
rule_id: SV-218795r960963_rule
severity: CAT I
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  All IIS 10.0 web server sample code, example applications, and tutorials must be removed from a production IIS 10.0 server.

description:
  <VulnDiscussion>Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove any executable sample code, example applications, or tutorials which are not explicitly used by a production website.

check_text:
  Navigate to the following folders:

  inetpub\
  Program Files\Common Files\System\msadc
  Program Files (x86)\Common Files\System\msadc

  If the folder or sub-folders contain any executable sample code, example applications, or tutorials which are not explicitly used by a production website, this is a finding.


vuln_id: V-218796
rule_id: SV-218796r960963_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 10.0 server.

description:
  <VulnDiscussion>Accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services created when the feature is not installed, become an exploitable threat to a web server.

  These accounts become inactive, are not monitored through regular use, and passwords for the accounts are not created or updated. An attacker, through very little effort, can use these accounts to gain access to the web server and begin investigating ways to elevate the account privileges.

  The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 web server.

  Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”.

  In the left pane, expand "Local Users and Groups" and click "Users".

  Delete any local accounts which were created by features which have been uninstalled or are not used.

check_text:
  Access the IIS 10.0 web server.

  Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”.

  In the left pane, expand "Local Users and Groups" and click "Users".

  Review the local users listed in the middle pane.

  If any local accounts are present and were created by features which have been uninstalled or are not used, this is a finding.


vuln_id: V-218797
rule_id: SV-218797r960963_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must be reviewed on a regular basis to remove any Operating System features, utility programs, plug-ins, and modules not necessary for operation.

description:
  <VulnDiscussion>Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is a danger at the application layer of the OSI model. Office suites, development tools, and graphic editors are examples of such troublesome programs.

  Individual productivity tools have no legitimate place or use on an enterprise production web server and are prone to security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services, and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove all utility programs, Operating System features, or modules installed that are not necessary for web server operation.

check_text:
  Consult with the System Administrator and review all of the IIS 10.0 and Operating System features installed.

  Determine if any features installed are no longer necessary for operation.

  If any utility programs, features, or modules are installed which are not necessary for operation, this is a finding.

  If any unnecessary Operating System features are installed, this is a finding.


vuln_id: V-218798
rule_id: SV-218798r1112381_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.

description:
  <VulnDiscussion>Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.

  A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.

  A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under IIS, double-click the "MIME Types" icon.

  From the "Group by:" drop-down list, select "Content Type".

  From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions:

  .exe
  .dll
  .com
  .bat
  .csh

  Under the "Actions" pane, click "Apply".

check_text:
  Note: If the server is hosting WSUS, this is not applicable.

  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under IIS, double-click the "MIME Types" icon.

  From the "Group by:" drop-down list, select "Content Type".

  From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:

  .exe
  .dll
  .com
  .bat
  .csh

  If any OS shell MIME types are configured, this is a finding.


vuln_id: V-218799
rule_id: SV-218799r960963_rule
severity: CAT II
title: The IIS 10.0 web server must have Web Distributed Authoring and Versioning (WebDAV) disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol which, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.

  WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access Server Manager on the IIS 10.0 web server.

  Click the IIS 10.0 web server name.

  Click on "Manage".

  Select "Add Roles and Features".

  Click "Next" in the "Before you begin" dialog box.

  Select "Role-based or feature-based installation" on the "Installation Type" dialog box and click "Next".

  Select the IIS 10.0 web server in the "Server Selection" dialog box.

  From the "Windows Features" dialog box, navigate to "World Wide Web Services" >> "Common HTTP Features".

  De-select "WebDAV Publishing", and click "Next" to complete removing the WebDAV Publishing feature from the IIS 10.0 web server.

check_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Review the features listed under the “IIS" section.

  If the "WebDAV Authoring Rules" icon exists, this is a finding.


vuln_id: V-218801
rule_id: SV-218801r961083_rule
severity: CAT II
fix_text: Remove all files from the web server with both .java and .jpp extensions.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  Java software installed on a production IIS 10.0 web server must be limited to .class files and the Java Virtual Machine.

description:
  <VulnDiscussion>Mobile code in hosted applications allows the developer to add functionality and displays to hosted applications that are fluid, as opposed to a static web page. The data presentation becomes more appealing to the user, is easier to analyze, and is less complicated to navigate through the hosted application and data.

  Some mobile code technologies in use in today's applications are: Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. The DoD has created policies that define the usage of mobile code on DoD systems. The usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations.

  Source code for a Java program is often stored in files with either .java or .jpp file extensions. From the .java and .jpp files the Java compiler produces a binary file with an extension of .class. The .java or .jpp file could therefore reveal sensitive information regarding an application's logic and permissions to resources on the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Search the system for files with either .java or .jpp extensions.

  If files with .java or .jpp extensions are found, this is a finding.


vuln_id: V-218802
rule_id: SV-218802r1138072_rule
severity: CAT I
cci: CCI-001082
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  IIS 10.0 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

description:
  <VulnDiscussion>As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.

  All non-administrator access to shell scripts and operating system functions must be mission essential and documented.

check_text:
  Obtain a list of the user accounts with access to the system, including all local and domain accounts. 

  Review the privileges to the web server for each account.

  Verify with the system administrator or the ISSO that all privileged accounts are mission essential and documented.

  Verify with the system administrator or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented.

  If undocumented privileged accounts are found, this is a finding.

  If undocumented non-administrator access to shell scripts and operating system functions are found, this is a finding.

  If this IIS 10 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.


vuln_id: V-218803
rule_id: SV-218803r1138074_rule
severity: CAT II
cci: CCI-001082
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must separate the hosted applications from hosted web server management functionality.

description:
  <VulnDiscussion>The separation of user functionality from web server management can be accomplished by moving management functions to a separate IP address or port. To further separate the management functions, separate authentication methods and certificates should be used.

  By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Develop a method to manage the hosted applications, either by moving its management functions off of the IIS 10.0 web server or by accessing the application's management via a uniquely assigned IP address.

check_text:
  Review the IIS 10.0 web server configuration with the System Administrator.

  Determine if the IIS 10.0 web server hosts any applications.

  If the IIS 10.0 web server does not host any applications, this is Not Applicable.

  If the IIS 10.0 web server is hosting Exchange, this is Not Applicable.

  If the IIS 10.0 web server hosts applications, review the application's management functionality and authentication methods with the System Administrator to determine if the management of the application is accomplished with the same functions and authentication methods as the web server management.

  If the IIS 10.0 web server management and the application's management functionality is not separated, this is a finding.


vuln_id: V-218804
rule_id: SV-218804r1043180_rule
severity: CAT II
title: The IIS 10.0 web server must use cookies to track session state.
cci: CCI-001664
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol.

  Using URI will embed the session ID as a query string in the Uniform Resource Identifier (URI) request and then the URI is redirected to the originally requested URL. The changed URI request is used for the duration of the session, so no cookie is necessary.

  By requiring expired session IDs to be regenerated while using URI, potential attackers have less time to capture a cookie and gain access to the Web server content.

  Satisfies: SRG-APP-000223-WSR-000011, SRG-APP-000220-WSR-000201</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under "ASP.Net", double-click the "Session State" icon.

  Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list.

  Click "Apply" in the "Actions" pane.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Open the IIS 10.0 Manager.
  Click the IIS 10.0 web server name.
  Under "ASP.Net", double-click the "Session State" icon.
  Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.
  If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.

  Alternative method:
  Click the site name.
  Select "Configuration Editor" under the "Management" section.
  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
  Verify the "cookieless" is set to "UseCookies".
  If the "cookieless" is not set to "UseCookies", this is a finding.

  Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.


vuln_id: V-218805
rule_id: SV-218805r1067583_rule
severity: CAT II
title: The IIS 10.0 web server must accept only system-generated session identifiers.
cci: CCI-001664
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session.

  When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under the "ASP.NET" section, select "Session State".

  Under "Cookie Settings", select the "Use Cookies" mode from the "Mode:" drop-down list.

  Under "Time-out (in minutes)", enter a value of "15 or less".

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under the "ASP.NET" section, select "Session State".

  Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.

  Under "Time-out (in minutes)", verify a maximum of 15 minutes is entered.

  If the "Use Cookies" mode is selected and Time-out (in minutes) is configured for "15 minutes" (or less), this is not a finding.

  Alternative method:

  Click the site name.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".

  Verify the "cookieless" is set to "UseCookies".

  If the "cookieless" is not set to "UseCookies", this is a finding.

  Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.


vuln_id: V-218806
rule_id: SV-218806r961122_rule
severity: CAT II
title: The IIS 10.0 web server must augment re-creation to a stable and known baseline.
cci: CCI-001190
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the possibility for security risks. The web server must offer, and not hinder, a method that allows for the quick and easy reinstallation of a verified and patched baseline to guarantee the production web server is up-to-date and has not been modified to add functionality or expose security risks.

  When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Prepare documentation for disaster recovery methods for the IIS 10.0 web server in the event of the necessity for rollback.

  Document and test the disaster recovery methods designed.

check_text:
  Interview the System Administrator for the IIS 10.0 web server.

  Ask for documentation on the disaster recovery methods tested and planned for the IIS 10.0 web server in the event of the necessity for rollback.

  If documentation for a disaster recovery has not been established, this is a finding.


vuln_id: V-218807
rule_id: SV-218807r1067586_rule
severity: CAT II
title: The production IIS 10.0 web server must utilize SHA2 encryption for the Machine Key.
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>The Machine Key element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, forms authentication, membership and roles, and anonymous identification. Ensuring a strong encryption method can mitigate the risk of data tampering in crucial functional areas such as forms authentication cookies, or view state.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "Machine Key" icon in the web server Home Pane.

  Set the Validation method to "HMACSHA256" or stronger.

  Set the Encryption method to "Auto".

  Click "Apply" in the "Actions" pane.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Note: If the IIS 10.0 web server is hosting Exchange, this is Not Applicable.

  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "Machine Key" icon in the website Home Pane.

  Verify "HMACSHA256" or stronger encryption is selected for the Validation method and "Auto" is selected for the Encryption method.

  If "HMACSHA256" or stronger encryption is not selected for the Validation method and/or "Auto" is not selected for the Encryption method, this is a finding.

  If .NET is not installed, this is Not Applicable.


vuln_id: V-218808
rule_id: SV-218808r961158_rule
severity: CAT II
title: Directory Browsing on the IIS 10.0 web server must be disabled.
cci: CCI-001310
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled, the risk of inadvertently disclosing sensitive content is increased.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "Directory Browsing" icon.

  Under the "Actions" pane click "Disabled".

  Under the "Actions" pane, click "Apply".

check_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "Directory Browsing" icon.

  Under the “Actions” pane verify "Directory Browsing" is disabled.

  If “Directory Browsing” is not disabled, this is a finding.


vuln_id: V-218809
rule_id: SV-218809r961167_rule
severity: CAT II
title: The IIS 10.0 web server Indexing must only index web content.
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Run MMC.

  Add the Indexing Service snap-in.

  Edit the indexed directories to only include web document directories.

check_text:
  Access the IIS 10.0 Web Server.

  Access an administrator command prompt and type "regedit <enter>" to access the server's registry.

  Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\.

  If this key exists, then indexing is enabled. 

  If the key does not exist, this check is Not Applicable.

  Review the Catalog keys to determine if directories other than web document directories are being indexed.

  If so, this is a finding.


vuln_id: V-218810
rule_id: SV-218810r1022657_rule
severity: CAT II
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 web server, patches, loaded modules, and directory paths.

description:
  <VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "Error Pages" icon.

  Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.

  Set Feature Setting to "Detailed errors for local requests and custom error pages for remote requests" or "Custom error pages".

check_text:
  Note: If the server is hosting WSUS, this is Not Applicable.

  Open the IIS 10.0 Manager.
  Click the IIS 10.0 web server name.
  Double-click the "Error Pages" icon.
  Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.

  If the feature setting is not set to "Detailed errors for local requests and custom error pages for remote requests", or "Custom error pages"  this is a finding.


vuln_id: V-218812
rule_id: SV-218812r961278_rule
severity: CAT II
title: The IIS 10.0 web server must restrict inbound connections from non-secure zones.
cci: CCI-002314
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions.

  A web server can be accessed remotely and must be capable of restricting access from what the DoD defines as non-secure zones. Non-secure zones are defined as any IP, subnet, or region defined as a threat to the organization. The non-secure zones must be defined for public web servers logically located in a DMZ, as well as private web servers with perimeter protection devices. By restricting access from non-secure zones through internal web server access lists, the web server can stop or slow denial of service (DoS) attacks on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under "Management", double-click "Management Service".

  Stop the Web Management Service under the "Actions" pane.

  Configure only known, secure IP ranges as "Allow".

  Select "Apply" in "Actions" pane.

  Restart the Web Management Service under the "Actions" pane.

check_text:
  Note: This requirement applies to the Web Management Service. If the Web Management Service is not installed, this is Not Applicable.

  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under "Management", double-click "Management Service".

  If "Enable remote connections" is not selected, this is Not Applicable.

  If "Enable remote connections" is selected, review the entries under "IP Address Restrictions".

  Verify only known, secure IP ranges are configured as "Allow".

  If "IP Address Restrictions" are not configured or IP ranges configured to "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.


vuln_id: V-218813
rule_id: SV-218813r961281_rule
severity: CAT II
cci: CCI-002322
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must provide the capability to immediately disconnect or disable remote access to the hosted applications.

description:
  <VulnDiscussion>During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.

  The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.

  The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Prepare documented procedures for shutting down an IIS 10.0 website in the event of an attack.

  The procedure should, at a minimum, provide the following steps:

  Determine the respective website for the application at risk of an attack.

  Access the IIS 10.0 web server IIS Manager.

  Select the respective website. 

  In the "Actions" pane, under "Manage Website", click "Stop".

  If necessary, stop all websites.

  If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager.

  In the "Actions" pane, under "Manage Server", click "Stop".

check_text:
  Interview the System Administrator and Web Manager.

  Ask for documentation for the IIS 10.0 web server administration.

  Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:

  Determine the respective website for the application at risk of an attack.

  Access the IIS 10.0 web server IIS Manager.

  Select the respective website.

  In the "Actions" pane, under "Manage Website", click "Stop".

  If necessary, stop all websites.

  If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager.

  In the "Actions" pane, under "Manage Server", click "Stop".

  If the web server is not capable or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.


vuln_id: V-218814
rule_id: SV-218814r1067589_rule
severity: CAT II
title: IIS 10.0 web server system files must conform to minimum file permission requirements.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open Explorer and navigate to the inetpub directory.

  Right-click "inetpub" and select "Properties".

  Click the "Security" tab.

  Set the following permissions: 
  System: Full control
  Administrators: Full control
  TrustedInstaller: Full control
  ALL APPLICATION PACKAGES (built-in security group): Read and execute, This folder, subfolders and files
  ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute, This folder, subfolders and files
  Users: Read and execute, list folder contents
  CREATOR OWNER: Full Control, Subfolders and files only

check_text:
  Open Explorer and navigate to the inetpub directory.

  Right-click "inetpub" and select "Properties".

  Click the "Security" tab.

  Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.

  System: Full control
  Administrators: Full control
  TrustedInstaller: Full control
  ALL APPLICATION PACKAGES (built-in security group): Read and execute, This folder, subfolders and files
  ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute, This folder, subfolders and files
  Users: Read and execute, list folder contents
  CREATOR OWNER: Full Control, Subfolders and files only


vuln_id: V-218815
rule_id: SV-218815r961392_rule
severity: CAT II
cci: CCI-001849
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must use a logging mechanism configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 10.0 web server.

description:
  <VulnDiscussion>To ensure the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity.

  The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under "IIS" double-click on the "Logging" icon.

  If necessary, in the "Logging" configuration box, re-designate a log path to a location able to house the logs.

  Under "Log File Rollover", de-select the "Do not create new log files" setting.

  Configure a schedule to rollover log files on a regular basis.

check_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under "IIS" double-click the "Logging" icon.

  In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.

  Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.

  Under "Log File Rollover", verify "Do not create new log files" is not selected.

  Verify a schedule is configured to rollover log files on a regular basis.

  Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device.

  If the designated logging path device is not of sufficient space to maintain all log files, and there is not a schedule to rollover files on a regular basis, this is a finding.


vuln_id: V-218816
rule_id: SV-218816r1067591_rule
severity: CAT II
cci: CCI-000213,CCI-001813,CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  Access to web administration tools must be restricted to the web manager and the web managers designees.

description:
  <VulnDiscussion>A web server can be modified through parameter modification, patch installation, upgrades to the web server or modules, and security parameter changes. With each of these changes, there is the potential for an adverse effect such as a DoS, web server instability, or hosted application instability.

  To limit changes to the web server and limit exposure to any adverse effects from the changes, files such as the web server application files, libraries, and configuration files must have permissions and ownership set properly to only allow privileged users access.

  The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators.

  Satisfies: SRG-APP-000380-WSR-000072, SRG-APP-000435-WSR-000147, SRG-APP-000033-WSR-000169</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Restrict access to the web administration tool to only the web manager and the web manager’s designees.

check_text:
  Right-click "InetMgr.exe", then click "Properties" from the "Context" menu.

  Select the "Security" tab.

  Review the groups and user names.

  The following accounts may have Full control privileges:

  TrustedInstaller
  Web Managers
  Web Manager designees
  CREATOR OWNER

  The following accounts may have read and execute, or read permissions:

  Non Web Manager Administrators
  ALL APPLICATION PACKAGES (built-in security group)
  ALL RESTRICTED APPLICATION PACKAGES (built-in security group)
  SYSTEM
  Users

  Specific users may be granted read and execute and read permissions.

  Compare the local documentation authorizing specific users, against the users observed when reviewing the groups and users.

  If any other access is observed, this is a finding.


vuln_id: V-218817
rule_id: SV-218817r961470_rule
severity: CAT II
title: The IIS 10.0 web server must not be running on a system providing any other role.
fix_text: Remove all unapproved programs and roles from the production web server.
cci: CCI-001762
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.

  The web server must provide the capability to disable or deactivate network-related services deemed non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review programs installed on the OS.

  Open Control Panel.

  Open Programs and Features.

  The following programs may be installed without any additional documentation:

  Administration Pack for IIS
  IIS Search Engine Optimization Toolkit
  Microsoft .NET Framework version 3.5 SP1 or greater
  Microsoft Web Platform Installer version 3.x or greater
  Virtual Machine Additions

  Review the installed programs, if any programs are installed other than those listed above, this is a finding.

  Note: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.


vuln_id: V-218818
rule_id: SV-218818r961470_rule
severity: CAT II
title: The Internet Printing Protocol (IPP) must be disabled on the IIS 10.0 web server.
cci: CCI-001762
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>The use of IPP on an IIS web server allows client access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Click “Start”, click “Administrative Tools”, and then click “Server Manager”.

  Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”.

  If the Internet Printing option is checked, clear the check box, click “Next”, and then click “Remove” to complete the wizard.

check_text:
  If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable.

  Navigate to the following directory:

  %windir%\web\printers

  If this folder exists, this is a finding.

  Determine whether Internet Printing is enabled:

  Click “Start”, click “Administrative Tools”, and then click “Server Manager”.

  Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”.

  If the Internet Printing option is enabled, this is a finding.


vuln_id: V-218819
rule_id: SV-218819r1022659_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must be tuned to handle the operational requirements of the hosted application.

description:
  <VulnDiscussion>A Denial of Service (DoS) can occur when the web server is overwhelmed and can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 web server registry.

  Verify the following keys are present and configured. The required setting depends upon the requirements of the application. These settings must be explicitly configured to show a conscientious tuning has been made.

  Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\

  Configure the following registry keys to levels to accommodate the hosted applications.

  Create REG_DWORD "URIEnableCache"
  Create REG_DWORD "UriMaxUriBytes"
  Create REG_DWORD "UriScavengerPeriod"

check_text:
  If the IIS 10.0 web server is not hosting any applications, this is Not Applicable.

  If the IIS 10.0 web server is hosting applications, consult with the system administrator to determine risk analysis performed when the application was written and deployed to the IIS 10.0 web server.

  Obtain documentation on the configuration.
  Verify, at a minimum, the following tuning settings in the registry.
  Access the IIS 10.0 web server registry.
  Verify the following keys are present and configured. The required setting depends upon the requirements of the application. 
  Recommended settings are not provided as these settings must be explicitly configured to show a conscientious tuning has been made.
  Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\
  REG_DWORD "URIEnableCache"
  REG_DWORD "UriMaxUriBytes"
  REG_DWORD "UriScavengerPeriod"

  If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.


vuln_id: V-218820
rule_id: SV-218820r961632_rule
severity: CAT II
title: IIS 10.0 web server session IDs must be sent to the client using TLS.
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under "Management" section, double-click the "Configuration Editor" icon.

  From the "Section:" drop-down list, select "system.webServer/asp".

  Expand the "session" section.

  Select "True" for the "keepSessionIdSecure" setting.

  Select "Apply" from the "Actions" pane.

check_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Under the "Management" section, double-click the "Configuration Editor" icon.

  From the "Section:" drop-down list, select "system.webServer/asp".

  Expand the "session" section.

  Verify the "keepSessionIdSecure" is set to "True".

  If the "keepSessionIdSecure" is not set to "True", this is a finding.


vuln_id: V-218821
rule_id: SV-218821r1067596_rule
severity: CAT I
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  An IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.

description:
  <VulnDiscussion>TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.

  NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 Web Server.

  Navigate to:
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server 

  Create a REG_DWORD named "DisabledByDefault" with a value of "0".
  Create a REG_DWORD named "Enabled" with a  value of "1".

  Navigate to:
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server

  For each protocol:
  Create a REG_DWORD named "DisabledByDefault" with a value of "1".
  Create a REG_DWORD named "Enabled" with a  value of "0".

check_text:
  Access the IIS 10.0 Web Server.

  Navigate to:
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server

  Verify a REG_DWORD value of "0" for "DisabledByDefault".
  Verify a REG_DWORD value of "1" for "Enabled".

  Navigate to:
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server

  Verify a REG_DWORD value of "1" for "DisabledByDefault".
  Verify a REG_DWORD value of "0" for "Enabled".

  If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.

  SSL 3.0 is disabled by default in newer Operating Systems. If SSL 3.0 has a registry DWORD enabled with a value of 1, this is a finding. If this key is not present, this is not a finding.


vuln_id: V-218822
rule_id: SV-218822r961632_rule
severity: CAT II
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.

description:
  <VulnDiscussion>TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2-approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled.

  NIST SP 800-52 defines the approved TLS versions for government applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the web server to use an approved TLS version according to NIST SP 800-52 and to disable all non-approved versions.

check_text:
  Review the web server documentation and deployed configuration to determine which version of TLS is being used.

  If the TLS version is not TLS 1.2 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.


vuln_id: V-218823
rule_id: SV-218823r961863_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  All accounts installed with the IIS 10.0 web server software and tools must have passwords assigned and default passwords changed.

description:
  <VulnDiscussion>During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.

  The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.

  Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 web server.

  Access the "Apps" menu. Under Administrative Tools, select Computer Management.

  In left pane, expand "Local Users and Groups" and click on "Users".

  Change passwords for any local accounts present that are used by IIS 10.0, then verify with System Administrator default passwords have been changed.

  Develop an internal process for changing passwords on a regular basis.

check_text:
  Access the IIS 10.0 web server.

  Access the "Apps" menu. Under "Administrative Tools", select "Computer Management".

  In left pane, expand "Local Users and Groups" and click "Users".

  Review the local users listed in the middle pane. 

  If any local accounts are present and used by IIS 10.0, verify with System Administrator that default passwords have been changed.

  If passwords have not been changed from the default, this is a finding.


vuln_id: V-218824
rule_id: SV-218824r961863_rule
severity: CAT II
title: Unspecified file extensions on a production IIS 10.0 web server must be removed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "ISAPI and CGI restrictions" icon.

  Click "Edit Feature Settings".

  Remove the check from the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes.

  Click "OK".

check_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the "ISAPI and CGI restrictions" icon.

  Click “Edit Feature Settings".

  Verify the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are NOT checked.

  If either or both of the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are checked, this is a finding.


vuln_id: V-218825
rule_id: SV-218825r1067593_rule
severity: CAT II
title: The IIS 10.0 web server must have a global authorization rule configured to restrict access.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the IIS 10.0 web server name.

  Double-click the ".NET Authorization Rules" icon.

  Alter the list as necessary to ensure "All Users" is set to "Allow" and "Anonymous Users" is set to "Deny".

  Remove any other line items.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.
  Note: If the Server is hosting Microsoft SharePoint, this is Not Applicable.
  Note: If the server is hosting WSUS, this is Not Applicable.
  Note: If the server is hosting Exchange, this is Not Applicable.
  Note: If the server is public facing, this is Not Applicable.
  Note: If the website is behind a load balancer or proxy server, this is Not Applicable.

  Open the IIS 10.0 Manager.
  Click the IIS 10.0 web server name.
  Double-click the ".NET Authorization Rules" icon.
  Ensure "All Users" is set to "Allow", and "Anonymous Users" is set to "Deny", otherwise this is a finding.
  If any other rules are present, this is a finding.


vuln_id: V-218826
rule_id: SV-218826r960735_rule
severity: CAT II
cci: CCI-000054
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
title:
  The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.

description:
  <VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the IIS 10.0 IIS Manager.

  Click the IIS 10.0 server.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".

  Expand "siteDefaults".
  Expand "limits".

  Set the "maxconnections" parameter to a value greater than zero.

check_text:
  Access the IIS 10.0 IIS Manager.

  Click the IIS 10.0 server.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".

  Expand "siteDefaults".
  Expand "limits".

  Review the results and verify the value is greater than zero for the "maxconnections" parameter.

  If the maxconnections parameter is set to zero, this is a finding.


vuln_id: V-218827
rule_id: SV-218827r1112380_rule
severity: CAT III
title: The IIS 10.0 web server must enable HTTP Strict Transport Security (HSTS).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>HTTP Strict Transport Security (HSTS) ensures browsers always connect to a website over TLS. HSTS exists to remove the need for redirection configurations. HSTS relies on the browser, web server, and a public "Allowlist". If the browser does not support HSTS, it will be ignored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Using the Configuration Editor in the IIS Manager or Powershell:
  Enable HSTS.
  Set includeSubDomains to True.
  Set max-age to a value greater than 0.
  Set redirectHttpToHttps to True.

check_text:
  Note: If the server is hosting WSUS, this is not applicable.
  Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.

  Access the IIS 10.0 Web Server.
  Open IIS Manager.
  Click the IIS 10.0 web server name.
  Open on Configuration Editor under Management.
  For the Section, navigate to system.applicationHost/sites.
  Expand siteDefaults and HSTS.
  If enabled is not set to True, this is a finding.
  If includeSubDomains is not set to True, this is a finding.
  If max-age is not set to a value greater than 0, this is a finding.
  If redirectHttpToHttps is not True, this is a finding.

  If the website is behind a load balancer or proxy server, and HSTS enablement is handled there, this is not applicable.

  If the version of Windows Server does not natively support HSTS, this is not a finding.


vuln_id: V-228572
rule_id: SV-228572r960963_rule
severity: CAT II
title: An IIS Server configured to be a SMTP relay must require authentication.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Anonymous SMTP relays are strictly prohibited. An anonymous SMTP relay can be a vector for many types of malicious activity not limited to server exploitation for the sending of SPAM mail, access to emails, phishing, DoS attacks, etc. Enabling TLS, authentication, and strictly assigning IP addresses that can communicate with the relay greatly reduce the risk of the implementation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the relay server with a specific allowed IP address, from the same network as the relay, and implement TLS.

check_text:
  Interview the System Administrator about the role of the IIS 10.0 web server.

  If the IIS 10.0 web server is running SMTP relay services, have the SA provide supporting documentation on how the server is hardened. A DoD-issued certificate, and specific allowed IP address should be configured.

  If the IIS web server is not running SMTP relay services, this is Not Applicable.

  If the IIS web server running SMTP relay services without TLS enabled, this is a finding.

  If the IIS web server running SMTP relay services is not configured to only allow a specific IP address, from the same network as the relay, this is a finding.


vuln_id: V-241788
rule_id: SV-241788r1025160_rule
severity: CAT III
title: HTTPAPI Server version must be removed from the HTTP Response Header information.
cci: CCI-001312
deprecated_at: 2026-03-12 19:55:53
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>HTTP Response Headers contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of certain HTTP Response Header information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters".
  Create REG_DWORD "DisableServerHeader” and set it to "2".

  Note: This can be performed multiple ways; this is an example.

check_text:
  Note: If the server is hosting WSUS, this is Not Applicable.

  Open Registry Editor.
  Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters"
  Verify "DisableServerHeader” is set to "2".

  If REG_DWORD DisableServerHeader is not set to 2, this is a finding.
  If the System Administrator can show that Server Version information has been removed via other means, such as using a rewrite outbound rule, this is not a finding.


vuln_id: V-241789
rule_id: SV-241789r1022662_rule
severity: CAT III
title: ASP.NET version must be removed from the HTTP Response Header information.
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>HTTP Response Headers contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of certain HTTP Response Header information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.
  Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.
  Click the HTTP Response Headers button.
  Click to select the “X-Powered-By” HTTP Header.
  Click “Remove” in the Actions Panel.
  Note: This can be performed multiple ways, this is an example.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Open the IIS 10.0 Manager.
  Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.
  Click the HTTP Response Headers button.
  Click to select the “X-Powered-By” HTTP Header.
  If “X-Powered-By” has not been removed, this is a finding.


vuln_id: V-268325
rule_id: SV-268325r1025163_rule
severity: CAT II
title: The Request Smuggling filter must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 19:55:53
description:
  <VulnDiscussion>Security scans show Request Smuggling vulnerability on IIS server.

  The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

  The vulnerability exists due to the way that HTTP proxies (front-end) and web servers (back-end) that do not strictly adhere to RFC standards handle sequences of HTTP requests received from multiple sources. A remote attacker can send a specially crafted request to a targeted IIS Server, perform HTTP request smuggling attack and modify responses or retrieve information from another user's HTTP session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters".
  Create REG_DWORD "DisableRequestSmuggling” and set it to "1".

  Note: This can be performed multiple ways; this is an example.

check_text:
  Open Registry Editor.
  Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters"
  Verify "DisableRequestSmuggling” is set to "1".

  If REG_DWORD DisableRequestSmuggling is not set to 1, this is a finding.


vuln_id: V-218735
rule_id: SV-218735r1022667_rule
severity: CAT II
title: The IIS 10.0 website session state must be enabled.
cci: CCI-000054
deprecated_at: 2026-03-12 20:00:16
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is either stored in a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.

  When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.

  ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Under the "ASP.NET" section, select "Session State".

  Under "Session State Mode Settings", verify the "In Process" mode is selected.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Under the "ASP.NET" section, select "Session State".

  Under "Session State Mode Settings", verify the "In Process" mode is selected.

  If the "Session State Mode Settings" is set to "In Process", this is not a finding.

  Alternative method:

  Click the site name.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".

  Verify the "mode" reflects "InProc".

  If the "mode" is not set to "InProc", this is a finding.

  If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.


vuln_id: V-218736
rule_id: SV-218736r1022669_rule
severity: CAT II
title: The IIS 10.0 website session state cookie settings must be configured to Use Cookies mode.
cci: CCI-000054
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.

  When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.

  ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session.

  When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server: 

  Open the IIS 10.0 Manager.

  Click the site name.

  Under the ASP.NET section, select "Session State".

  Under "Cookie Settings", select the "Use Cookies" from the "Mode:" drop-down list.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:
  Open the IIS 10.0 Manager.
  Click the site name.
  Under the "ASP.NET" section, select "Session State".
  Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.
  If the "Use Cookies" mode is selected, this is not a finding.

  Alternative method:
  Click the site name.
  Select "Configuration Editor" under the "Management" section.
  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
  Verify the "cookieless" is set to "UseCookies".
  If the "cookieless" is not set to "UseCookies", this is a finding.
  Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.


vuln_id: V-218737
rule_id: SV-218737r1022671_rule
severity: CAT II
title: A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.
cci: CCI-000068
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.

  NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "SSL Settings" icon.

  Select "Require SSL" check box.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
  Note: If the server is hosting SharePoint, this is Not Applicable.
  Note: If the server is hosting WSUS, this is Not Applicable.
  Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server and is Not Applicable in this STIG.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.
  Click the site name.
  Double-click the "SSL Settings" icon.
  Verify "Require SSL" check box is selected.

  If the "Require SSL" check box is not selected, this is a finding.


vuln_id: V-218738
rule_id: SV-218738r1022673_rule
severity: CAT II
cci: CCI-000068
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  A public IIS 10.0 website must only accept Secure Socket Layer (SSL) connections when authentication is required.

description:
  <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.

  NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "SSL Settings" icon.

  Select "Require SSL" check box.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable.
  Note: If the server being reviewed is a public IIS 10.0 web server not requiring authentication, this is Not Applicable.
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.
  Note: If the server being reviewed is hosting WSUS, this is Not Applicable.
  Note: If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is Not Applicable.
  Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "SSL Settings" icon.

  Verify "Require SSL" check box is selected.

  If the "Require SSL" check box is not selected, this is a finding.


vuln_id: V-218739
rule_id: SV-218739r1022675_rule
severity: CAT II
title: Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.
cci: CCI-000139,CCI-001464
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.

  In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.

  Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Click the "Logging" icon.

  Under Log Event Destination, select the "Both log file and ETW event" radio button.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If this server is hosting WSUS, this requirement is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Click the "Logging" icon.

  Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.

  If the "Both log file and ETW event" radio button is not selected, this is a finding.

  Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting. More configuration information is available at:
  https://blogs.intelink.gov/blogs/_disairrt/?p=1317


vuln_id: V-218740
rule_id: SV-218740r960900_rule
severity: CAT II
cci: CCI-000133
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.

description:
  <VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. 

  Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.

  A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 10.0 web server transparently.

check_text:
  Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy.

  If the IIS 10.0 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Click the "Logging" icon.

  Click "View log file".

  When log file is displayed, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server.

  If the website is not behind a load balancer or proxy server, this is Not Applicable.

  If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.

  If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.


vuln_id: V-218741
rule_id: SV-218741r1022677_rule
severity: CAT II
cci: CCI-000134
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events.

description:
  <VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.

  Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.

  Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Select the website being reviewed.

  Under "IIS", double-click the "Logging" icon.

  Configure the "Format:" under "Log File" to "W3C".

  Select "Fields".

  Under "Custom Fields", select the following fields:

  Request Header >> Connection

  Request Header >> Warning

  Click "OK".

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If this server is hosting WSUS, this requirement is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Select the website being reviewed.

  Under "IIS", double-click the "Logging" icon.

  Verify the "Format:" under "Log File" is configured to "W3C".

  Select "Fields".

  Under "Custom Fields", verify the following fields are selected:

  Request Header >> Connection

  Request Header >> Warning

  If any of the above fields are not selected, this is a finding.


vuln_id: V-218742
rule_id: SV-218742r1022679_rule
severity: CAT II
cci: CCI-001487
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.

description:
  <VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.

  Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.

  Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 web server IIS 10.0 Manager.

  Select the website being reviewed.

  Under "IIS", double-click the "Logging" icon.

  Configure the "Format:" under "Log File" to "W3C".

  Select "Fields".

  Under "Standard Fields", select "User Agent", "User Name", and "Referrer".

  Under "Custom Fields", select the following fields:

  Request Header >> Authorization

  Response Header >> Content-Type

  Click "OK".

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If this server is hosting WSUS, this requirement is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 web server IIS 10.0 Manager.

  Under "IIS", double-click the "Logging" icon.

  Verify the "Format:" under "Log File" is configured to "W3C".

  Select "Fields".

  Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected.

  Under "Custom Fields", verify the following fields have been configured: 

  Request Header >> Authorization

  Response Header >> Content-Type

  If any of the above fields are not selected, this is a finding.


vuln_id: V-218743
rule_id: SV-218743r1156522_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.

description:
  <VulnDiscussion>Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.

  A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.

  A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click on the IIS 10.0 site.

  Under IIS, double-click the “MIME Types” icon.

  From the "Group by:" drop-down list, select "Content Type".

  From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions:

  .exe
  .dll
  .com
  .bat
  .csh

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server is hosting WSUS, this is not applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click on the IIS 10.0 site.

  Under IIS, double-click the “MIME Types” icon.

  From the "Group by:" drop-down list, select "Content Type".

  From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:

  .exe
  .dll
  .com
  .bat
  .csh

  If any OS shell MIME types are configured, this is a finding.


vuln_id: V-218744
rule_id: SV-218744r1135545_rule
severity: CAT II
title: Mappings to unused and vulnerable scripts on the IIS 10.0 website must be removed.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings.

  For Handler Mappings, the ISSO must document and approve all allowable file extensions the website allows (whitelist) and denies (blacklist). The whitelist and blacklist will be compared to the Handler Mappings in IIS 10. Handler Mappings at the site level take precedence over Handler Mappings at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click "Handler Mappings".

  Remove any script file extensions listed on the black list that are enabled.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is hosting SharePoint, this is not applicable.

  For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (whitelist) and denies (blacklist). The whitelist and blacklist will be compared to the Handler Mappings in IIS 10.0. Handler Mappings at the site level take precedence over Handler Mappings at the server level.

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click "Handler Mappings".

  If any script file extensions from the blacklist are enabled, this is a finding.


vuln_id: V-218745
rule_id: SV-218745r960963_rule
severity: CAT II
title: The IIS 10.0 website must have resource mappings set to disable the serving of certain file types.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings.

  For Request Filtering, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server: 

  Open the IIS 10.0 Manager.

  Click the site name to review.

  Double-click Request Filtering->File Name Extensions Tab->Deny File Name Extension.

  Add any script file extensions listed on the black list that are not listed.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

  For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.

  Follow the procedures below for each site hosted on the IIS 10.0 web server: 

  Open the IIS 10.0 Manager.

  Click the site name to review.

  Double-click Request Filtering->File Name Extensions Tab.

  If any script file extensions from the black list are not denied, this is a finding.


vuln_id: V-218748
rule_id: SV-218748r1043177_rule
severity: CAT II
title: Each IIS 10.0 website must be assigned a default host header.
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to use, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address.

  Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Right-click on the site name under review.

  Select "Edit Bindings".

  Assign hostname entries and unique IP addresses to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.

  Click "OK".

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.
  Right-click on the site name under review.
  Select "Edit Bindings".

  Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.

  If both hostname entries and unique IP addresses are not configured to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding.

  Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.

  Note: If HTTP/Port 80 is not being used, and is not configured as above, this is not a finding.

  Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.


vuln_id: V-218749
rule_id: SV-218749r1111805_rule
severity: CAT II
cci: CCI-000197,CCI-001188,CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.

description:
  <VulnDiscussion>A DoD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.

  Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Double-click the "SSL Settings" icon.

  Verify the "Clients Certificate Required" check box is selected.

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is a public IIS 10.0 web server, this is not applicable.
  Note: If the server being reviewed is hosting SharePoint, this is not applicable.
  Note: If the server being reviewed is hosting WSUS, this is not applicable.
  Note: If certificate handling is performed at the Proxy/Load Balancer, this is not applicable.
  Note: If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is not applicable.
  Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is not applicable.
  Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Double-click the "SSL Settings" icon.

  Verify the "Clients Certificate Required" check box is selected.

  If the "Clients Certificate Required" check box is not selected, this is a finding.


vuln_id: V-218750
rule_id: SV-218750r1138073_rule
severity: CAT I
title: Anonymous IIS 10.0 website access accounts must be restricted.
fix_text: Remove the Anonymous access account from all privileged accounts and all privileged groups.
cci: CCI-001082
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data stored on the web server must be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Check the account used for anonymous access to the website.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:
  Open the IIS 10.0 Manager.

  Double-click "Authentication" in the IIS section of the website’s Home Pane.

  If "Anonymous access" is disabled, this is Not a Finding.

  If "Anonymous access" is enabled, click "Anonymous Authentication".

  Click "Edit" in the "Actions" pane.

  If the "Specific user" radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note the account name.

  If nothing is tied to "Specific User", this is Not a Finding.

  Check privileged groups that may allow the anonymous account inappropriate membership:
  Open "Computer Management" on the machine.

  Expand "Local Users and Groups".

  Open "Groups".

  Review the members of any of the following privileged groups:

  Administrators
  Backup Operators
  Certificate Services (of any designation)
  Distributed COM Users
  Event Log Readers
  Network Configuration Operators
  Performance Log Users
  Performance Monitor Users
  Power Users
  Print Operators
  Remote Desktop Users
  Replicator

  Double-click each group and review its members.

  If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.


vuln_id: V-218751
rule_id: SV-218751r1043181_rule
severity: CAT II
title: The IIS 10.0 website must generate unique session identifiers that cannot be reliably reproduced.
cci: CCI-001188
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. To maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.

  By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.

  The session ID generator must be a FIPS 140-2-approved generator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Under the ASP.NET section, select "Session State".

  Under "Session State" Mode Settings, select the "In Process" mode.

check_text:
  Note: If ASP.NET is not installed, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Under the "ASP.NET" section, select "Session State".

  Under "Session State" Mode Settings, verify the "In Process" mode is selected.

  If the "In Process" mode is selected, this is not a finding.

  Alternative method:

  Click the site name.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".

  Verify the "mode" reflects "InProc".

  If the "mode" is not set to "InProc", this is a finding.

  If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.


vuln_id: V-218752
rule_id: SV-218752r1111807_rule
severity: CAT II
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.

description:
  <VulnDiscussion>The content database is accessed by multiple anonymous users when the web server is in production. By locating the content database on the same partition as the web server system file, the risk for unauthorized access to these protected files is increased. Additionally, having the content database path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Click the "Advanced Settings" from the "Actions" pane.

  Change the Physical Path to the new partition and directory location.

check_text:
  Note: If this server is hosting WSUS, this requirement is not applicable.
  Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is not applicable.
  Note: If this server is hosting the SharePoint Web Services site, this requirement is not applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Click the "Advanced Settings" from the "Actions" pane.

  Review the Physical Path.

  If the Path is on the same partition as the OS, this is a finding.


vuln_id: V-218753
rule_id: SV-218753r961152_rule
severity: CAT II
title: The IIS 10.0 website must be configured to limit the maxURL.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Click the site name under review.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  Set the "maxURL" value to "4096" or less.

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click on the site name.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  If the "maxUrl" value is not set to "4096" or less, this is a finding.


vuln_id: V-218754
rule_id: SV-218754r1156525_rule
severity: CAT II
title: The IIS 10.0 website must be configured to limit the size of web requests.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  Set the "maxAllowedContentLength" value to "2147483647" or less.

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click on the site name.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  If the "maxAllowedContentLength" value is not explicitly set to "2147483647" or less or a length documented and approved by the ISSO, this is a finding.


vuln_id: V-218755
rule_id: SV-218755r961152_rule
severity: CAT II
title: The IIS 10.0 websites Maximum Query String limit must be configured.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  Set the "Maximum Query String" value to "2048" or less.

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "Request Filtering" icon.

  Click “Edit Feature Settings” in the "Actions" pane.

  If the "Maximum Query String" value is not set to "2048" or less, this is a finding.


vuln_id: V-218756
rule_id: SV-218756r961152_rule
severity: CAT II
title: Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  Uncheck the "Allow high-bit characters" check box.

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  If the "Allow high-bit characters" check box is checked, this is a finding.

  Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.


vuln_id: V-218757
rule_id: SV-218757r961152_rule
severity: CAT II
title: Double encoded URL requests must be prohibited by any IIS 10.0 website.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the "Allow double escaping" option is disabled, it prevents attacks that rely on double-encoded requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  Uncheck the "Allow double escaping" check box.

check_text:
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  If the "Allow double escaping" check box is checked, this is a finding.


vuln_id: V-218758
rule_id: SV-218758r1156527_rule
severity: CAT II
title: Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the "File Extensions Request" filter enables rejection of requests containing specific file extensions not defined in the "File Extensions" filter. Tripping this filter will cause IIS to generate a Status Code 404.7.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  Uncheck the "Allow unlisted file extensions" check box.

check_text:
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

  Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is Not Applicable.

  Note: If the server being reviewed is hosting Azure DevOps (ADO), this is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Double-click the "Request Filtering" icon.

  Click "Edit Feature Settings" in the "Actions" pane.

  If the "Allow unlisted file name extensions" check box is checked, this is a finding.

  Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

  Note: If this IIS 10.0 installation is supporting Splunk, this requirement is Not Applicable.

  Note: If this IIS 10.0 installation is supporting WSUS, this requirement is Not Applicable.


vuln_id: V-218759
rule_id: SV-218759r961158_rule
severity: CAT II
title: Directory Browsing on the IIS 10.0 website must be disabled.
cci: CCI-001310
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the Site.

  Double-click the "Directory Browsing" icon.

  Under the "Actions" pane, click "Disabled".

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Click the Site.

  Double-click the "Directory Browsing" icon.

  If "Directory Browsing" is not installed, this is Not Applicable.

  Under the "Actions" pane, verify "Directory Browsing" is "Disabled".

  If "Directory Browsing" is not "Disabled", this is a finding.


vuln_id: V-218760
rule_id: SV-218760r1022690_rule
severity: CAT II
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 website, patches, loaded modules, and directory paths.

description:
  <VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Error Pages" icon.

  Click each error message and click "Edit Feature" Setting from the "Actions" pane; set each error message to "Detailed errors for local requests and custom error pages for remote requests" or "Custom error pages".

check_text:
  Note: If this server is hosting WSUS, this requirement is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click the "Error Pages" icon.

  Click each error message and click "Edit Feature" setting from the "Actions" pane.

  If any error message is not set to "Detailed errors for local requests and custom error pages for remote requests" or "Custom error pages", this is a finding.


vuln_id: V-218761
rule_id: SV-218761r961167_rule
severity: CAT II
title: Debugging and trace information used to diagnose the IIS 10.0 website must be disabled.
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click ".NET Compilation".

  Scroll down to the "Behavior" section and set the value for "Debug" to "False".

check_text:
  Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.
  Note: If the ".NET feature" is not installed, this check is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Double-click ".NET Compilation".

  Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False".

  If the "Debug" value is not set to "False", this is a finding.


vuln_id: V-218762
rule_id: SV-218762r1043182_rule
severity: CAT II
title: The Idle Time-out monitor for each IIS 10.0 website must be enabled.
cci: CCI-002361
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received.

  The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes.

  By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the Application Pools.

  Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.

  Scroll down to the "Process Model" section and set the value for "Idle Time-out" to something other than "0". "20" or less is recommended if the amount of RAM on the system is limited.

check_text:
  If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.
  Click the Application Pools.
  Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
  Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is not "0".

  If the "Idle Time-out" is set to "0", this is a finding.


vuln_id: V-218763
rule_id: SV-218763r1043182_rule
severity: CAT II
cci: CCI-002361
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.

description:
  <VulnDiscussion>Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.

  Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 15 minutes for low-value applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". 

  Set the "timeout" to "00:15:00 or less”.

  In the "Actions" pane, click "Apply".

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".

  Verify the "timeout" is set to "00:15:00 or less”.

  If "timeout" is not set to "00:15:00 or less”, this is a finding.


vuln_id: V-218764
rule_id: SV-218764r961281_rule
severity: CAT II
cci: CCI-002322
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.

description:
  <VulnDiscussion>During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.

  The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.

  The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Prepare documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:

  Determine the respective website for the application at risk of an attack.

  Access the IIS 10.0 web server IIS 10.0 Manager.

  Select the respective website.

  In the "Actions" pane, under "Manage Website", click "Stop".

  If necessary, stop all websites.

  If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager.

  In the "Actions" pane, under "Manage Server", click "Stop".

check_text:
  Interview the System Administrator and Web Manager.

  Ask for documentation for the IIS 10.0 web server administration.

  Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:

  Determine the respective website for the application at risk of an attack.

  Access the IIS 10.0 web server IIS 10.0 Manager.

  Select the respective website.

  In the "Actions" pane, under "Manage Website", click "Stop".

  If necessary, stop all websites.

  If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager.

  In the "Actions" pane, under "Manage Server", click "Stop".

  If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.


vuln_id: V-218765
rule_id: SV-218765r961392_rule
severity: CAT II
cci: CCI-001849
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website must use a logging mechanism configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 10.0 website.

description:
  <VulnDiscussion>To make certain the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity.

  The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Under "IIS" double-click on the "Logging" icon.

  If necessary, in the "Logging" configuration box, redesignate a log path to a location able to house the logs.

  Under "Log File Rollover", deselect the "Do not create new log files" setting.

  Configure a schedule to rollover log files on a regular basis.

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 web server IIS 10.0 Manager.

  Under "IIS" double-click on the "Logging" icon.

  In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.

  Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.

  Under "Log File Rollover", verify "Do not create new log files" is not selected.

  Verify a schedule is configured to rollover log files on a regular basis.

  Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device.

  If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.


vuln_id: V-218766
rule_id: SV-218766r1111809_rule
severity: CAT II
cci: CCI-001762
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 websites must use ports, protocols, and services according to Ports, Protocols, and Services Management (PPSM) guidelines.

description:
  <VulnDiscussion>Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.

  The web server must provide the capability to disable or deactivate network-related services deemed to be non-essential to the server mission, too unsecure, or prohibited by the PPSM CAL and vulnerability assessments.

  Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS.

  The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, PPSM, and the associated PPS Assurance Category Assignments List.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  In the "Action" Pane, click "Bindings".

  Edit to change an existing binding and set the correct ports and protocol.

check_text:
  Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.

  Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DOD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  In the "Action" Pane, click "Bindings".

  Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.


vuln_id: V-218767
rule_id: SV-218767r1111811_rule
severity: CAT II
cci: CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 website must only accept client certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs).

description:
  <VulnDiscussion>The use of a DOD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DOD defense-in-depth strategy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  To add DOD Certificates to the Server, if not already present:

  Open the IIS 10.0 Manager.

  Click the Server name.

  Double-click "Server Certificates".

  Click "Import" under the "Actions" pane.

  Browse to the DOD certificate location, select it, and click "OK".

  Remove any non-DOD certificates if present.

  Follow the procedures below for each site hosted on the IIS 10.0 web server to bind the certificates to the site:

  Click on the site needing the certificate.

  Select "Bindings" under the "Actions" pane.

  Click on the binding needing a certificate and select "Edit", or add a site binding for HTTPS.

  Assign the certificate to the website by choosing it under the "SSL Certificate" drop-down and clicking "OK".

check_text:
  Note: If the server being reviewed is hosting WSUS, this is not applicable.
  Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Click the site name under review.

  Click "Bindings" in the "Action" Pane.

  Click the "HTTPS type" from the box.

  Click "Edit".

  Click "View" and then review and verify the certificate path.

  If the list of CAs in the trust hierarchy does not lead to the DOD PKI Root CA, DOD-approved external certificate authority (ECA), or DOD-approved external partner, this is a finding.

  If HTTPS is not an available type under site bindings, this is a finding.

  If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server with IP address and Domain Restrictions in place, this is not a finding.


vuln_id: V-218768
rule_id: SV-218768r1156529_rule
severity: CAT I
cci: CCI-002476
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The IIS 10.0 private website must employ cryptographic mechanisms (TLS) and require client certificates.

description:
  <VulnDiscussion>TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2/140-3 approved TLS version, and all non-FIPS-approved SSL versions must be disabled.

  NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Double-click the "SSL Settings" icon under the "IIS" section.

  Select the "Require SSL" setting.

  Select the "Client Certificates Required" setting.

  Click "Apply" in the "Actions" pane.

  Click the site under review.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access".

  Click on the drop-down list for "sslFlags".

  Select the "Ssl128" check box.

  Click "Apply" in the "Actions" pane.

check_text:
  Notes: 
  - If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server. In this case, this requirement is not applicable.
  - If this is a public-facing web server, this requirement is not applicable.
  - If this server is hosting WSUS, this requirement is not applicable.
  - If the server being reviewed is hosting SharePoint, this is not applicable.
  - If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is not applicable.
  - If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is not applicable.
  - If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.
  - If the server is providing CRL, and not otherwise hosting any content, this requirement is not applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Open the IIS 10.0 Manager.

  Double-click the "SSL Settings" icon under the "IIS" section.

  Verify "Require SSL" is checked.

  Verify "Client Certificates Required" is selected.

  Click the site under review.

  Select "Configuration Editor" under the "Management" section.

  From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access".

  The value for "sslFlags" set must include "ssl128".

  If the "Require SSL" is not selected, this is a finding.

  If the "Client Certificates Required" is not selected, this is a finding. Note: "Client Certificates Required" can be considered Not Applicable in a Single Sign On (SSO) scenario where client certificates are no longer processed locally.

  If the "sslFlags" is not set to "ssl128", this is a finding.


vuln_id: V-218769
rule_id: SV-218769r961632_rule
severity: CAT II
title: IIS 10.0 website session IDs must be sent to the client using TLS.
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 Manager.

  Select the website being reviewed.

  Under "Management" section, double-click the "Configuration Editor" icon.

  From the "Section:" drop-down list, select "system.webServer/asp".

  Expand the "session" section.

  Select "True" for the "keepSessionIdSecure" setting.

  Select "Apply" from the "Actions" pane.

check_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 Manager.

  Select the website being reviewed.

  Under "Management" section, double-click the "Configuration Editor" icon.

  From the "Section:" drop-down list, select "system.webServer/asp".

  Expand the "session" section.

  Verify the "keepSessionIdSecure" is set to "True".

  If the "keepSessionIdSecure" is not set to "True", this is a finding.


vuln_id: V-218770
rule_id: SV-218770r1111816_rule
severity: CAT II
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  Cookies exchanged between the IIS 10.0 website and the client must have cookie properties set to prohibit client-side scripts from reading the cookie data.

description:
  <VulnDiscussion>A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.

  Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 Manager.
  Under "Management" section, double-click the "Configuration Editor" icon.
  From the "Section:" drop-down list, select "system.web/httpCookies".
  Set the "require SSL" to "True".

  From the "Section:" drop-down list, select "system.web/sessionState".
  Set the "compressionEnabled" to "False".

  Select "Apply" from the "Actions" pane.

check_text:
  Note: If the server being reviewed is a public IIS 10.0 web server, this is not applicable.
  Note: If the server being reviewed is hosting SharePoint, this is not applicable.
  Note: If the server being reviewed is hosting WSUS, this is not applicable.
  Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
  Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.

  Follow the procedures below for each site hosted on the IIS 10.0 web server:

  Access the IIS 10.0 Manager.
  Under the "Management" section, double-click the "Configuration Editor" icon.
  From the "Section:" drop-down list, select "system.web/httpCookies".
  Verify the "require SSL" is set to "True".

  From the "Section:" drop-down list, select "system.web/sessionState".
  Verify the "compressionEnabled" is set to "False".

  If both the "system.web/httpCookies:require SSL" is set to "True" and the "system.web/sessionState:compressionEnabled" is set to "False", this is not a finding.


vuln_id: V-218771
rule_id: SV-218771r961863_rule
severity: CAT II
title: The IIS 10.0 website must have a unique application pool.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the site name under review.

  Assign a unique application pool to each website.

check_text:
  Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.

  If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

  Open the IIS 10.0 Manager.

  Click "Application Pools".

  In the list of Application Pools, review the "Applications" column and verify unique application pools for each website.

  If any Application Pools are being used for more than one website, this is a finding.


vuln_id: V-218772
rule_id: SV-218772r1022694_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The maximum number of requests an application pool can process for each IIS 10.0 website must be explicitly set.

description:
  <VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click "Application Pools".

  Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.

  Scroll down to the "Recycling section" and set the value for "Request Limit" to greater than "0".

  Click "OK".

check_text:
  Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
  Note: If this server is hosting WSUS, this requirement is Not Applicable.
  Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

  Open the IIS 10.0 Manager.

  Perform for each Application Pool.

  Click "Application Pools".

  Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.

  Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0".

  If the "Request Limit" is set to a value of "0", this is a finding.

  If the system must require "Request Limit" to be set to "0", it is documented and approved by the ISSO, this is not a finding.


vuln_id: V-218775
rule_id: SV-218775r1022696_rule
severity: CAT II
title: The application pool for each IIS 10.0 website must have a recycle time explicitly set.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click the "Application Pools".

  Perform the following for each Application Pool:

  Highlight an Application Pool and click "Recycling" in the "Actions" pane.

  In the Recycling Conditions window, select at least one means to recycle the Application Pool (e.g., Regular Time Intervals, Scheduled Time).

  Click "Next".

  In the Recycling Events to Log window, select at minimum both the events that match the conditions from the previous step (e.g., Regular Time Intervals, Scheduled Time).

  Click "Finish".

check_text:
  Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
  Note: If the IIS Application Pool is hosting Microsoft Exchange and not otherwise hosting any content, this is Not Applicable.
  Note: If this server is hosting WSUS, this requirement is Not Applicable.

  Open the IIS 10.0 Manager.

  Expand "Application Pools".

  Perform the following for each Application Pool:

  Highlight an Application Pool and click "Recycling" in the "Actions" pane.

  In the Recycling Conditions window, verify at least one condition is checked as desired by the organization (e.g., Regular Time Intervals, Scheduled Time).

  If no conditions are checked, this is a finding.

  Click "Next".

  In the Recycling Events to Log window, verify at minimum the Recycling Events are selected that correspond to the conditions defined in the previous step (e.g., Regular Time Intervals, Scheduled Time).

  If no events are selected, this is a finding.

  Click "Cancel".


vuln_id: V-218777
rule_id: SV-218777r961863_rule
severity: CAT II
title: The application pools rapid fail protection for each IIS 10.0 website must be enabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection, the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click "Application Pools".

  Perform the following for each Application Pool:

  Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.

  Scroll down to the "Rapid Fail Protection" section and set the value for "Enabled" to "True".

  Click "OK".

check_text:
  Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.

  If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

  Open the IIS 10.0 Manager.

  Click "Application Pools".

  Perform the following for each Application Pool:

  Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.

  Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True".

  If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.


vuln_id: V-218778
rule_id: SV-218778r961863_rule
severity: CAT II
title: The application pools rapid fail protection settings for each IIS 10.0 website must be managed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the IIS 10.0 Manager.

  Click "Application Pools".

  Perform the following for each Application Pool:

  Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.

  Scroll down to the "Rapid Fail Protection" section and set the value for "Failure Interval" to "5" or less.

  Click "OK".

check_text:
  Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.

  If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

  Open the IIS 10.0 Manager.

  Click "Application Pools".

  Perform the following for each Application Pool:

  Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.

  Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5".

  If the "Failure Interval" is not set to "5" or less, this is a finding.


vuln_id: V-218779
rule_id: SV-218779r1022698_rule
severity: CAT II
title: Interactive scripts on the IIS 10.0 web server must be located in unique and designated folders.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the System Administrator (SA) control over what goes into those folders and to facilitate access control at the folder level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All interactive programs must be placed in unique designated folders based on CGI or ASP script type.

  Open the IIS 10.0 Manager.

  Right-click the IIS 10.0 web server name and select "Explore".

  Search for the listed script extensions.

  Move each script type to its unique designated folder.

  Set the permissions to the scripts folders as follows:

  Administrators: FULL
  TrustedInstaller: FULL
  SYSTEM: FULL
  ApplicationPoolId:READ
  Custom Service Account: READ
  Users: READ 
  ALL APPLICATION PACKAGES: READ

check_text:
  Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp. 

  All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.

  Open the IIS 10.0 Manager.

  Right-click the IIS 10.0 web site name and select "Explore".

  Search for the listed script extensions. Each script type must be in its unique designated folder.

  If scripts are not segregated from web content and in their own unique folders, this is a finding.

  If the website does not utilize CGI, this finding is Not Applicable.


vuln_id: V-218780
rule_id: SV-218780r960963_rule
severity: CAT II
title: Interactive scripts on the IIS 10.0 web server must have restrictive access controls.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension.

  The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the System Administrator (SA) or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp.

  If the website does not utilize CGI, this finding is NA.

  All interactive programs must have restrictive permissions.

  Open the IIS 10.0 Manager.

  Right-click the IIS 10.0 web server name and select "Explore".

  Search for the listed script extensions.

  Set the permissions to the CGI scripts as follows:

  Administrators: FULL
  Web Administrators: FULL
  TrustedInstaller: FULL
  ALL APPLICATION PACKAGES: Read
  ALL RESTRICTED APPLICATION PACKAGES: Read
  SYSTEM: FULL
  ApplicationPoolId: READ
  Custom Service Account: READ
  Users: READ

check_text:
  Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp.

  If the website does not utilize CGI, this finding is Not Applicable.

  All interactive programs must have restrictive permissions.

  Open the IIS 10.0 Manager.

  Right-click the IIS 10.0 web site name and select "Explore".

  Search for the listed script extensions.

  Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned.

  Administrators: FULL
  Web Administrators: FULL
  TrustedInstaller: FULL
  ALL APPLICATION PACKAGES: Read
  ALL RESTRICTED APPLICATION PACKAGES: Read
  SYSTEM: FULL
  ApplicationPoolId: READ
  Custom Service Account: READ
  Users: READ

  If the permissions are less restrictive than listed above, this is a finding.


vuln_id: V-218781
rule_id: SV-218781r1022700_rule
severity: CAT II
title: Backup interactive scripts on the IIS 10.0 server must be removed.
fix_text: Remove the backup files from the production web server.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
description:
  <VulnDiscussion>Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  If the website does not utilize CGI, this finding is Not Applicable.

  Open the IIS 10.0 Manager.

  Right-click the IIS 10.0 web site name and select "Explore".

  Search for the listed script extensions

  Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.

  If files with these extensions are found, this is a finding.


vuln_id: V-218782
rule_id: SV-218782r1111818_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-12 20:00:16
title:
  The required DoD banner page must be displayed to authenticated users accessing a DoD private website.

description:
  <VulnDiscussion>A consent banner will be in place to inform prospective entrants the website they are about to enter is a DoD website and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure a DoD private website to display the required DoD banner page when authentication is required for user access.

check_text:
  Note: This requirement is only applicable for private DOD websites.
  Note: If the server being reviewed is hosting WSUS, this is not applicable.

  If a banner is required, the following banner page must be in place: 

  “You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. 

  By using this IS (which includes any device attached to this IS), you consent to the following conditions: 

  -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. 

  - At any time, the USG may inspect and seize data stored on this IS. 

  - Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. 

  - This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy. 

  - Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.” 

  OR 

  If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner: 

  "I've read & consent to terms in IS user agreem't." 

  NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page. 

  If the access-controlled website does not display this banner page before entry, this is a finding.


vuln_id: V-223280
rule_id: SV-223280r961050_rule
severity: CAT II
title: Macros must be blocked from running in Access files from the Internet.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet.

  If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content”, users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

  If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Block macros from running in Office files from the Internet" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Block macros from running in Office files from the Internet" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\access\security

  If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.


vuln_id: V-223281
rule_id: SV-223281r1016166_rule
severity: CAT II
title: Trust Bar Notifications for unsigned application add-ins in Access must be disabled and blocked.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the "Require that application add-ins are signed by Trusted Publisher" policy setting is enabled, which prevents users from changing this policy setting.

  If users enable this policy setting, applications automatically disable unsigned add-ins without informing users.

  If this policy setting is disabled, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

  If users do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\access\security

  If the value NoTBPromptUnsignedAddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223282
rule_id: SV-223282r1082349_rule
severity: CAT II
title: VBA macros not digitally signed must be blocked in Access.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If this policy setting is enabled, choose from four options for determining how the specified applications will warn the user about macros:

  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros. If a site requires the use of macros, they must be signed/approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.

  If this policy setting is disabled, "Disable all with notification" will be the default setting.

  If this policy setting is not configured, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document.

  Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center >> VBA Macro Notification Settings to "Disable all except digitally signed macros".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Disable all except digitally signed macros".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\Microsoft\office\16.0\access\security

  If the value vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD = 2 or REG_DWORD =  4 is also acceptable. If the registry key does not exist, or is not configured properly, this is a finding.


vuln_id: V-223284
rule_id: SV-223284r961092_rule
severity: CAT II
title: The Macro Runtime Scan Scope must be enabled for all documents.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting specifies for which documents the VBA Runtime Scan feature is enabled.

  If the feature is disabled for all documents, no runtime scanning of enabled macros will be performed.

  If the feature is enabled for low trust documents, the feature will be enabled for all documents for which macros are enabled except:
   - Documents opened while macro security settings are set to "Enable All Macros"
   - Documents opened from a Trusted Location
   - Documents that are Trusted Documents
   - Documents that contain VBA that is digitally signed by a Trusted Publisher

  If the feature is enabled for all documents, then the above class of documents are not excluded from the behavior.

  This protocol allows the VBA runtime to report to the Anti-Virus system certain high-risk code behaviors it is about to execute and allows the Anti-Virus to report back to the process if the sequence of observed behaviors indicates likely malicious activity so the Office application can take appropriate action.

  When this feature is enabled, affected VBA projects' runtime performance may be reduced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings "Macro Runtime Scan Scope" to "Enable for all documents".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings "Macro Runtime Scan Scope" is set to "Enable for all documents".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\common\security

  If the value for macroruntimescanscope is REG_DWORD = 2, this is not a finding.


vuln_id: V-223285
rule_id: SV-223285r1067544_rule
severity: CAT I
title: Document metadata for rights managed Office Open XML files must be protected.
cci: CCI-002476
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting determines whether metadata is encrypted in Office Open XML files that are protected by Information Rights Management (IRM). If this policy setting is enabled, Excel, PowerPoint, and Word encrypt metadata stored in rights-managed Office Open XML files and override any configuration changes on users' computers. 

  If this policy setting is enabled, Office 2016 applications cannot encrypt metadata in rights-managed Office Open XML files, which can reduce security. If this policy setting is not configured when Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata associated with the document is not encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Protect document metadata for rights managed Office Open XML Files" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Protect document metadata for rights managed Office Open XML Files" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\common\security

  If the value DRMEncryptProperty is REG_DWORD = 1, this is not a finding.


vuln_id: V-223286
rule_id: SV-223286r960963_rule
severity: CAT II
title: The Office client must be prevented from polling the SharePoint Server for published links.
cci: CCI-000381,CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications can poll Office servers to retrieve lists of published links. 

  If this policy setting is enabled, Office 365 ProPlus applications cannot poll an Office server for published links. 

  If this policy setting is disabled or not configured, users of Office 365 ProPlus applications can see and use links to Microsoft SharePoint Server sites from those applications. Published links can be configured to Office applications during initial deployment, and can add or change links as part of regular operations. These links appear on the My SharePoint Sites tab of the Open, Save, and Save As dialog boxes when opening and saving documents from these applications. Links can be targeted so they only appear to users who are members of particular audiences. 

  Note: This policy setting applies to Microsoft SharePoint Server specifically. It does not apply to Microsoft SharePoint Foundation.
  </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Server Settings >> Disable the Office client from polling the SharePoint Server for published links to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Server Settings >> Disable the Office client from polling the SharePoint Server for published links is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\common\portal

  If the value for linkpublishingdisabled is REG_DWORD = "1", this is not a finding.


vuln_id: V-223287
rule_id: SV-223287r961863_rule
severity: CAT II
title: Custom user interface (UI) code must be blocked from loading in all Office applications.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications load any custom user interface (UI) code included with a document or template. Office 365 ProPlus allows developers to extend the UI with customization code that is included in a document or template. 

  If this policy setting is enabled, Office 365 ProPlus applications cannot load any UI customization code included with documents and templates. 

  If this policy setting is not configured or disabled, Office 365 ProPlus applications load any UI customization code included with a document or template when opening it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Global Options >> Customize >> Disable UI extending from documents and templates to Enabled: Disallow in Word; Excel; PowerPoint; Access; Outlook; Publisher; Project; Visio; InfoPath.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Global Options >> Customize >> Disable UI extending from documents and templates is set to Enabled: Disallow in Word; Excel; PowerPoint; Access; Outlook; Publisher; Project; Visio; InfoPath

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\common\toolbars

  If the value noextensibilitycustomizationfromdocument is REG_DWORD = 1 for all installed Office programs, this is not a finding.


vuln_id: V-223288
rule_id: SV-223288r961779_rule
severity: CAT II
title: ActiveX Controls must be initialized in Safe Mode.
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting specifies the Microsoft ActiveX initialization security level for all Microsoft Office applications. ActiveX controls can adversely affect a computer directly. In addition, malicious code can be used to compromise an ActiveX control and attack a computer. 

  To indicate the safety of an ActiveX control, developers can denote them as Safe for Initialization (SFI). SFI indicates that a control is safe to open and run, and that it is not capable of causing a problem for any computer, regardless of whether it has persisted data values or not. If a control is not marked SFI, it is possible that the control could adversely affect a computer--or it could mean that the developers did not test the control in all situations and are not sure whether it might be compromised in the future. If you enable this policy setting, you can set the ActiveX security level to a number between 1 and 6. These security levels are as follows:
   
  1. Regardless of how the control is marked, load it and use the persisted values (if any). This setting does not prompt the user. 

  2. If SFI, load the control in safe mode and use persisted values (if any). If not SFI, load in unsafe mode with persisted values (if any), or use the default (first-time initialization) settings. This level is similar to the default configuration, but does not prompt the user. 

  3. If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings. 

  4. If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings. 

  5. If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values. 

  6. If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values. 

  If you disable or do not configure this policy setting, if a control is marked SFI, the application loads the control in safe mode and uses persisted values (if any). If the control is not marked SFI, the application loads the control in unsafe mode with persisted values (if any), or uses the default (first-time initialization) settings. In both situations, the Message Bar informs users that the controls have been disabled and prompts them to respond. 

  Important: Some ActiveX controls do not respect the safe mode registry setting, and therefore might load persisted data even though you configure this setting to instruct the control to use safe mode. This setting only increases security for ActiveX controls that are accurately marked as SFI. In situations that involve malicious or poorly designed code, an ActiveX control might be inaccurately marked as SFI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "ActiveX Control Initialization" to "Enabled + 6".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "ActiveX Control Initialization" is set to "Enabled (If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values.)

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\Common\Security

  If the value UFIControls is set to REG_DWORD=6, this is not a finding.


vuln_id: V-223289
rule_id: SV-223289r961092_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Macros in all Office applications that are opened programmatically by another application must be opened based upon macro security level.

description:
  <VulnDiscussion>This policy setting controls whether macros can run in an Office 365 ProPlus application that is opened programmatically by another application. If this policy setting is enabled, the user can choose from three options for controlling macro behavior in Excel, PowerPoint, and Word when the application is opened programmatically:

  - Disable macros by default ¬- all macros are disabled in the programmatically opened application. 
  - Macros enabled (default) - macros can run in the programmatically opened application. This option enforces the default configuration in Excel, PowerPoint, and Word. 
  - User application macro security level - macro functionality is determined by the setting in the "Macro Settings" section of the Trust Center. 

  If this policy setting is disabled or not configured, when a separate program is used to launch Microsoft Excel, PowerPoint, or Word programmatically, any macros can run in the programmatically opened application without being blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Automation Security" to "Enabled (Use application macro security level)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Automation Security" is set to "Enabled (Use application macro security level)".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\Common\Security

  If the value AutomationSecurity is REG_DWORD = 2, this is not a finding.


vuln_id: V-223290
rule_id: SV-223290r1016167_rule
severity: CAT II
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Trust Bar notifications must be configured to display information in the Message Bar about the content that has been automatically blocked.

description:
  <VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications notify users when potentially unsafe features or content are detected, or whether such features or content are silently disabled without notification. 

  The Message Bar in Office 365 ProPlus applications is used to identify security issues, such as unsigned macros or potentially unsafe add-ins. When such issues are detected, the application disables the unsafe feature or content and displays the Message Bar at the top of the active window. The Message Bar informs the users about the nature of the security issue and, in some cases, provides the users with an option to enable the potentially unsafe feature or content, which could harm the user's computer. 

  If this policy setting is enabled, Office 365 ProPlus applications do not display information in the Message Bar about potentially unsafe content that has been detected or has automatically been blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Disable all Trust Bar notifications for security issues" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Microsoft Office 2016 >> Security Settings >> Disable all Trust Bar notifications for security issues is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\common\trustcenter

  If the value trustbar is REG_DWORD = 0, this is not a finding.


vuln_id: V-223291
rule_id: SV-223291r961128_rule
severity: CAT II
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Office applications must be configured to specify encryption type in password-protected Office 97-2003 files.

description:
  <VulnDiscussion>This policy setting enables you to specify an encryption type for password-protected Office 97-2003 files.

  If you enable this policy setting, you can specify the type of encryption that Office applications will use to encrypt password-protected files in the older Office 97-2003 file formats. The chosen encryption type must have a corresponding cryptographic service provider (CSP) installed on the computer that encrypts the file. See the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\ registry key for a list of CSPs installed on the local computer. Specify the encryption type to use by entering it in the provided text box in the following form:

  <Encryption Provider>,<Encryption Algorithm>,<Encryption Key Length>.
  For example, Microsoft Enhanced Cryptographic Provider v1.0,RC4,128

  If you do not configure this policy setting, Excel, PowerPoint, and Word use Office 97/2000 Compatible encryption, a proprietary encryption method, to encrypt password-protected Office 97-2003 files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office 97-2003 files to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office 97-2003 files is set to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256.
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\common\security

  If the value defaultencryption12 is set to REG_SZ = "Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256", this is not a finding.


vuln_id: V-223292
rule_id: SV-223292r961128_rule
severity: CAT II
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Office applications must be configured to specify encryption type in password-protected Office Open XML files.

description:
  <VulnDiscussion>This policy setting allows you to specify an encryption type for Office Open XML files.

  If you enable this policy setting, you can specify the type of encryption that Office applications use to encrypt password-protected files in the Office Open XML file formats used by Excel, PowerPoint, and Word. The chosen encryption type must have a corresponding cryptographic service provider (CSP) installed on the computer that encrypts the file. See the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\ registry key for a list of CSPs installed on the local computer. Specify the encryption type to use by entering it in the provided text box in the following form:

  <Encryption Provider>,<Encryption Algorithm>,<Encryption Key Length>

  For example: Microsoft Enhanced Cryptographic Provider v1.0,RC4,128

  If you disable or do not configure this policy setting, the default CSP is used. The default cryptographic service provider (CSP) is Microsoft Enhanced RSA and AES Cryptographic Provider, AES-128, 128-bit.

  Note: This policy setting does not take effect unless the registry key 
  HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\<office application name>\Security\Crypto\CompatMode is set to 0. By default the CompatMode registry key is set to 1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office Open XML files to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office Open XML files is set to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256.
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\common\security

  If the value OpenXMLEncryption is REG_SZ = "Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256", this is not a finding.


vuln_id: V-223293
rule_id: SV-223293r961353_rule
severity: CAT II
title: Users must be prevented from creating new trusted locations in the Trust Center.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether trusted locations can be defined by users, the Office Customization Tool (OCT), and Group Policy, or if they must be defined by Group Policy alone.

  If you enable this policy setting, users can specify any location as a trusted location, and a computer can have a combination of user-created, OCT-created, and Group Policy-created trusted locations.

  If you disable this policy setting, all trusted locations that are not created by Group Policy are disabled and users cannot create new trusted locations in the Trust Center.

  If you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled.

  Note: InfoPath and Outlook do not recognize trusted locations, and therefore are unaffected by this policy setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Trust Center >> Allow mix of policy and user locations to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016\Security Settings\Trust Center >> Allow mix of policy and user locations is set to "Disabled".
   
  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\common\security\trusted locations

  If the value for allow user locations is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223294
rule_id: SV-223294r961863_rule
severity: CAT II
title: Office applications must not load XML expansion packs with Smart Documents.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications can load an XML expansion pack manifest file with a Smart Document.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Smart Documents (Word, Excel) >> Disable Smart Document's use of manifests to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Smart Documents (Word, Excel) >> Disable Smart Document's use of manifests is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\common\smart tag

  If the value for neverloadmanifests is REG_DWORD = 1, this is not a finding.


vuln_id: V-223295
rule_id: SV-223295r961086_rule
severity: CAT II
title: The load of controls in Forms3 must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows the user to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe for Initialization (SFI) or Unsafe for Initialization (UFI). 
   
  ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as SFI, which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer, or the developers may not have tested the control in all situations and are not sure whether their control might be compromised at some future date. SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety was not important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked UFI, which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. 
   
  If this policy setting is enabled, choose from four options for loading controls in UserForms: 
   
  1. For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. 
   
  2. Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: 
   
  - For a UFI signed control, if users respond "Yes" to the prompt, load the control in unsafe mode. If users respond "No", load the control using the default properties. 
  - For an SFI signed control that supports both safe and unsafe modes, if users respond "Yes" to the prompt, load the control in unsafe mode. If users respond "No", load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 365 ProPlus release. 
   
  3. Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: 
   
  - For a UFI signed control, if users respond "Yes" to the prompt, load the control in unsafe mode. If users respond "No", load the control with its default properties. 
  - For an SFI signed control, load in safe mode. 
   
  4. For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). 
   
  If  this policy setting is disabled or not configured, the behavior is as if this policy setting is enabled and then select option "1".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" to "Enabled:1" or set it to "Disabled."

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" is set to Enabled and 1 from drop down. (For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration.)".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\VBA\Security

  If the value LoadControlsInForms is REG_DWORD=1, this is not a finding.

  If the value LoadControlsInForms does not exist, this is not a finding.


vuln_id: V-223296
rule_id: SV-223296r961086_rule
severity: CAT II
title: Add-on Management must be enabled for all Office 365 ProPlus programs.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons may contain viruses or other malicious code. Disabling or not configuring this setting could allow malicious code or users to become active on user computers or the network. For example, a malicious user can monitor and then use keystrokes that user's type into Internet Explorer. Even legitimate add-ons may demand resources, compromising the performance of Internet Explorer and the operating systems for user computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Add-on Management" to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Add-on Management" is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT

  If the value for each installed Office Program is REG_DWORD = 1, this is not a finding.


vuln_id: V-223297
rule_id: SV-223297r961050_rule
severity: CAT II
title: Consistent MIME handling must be enabled for all Office 365 ProPlus programs.
cci: CCI-000803
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied on to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. 

  TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Consistent Mime Handling" to "Enabled" and select the check boxes for all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Consistent Mime Handling is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling

  If the value for all installed Office programs is set to is REG_DWORD=1, this is not a finding.


vuln_id: V-223298
rule_id: SV-223298r961092_rule
severity: CAT II
title: User name and password must be disabled in all Office programs.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate website but actually opens a deceptive (spoofed) website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Disable user name and password" to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Disable user name and password" is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223299
rule_id: SV-223299r961086_rule
severity: CAT II
title: The Information Bar must be enabled in all Office programs.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications notify users when potentially unsafe features or content are detected, or whether such features or content are silently disabled without notification. The Message Bar in Office 2016 applications is used to identify security issues, such as unsigned macros or potentially unsafe add-ins. When such issues are detected, the application disables the unsafe feature or content and displays the Message Bar at the top of the active window. The Message Bar informs the users about the nature of the security issue and, in some cases, provides the users with an option to enable the potentially unsafe feature or content, which could harm the user's computer. 

  If you enable this policy setting, Office 365 ProPlus applications do not display information in the Message Bar about potentially unsafe content that has been detected or has automatically been blocked. 

  If you disable this policy setting, Office 365 ProPlus applications display information in the Message Bar about content that has automatically been blocked. 

  If you do not configure this policy setting, if an Office 365 ProPlus application detects a security issue, the Message Bar is displayed. However, this configuration can be modified by users in the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Information Bar to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Information Bar is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_securityband

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223300
rule_id: SV-223300r961863_rule
severity: CAT II
title: The Local Machine Zone Lockdown Security must be enabled in all Office programs.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine zone, making this security zone a prime target for malicious users and code. Disabling or not configuring this setting could allow pages in the Internet zone to navigate to pages in the Local Machine zone to then run code to elevate privileges. This could allow malicious code or users to become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Local Machine Zone Lockdown to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Local Machine Zone Lockdown Security is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown

  If the value for all installed Office programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223301
rule_id: SV-223301r961050_rule
severity: CAT II
title: The MIME Sniffing safety feature must be enabled in all Office programs.
cci: CCI-000803
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. 

  TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Mime Sniffing Safety Feature to "Enabled" for all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Mime Sniffing Safety Feature is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing

  If the value for all installed Office Programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223302
rule_id: SV-223302r961092_rule
severity: CAT II
title: Navigate URL must be enabled in all Office programs.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer attempts to load a malformed URL, a security risk could occur.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Navigate URL to "Enabled" and select the check boxes for all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Navigate URL is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223303
rule_id: SV-223303r961050_rule
severity: CAT II
title: Object Caching Protection must be enabled in all Office programs.
cci: CCI-000803
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. 

  TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Object Caching Protection to "Enabled" and select the check boxes for all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Object Caching Protection is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223304
rule_id: SV-223304r960921_rule
severity: CAT II
title: Protection from zone elevation must be enabled in all Office programs.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine zone, making this security zone a prime target for malicious users and code. Disabling or not configuring this setting could allow pages in the Internet zone to navigate to pages in the Local Machine zone to then run code to elevate privileges. This could allow malicious code or users to become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Protection from Zone Elevation to "Enabled" and select the check boxes for all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Protection from Zone Elevation is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223305
rule_id: SV-223305r961779_rule
severity: CAT II
title: ActiveX installation restriction must be enabled in all Office programs.
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like the other types of HTML or Microsoft Silverlight-based controls. Disabling or not configuring this setting does not block prompts for ActiveX control installations, and these prompts display to users. This could allow malicious code to become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict ActiveX Install to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict ActiveX Install is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223306
rule_id: SV-223306r960921_rule
severity: CAT II
title: File Download Restriction must be enabled in all Office programs.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the download. User preferences may also allow the download to occur without prompting or interaction with the user. Even if Internet Explorer prompts the user to accept the download, some websites abuse this functionality. Malicious websites may continually prompt users to download a file or present confusing dialog boxes to trick users into downloading or running a file. If the download occurs and it contains malicious code, the code could become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict File Download to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict File Download is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223307
rule_id: SV-223307r961092_rule
severity: CAT II
title: The Save from URL feature must be enabled in all Office programs.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the Web (MOTW) comment, indicating the page was saved from a site on the Internet, Internet Explorer runs the page in the Internet security zone instead of the less restrictive Local Intranet security zone. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer does not evaluate the page for a MOTW, potentially dangerous code could be allowed to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Saved from URL to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Saved from URL is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223308
rule_id: SV-223308r960921_rule
severity: CAT II
title: Scripted Windows Security restrictions must be enabled in all Office programs.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computers in some manner. Disabling or not configuring this setting allows unknown websites to:
  - Create browser windows appearing to be from the local operating system.
  - Draw active windows displaying outside of the viewable areas of the screen capturing keyboard input.
  - Overlay parent windows with their own browser windows to hide important system information, choices, or prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >>Scripted Window Security Restrictions to "Enabled" and select the check boxes for  all installed Office programs.

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Scripted Window Security Restrictions is set to "Enabled" and the check box is selected for every installed Office program.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS

  If the value for all installed programs is REG_DWORD = 1, this is not a finding.


vuln_id: V-223309
rule_id: SV-223309r961779_rule
severity: CAT II
title: Flash player activation must be disabled in all Office programs.
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the Adobe Flash control can be activated by Office documents. Note that activation blocking applies only within Office processes.

  If you enable this policy setting, you can choose from three options to control whether and how Flash is blocked from activation:

  1. "Block all activation" prevents the Flash control from being loaded, whether directly referenced by the document or indirectly by another embedded object.
  2. "Block embedding/linking, allow other activation" prevents the Flash control from being loaded when directly referenced by the document, but does not prevent activation through another object.
  3. "Allow all activation" restores Office's default behavior, allowing the Flash control to be activated.

  Because this setting is not a true Group Policy setting and "tattoos" the registry, enabling the "Allow all activation" option is the only way to restore default behavior after either of the "Block" options has been applied. It is not recommended to configure this setting to "Disabled" or "Not Configured" after it has been enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> Block Flash activation in Office documents >> Enabled >> Block all activation to "Enabled" (Block all activation).

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> Block Flash activation in Office documents >> Enabled >> Block all activation is set to "Enabled" Block all activation.

  Use the Windows Registry Editor to navigate to the following key:

  HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility

  If the value for COMMENT is REG_SZ = Block all Flash activation, this is not a finding.


vuln_id: V-223310
rule_id: SV-223310r961092_rule
severity: CAT II
title: Trusted Locations on the network must be disabled in Excel.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether trusted locations on the network can be used.

  If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by selecting the "Allow Trusted Locations on my network (not recommended)" check box in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

  If you disable or do not configure this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. Disabling this policy setting does not delete any network locations from the Trusted Locations list. Instead, it forces the selected application to treat the locations as non-trusted and prevents users from adding new network locations to the list.

  If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

  Disabling this policy setting will cause disruption for users who add network locations to the Trusted Locations list. However, it is not recommended to enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box itself states), so in practice it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\trusted locations

  If the value AllowNetworkLocations is REG_DWORD = 0, this is not a finding.


vuln_id: V-223311
rule_id: SV-223311r960963_rule
severity: CAT II
title: VBA Macros not digitally signed must be blocked in Excel.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:

  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros.  If a site requires the use of macros, they must be signed /approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> "Macro Notification Settings" is set to "Enabled" and select "Disable VBA macros except digitally signed macros" from the Options.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> "Macro Notification Settings" is set to "Enabled" and "Disable VBA macros except digitally signed macros" from the Options is selected.

  Use the Windows Registry Editor to navigate to the following key:
  HKCU\software\policies\Microsoft\office\16.0\excel\security

  If the value vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD =  4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.


