STIGQter: STIG Summary: Microsoft IIS 10.0 Site Security Technical Implementation Guide Version: 2 Release: 16 Benchmark Date: 01 Jul 2026:

Backup interactive scripts on the IIS 10.0 server must be removed.

DISA Rule

SV-218781r1022700_rule

Vulnerability Number

V-218781

Group Title

SRG-APP-000141-WSR-000087

Rule Version

IIST-SI-000263

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Remove the backup files from the production web server.

Check Contents

If the website does not utilize CGI, this finding is Not Applicable.

Open the IIS 10.0 Manager.

Right-click the IIS 10.0 web site name and select "Explore".

Search for the listed script extensions

Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.

If files with these extensions are found, this is a finding.

Vulnerability Number

V-218781

Documentable

False

Rule Version

IIST-SI-000263

Severity Override Guidance

If the website does not utilize CGI, this finding is Not Applicable.

Open the IIS 10.0 Manager.

Right-click the IIS 10.0 web site name and select "Explore".

Search for the listed script extensions

Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.

If files with these extensions are found, this is a finding.

Check Content Reference

M

Target Key

4051