STIGQter STIGQter: STIG Summary: Microsoft SharePoint 2013 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

SharePoint must identify data type, specification, and usage when transferring information between different security domains so policy restrictions may be applied.

DISA Rule

SV-223244r612235_rule

Vulnerability Number

V-223244

Group Title

SRG-APP-000516

Rule Version

SP13-00-000035

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the SharePoint server to identify data type, specification, and usage when transferring information between different security domains so policy restrictions may be applied.

In Central Administration, click Security.

On the Security page, in the Information policy list, click "Configure information rights management".

Select "Use the default RMS server specified in Active Directory" or identify a specific server by selecting "Use this RMS server:" and entering the server name.

Configure information management policies in accordance with the system security plan requirements.

Check Contents

Note: If no data is exchanged between different security domains, and has been documented by the Data Owner, IRM is not required. This requirement is Not Applicable.

Review the SharePoint server configuration to ensure data type, specification, and usage when transferring information between different security domains are identified so policy restrictions may be applied.

An IRM must be enabled in SharePoint. The Windows Rights Management Services (RMS) (or a comparable IRM product) can either be located through Active Directory or specified.

In Central Administration, click Security.

On the Security page, in the Information policy list, click "Configure information rights management".

If "Do not use IRM on this server" is selected, or if a configuration error message is displayed (such as "... IRM will not work until the client is configured properly"), this is a finding.

Vulnerability Number

V-223244

Documentable

False

Rule Version

SP13-00-000035

Severity Override Guidance

Note: If no data is exchanged between different security domains, and has been documented by the Data Owner, IRM is not required. This requirement is Not Applicable.

Review the SharePoint server configuration to ensure data type, specification, and usage when transferring information between different security domains are identified so policy restrictions may be applied.

An IRM must be enabled in SharePoint. The Windows Rights Management Services (RMS) (or a comparable IRM product) can either be located through Active Directory or specified.

In Central Administration, click Security.

On the Security page, in the Information policy list, click "Configure information rights management".

If "Do not use IRM on this server" is selected, or if a configuration error message is displayed (such as "... IRM will not work until the client is configured properly"), this is a finding.

Check Content Reference

M

Target Key

4096

Comments