UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Administrative users and groups with access privilege to the web server must be documented.


Overview

Finding ID Version Rule ID IA Controls Severity
V-2257 WA120 IIS7 SV-32638r2_rule Low
Description
There are typically several individuals and groups involved in running a production web-site. In most cases, several types of users on a web server can be identified, such as, SA's, Web Managers, Auditors, Authors, Developers, and the Clients. Nonetheless, only necessary user and administrative accounts will be allowed on the web server. Accounts will be restricted to those who are necessary to maintain web services, review the server’s operation and the OS. Owing to the sensitivity of web servers, a detailed record of these accounts must be maintained.
STIG Date
IIS 7.0 WEB SERVER STIG 2017-04-05

Details

Check Text ( C-29090r1_chk )
Determine if the local sites' documentation matches an examination of the privileged IDs on the server. Using User Manager, User Manager for Domains, or Local Users and Groups, examine user accounts to verify the above information. If documentation does not exist for users and groups found on the server, this is a finding.
Fix Text (F-26819r1_fix)
Document the administrative users and groups which have access rights to the web server in the website SOP or an equivalent document.