The Exchange local machine policy must require signed scripts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221216	EX16-ED-000150	SV-221216r960954_rule	CCI-001749	medium
Description
Scripts, especially those downloaded from untrusted locations, often provide a way for attackers to infiltrate a system. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided.
STIG			Date
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide			2024-12-06

Related Frameworks

1 mapping across 2 frameworks

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-4Audit Log Storage Capacity

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-14Signed Components

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(1)Automated Access Enforcement and Audit Records

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(3)Signed Components

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(5)Authorized Software — Allow-by-exception

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(5)Individual Authentication with Group Authentication

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-2Separation of System and User Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23Session Authenticity

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+2 more (top 10 by confidence shown)

CCI1 mapping

CCI-001749

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)

Details

Check Text (C-221216r960954_chk)

Open the Exchange Management Shell and enter the following command: Get-ExecutionPolicy If the value returned is not "RemoteSigned", this is a finding.

Fix Text (F-22920r411775_fix)

Open the Exchange Management Shell and enter the following command: Set-ExecutionPolicy RemoteSigned