OpenControls Logo

STIG Viewer

STIGViewer Support

The Exchange software baseline copy must exist.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-221255EX16-ED-000590SV-221255r961461_ruleCCI-001813medium
Description
Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise, unauthorized changes to the software may not be discovered. This effort is a vital step to securing the host and the applications, as it is the only method that may provide the ability to detect and recover from otherwise undetected changes, such as those that result from worm or bot intrusions. The Exchange software and configuration baseline is created and maintained for comparison during scanning efforts. Operational procedures must include baseline updates as part of configuration management tasks that change the software and configuration.
STIGDate
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide2024-12-06

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.1Automated Access Enforcement / Auditing
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (50) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+40 more (top 10 by confidence shown)

CCI1 mapping
CCI-001813
1.00

Details

Check Text (C-221255r961461_chk)

Review the Email Domain Security Plan (EDSP). Determine the baseline documentation. Review the application software baseline procedures and implementation artifacts. Note the list of files and directories included in the baseline procedure for completeness. If an email software copy exists to serve as a baseline and is available for comparison during scanning efforts, this is not a finding.

Fix Text (F-22959r411892_fix)

Implement an email software baseline process and update the EDSP.