A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-218737	IIST-SI-000203	SV-218737r1022671_rule	CCI-000068	medium
Description
Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.
STIG			Date
Microsoft IIS 10.0 Site Security Technical Implementation Guide			2026-05-23

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.2Protection of Confidentiality / Integrity Using Encryption

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (33) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-17(2)Protection of Confidentiality and Integrity Using Encryption

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6(1)Automated Management, Application, and Verification

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(1)Periodic Review

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(8)Access to Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-3Device Identification and Authentication

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+23 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)

CCI1 mapping

CCI-000068

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)

Details

Check Text (C-218737r1022671_chk)

Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. Note: If the server is hosting SharePoint, this is Not Applicable. Note: If the server is hosting WSUS, this is Not Applicable. Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server and is Not Applicable in this STIG. Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Click the site name. Double-click the "SSL Settings" icon. Verify "Require SSL" check box is selected. If the "Require SSL" check box is not selected, this is a finding.

Fix Text (F-20208r903108_fix)

Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Click the site name. Double-click the "SSL Settings" icon. Select "Require SSL" check box. Select "Apply" from the "Actions" pane.