SharePoint must validate the integrity of security attributes exchanged between systems.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-223277 | SP13-00-000105 | SV-223277r961080_rule | CCI-001158 | medium |
| Description | ||||
| When data is exchanged between information systems, the security attributes associated with said data need to be maintained. Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Security attributes may be explicitly or implicitly associated with the information contained within the information system. | ||||
| STIG | Date | |||
| Microsoft SharePoint 2013 Security Technical Implementation Guide | 2024-12-10 | |||
Related Frameworks
1 mapping across 4 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-001158
1.00
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
NIST CSF 2.00 mappings
No source states a mapping between these directly.
Also reachable in 4 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
PR.DS-02
0.50
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
- NIST OLIR Informative ReferenceOLIR 153 (2025-04-07)intersects(normalised)SCF Focal Document mapping (catalog)SCF 2026.2 focalintersects(normalised)
Details
Check Text (C-223277r961080_chk)
Note: If no data is exchanged between systems, and has been documented by the Data Owner, IRM is not required. This requirement is Not Applicable.
Review the SharePoint server configuration to ensure the integrity of security attributes exchanged between systems is validated.
An IRM must be enabled in SharePoint. The Windows Rights Management Services (RMS) (or a comparable IRM product) can either be located through Active Directory or specified.
In Central Administration, click Security.
On the Security page, in the Information policy list, click "Configure information rights management".
If "Do not use IRM on this server" is selected, or if a configuration error message is displayed (such as "... IRM will not work until the client is configured properly"), this is a finding.
Fix Text (F-24938r430889_fix)
Configure the SharePoint server to validate the integrity of security attributes exchanged between systems.
In Central Administration, click Security.
On the Security page, in the Information policy list, click "Configure information rights management".
Select "Use the default RMS server specified in Active Directory", or identify a specific server by selecting "Use this RMS server:" and entering the server name.
Configure information management policies in accordance with the system security plan requirements.