Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

IIS 7.0 Server STIG

The IIS 7.0 Server STIG (V1 R19) has 25 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

25STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R19

CurrentPublished Fri Jan 24 2020

Programs and features not necessary for operations must be removed.

IIS 7.0 Server STIG

Assessment Title

Rule Text

Description

Discussion Text

Just as running unneeded services and protocols increase the attack surface of the web server, running unneeded utilities and programs is also an added risk to the web server.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-2251

Rule

SV-46363r3_rule

Severity

low

Rule Version

WG130 IIS7

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review programs installed on the OS.
1. Open Control Panel.
2. Open Programs and Features.
3. The following programs may be installed without any additional documentation:
  Administration Pack for IIS 7.0
  IIS Search Engine Optimization Toolkit
  Microsoft .NET Framework version 3.5 SP1 or greater
  Microsoft Web Platform Installer version 3.x or greater
  Virtual Machine Additions
4. Review the installed programs, if any programs are installed other than those listed above, this is a finding.

NOTE: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.

Implementation Procedure

Fix Text

Remove all unapproved programs and roles from the production web server.

STIG check 13 of 25 in the IIS 7.0 Server STIG checklist

← Previous · V-2248Access to web administration tools must be restricted to the web manager and the web managers designees.Next · V-2257 →Administrative users and groups with access privilege to the web server must be documented.