Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

IIS 7.0 Site STIG

The IIS 7.0 Site STIG (V1 R19) has 49 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

49STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R19

CurrentPublished Fri Jan 24 2020

A private web-site must utilize certificates from a trusted DoD CA.

IIS 7.0 Site STIG

Assessment Title

Rule Text

Description

Discussion Text

The use of a DoD PKI certificate ensures clients the private web site they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-13620

Rule

SV-32473r2_rule

Severity

medium

Rule Version

WG355 IIS7

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

1. Open the IIS Manager.
2. Click the site name under review.
3. Click Bindings in the Action Pane.
4. Click the HTTPS type from the box.
5. Click Edit.
6. Click View, review and verify the certificate path. If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding.  If HTTPS is not an available type under site bindings, this is a finding.

Implementation Procedure

Fix Text

1. Open the IIS Manager.
2. Click the Server name.
3. Double-Click Server Certificates.
4. Click Import under the Actions Pane.
5. Browse to the DoD certificate location, select it, and click OK.
6. Remove any non-DoD certificates if present.
7. Click on the site needing the certificate.
8. Select Bindings under the Actions Pane.
9. Click on the binding needing a certificate and select edit, or add a site binding for HTTPS and execute step 10.
10. Assign the certificate to the web site by choosing it under the SSL Certificate drop down and clicking OK.

STIG check 1 of 49 in the IIS 7.0 Site STIG checklist

Next · V-13686 →Remote authors or content providers will only use secure encrypted logons and connections to upload files to the Document Root directory.