What changed in Microsoft Exchange 2013 Edge Transport Server STIG V1R6V1R6 changes

Microsoft Exchange 2013 Edge Transport Server STIG V1R6 (2024-07-24) replaced V1R5 (2019-04-26): 63 checks added, 63 removed. It has 63 checks, against 63 in V1R5.

V1R6 checklistV1R5 checklist Compare V1R5 and V1R6 in STIG Compare

  • 63 added
  • 63 removed
  • 0 updated

Added in V1R6 (63)

  • V-234702CAT IIExchange must limit the Receive connector timeout.
  • V-234703CAT IIExchange servers must use approved DoD certificates.
  • V-234704CAT IIExchange must have accepted domains configured.
  • V-234705CAT IIExchange external Receive connectors must be domain secure-enabled.
  • V-234706CAT IIThe Exchange email Diagnostic log level must be set to the lowest level.
  • V-234707CAT IIExchange Connectivity logging must be enabled.
  • V-234708CAT IIExchange Queue monitoring must be configured with threshold and action.
  • V-234709CAT IIExchange must not send Customer Experience reports to Microsoft.
  • V-234710CAT IIExchange Audit data must be protected against unauthorized access (read access).
  • V-234711CAT IIExchange Send Fatal Errors to Microsoft must be disabled.
  • V-234712CAT IIExchange audit data must be protected against unauthorized access for modification.
  • V-234713CAT IIExchange audit data must be protected against unauthorized access for deletion.
  • V-234714CAT IIExchange audit data must be on separate partitions.
  • V-234715CAT IIThe Exchange local machine policy must require signed scripts.
  • V-234716CAT IIExchange Internet-facing Send connectors must specify a Smart Host.
  • V-234717CAT IIExchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.
  • V-234718CAT IIExchange Outbound Connection Timeout must be 10 minutes or less.
  • V-234719CAT IIExchange Outbound Connection Limit per Domain Count must be controlled.
  • V-234720CAT IIIExchange Global Outbound Message size must be controlled.
  • V-234721CAT IIIExchange Send connector connections count must be limited.
  • V-234722CAT IIIExchange message size restrictions must be controlled on Send connectors.
  • V-234723CAT IIIExchange Send connectors delivery retries must be controlled.
  • V-234724CAT IIIExchange Send connectors must be clearly named.
  • V-234725CAT IIExchange Receive connector Maximum Hop Count must be 60.
  • V-234726CAT IIIExchange Receive connectors must be clearly named.
  • V-234727CAT IIIExchange Receive connectors must control the number of recipients chunked on a single message.
  • V-234728CAT IIExchange Receive connectors must control the number of recipients per message.
  • V-234729CAT IIIThe Exchange Internet Receive connector connections count must be set to default.
  • V-234730CAT IIIExchange Message size restrictions must be controlled on Receive connectors.
  • V-234731CAT IIExchange messages with a blank sender field must be rejected.
  • V-234732CAT IIExchange messages with a blank sender field must be filtered.
  • V-234733CAT IIExchange filtered messages must be archived.
  • V-234734CAT IIThe Exchange Sender filter must block unaccepted domains.
  • V-234735CAT IIExchange nonexistent recipients must not be blocked.
  • V-234736CAT IIThe Exchange Sender Reputation filter must be enabled.
  • V-234737CAT IIThe Exchange Sender Reputation filter must identify the spam block level.
  • V-234738CAT IIExchange Attachment filtering must remove undesirable attachments by file type.
  • V-234739CAT IIThe Exchange Spam Evaluation filter must be enabled.
  • V-234740CAT IIThe Exchange Block List service provider must be identified.
  • V-234741CAT IIExchange messages with malformed From address must be rejected.
  • V-234742CAT IIThe Exchange Recipient filter must be enabled.
  • V-234743CAT IIThe Exchange tarpitting interval must be set.
  • V-234744CAT IIExchange internal Receive connectors must not allow anonymous connections.
  • V-234745CAT IIExchange Simple Mail Transfer Protocol (SMTP) IP Allow List entries must be empty.
  • V-234746CAT IIThe Exchange Simple Mail Transfer Protocol (SMTP) IP Allow List Connection filter must be enabled.
  • V-234747CAT IIThe Exchange Simple Mail Transfer Protocol (SMTP) Sender filter must be enabled.
  • V-234748CAT IIExchange must have antispam filtering installed.
  • V-234749CAT IIExchange must have antispam filtering enabled.
  • V-234750CAT IIExchange must have antispam filtering configured.
  • V-234751CAT IIExchange Sender Identification Framework must be enabled.
  • V-234752CAT IIThe Exchange application directory must be protected from unauthorized access.
  • V-234753CAT IIThe Exchange software baseline copy must exist.
  • V-234754CAT IIExchange software must be monitored for unauthorized changes.
  • V-234755CAT IIExchange services must be documented and unnecessary services must be removed or disabled.
  • V-234756CAT IIExchange software must be installed on a separate partition from the OS.
  • V-234757CAT IIThe Exchange SMTP automated banner response must not reveal server details.
  • V-234758CAT IExchange must provide redundancy.
  • V-234759CAT IIExchange internal Send connectors must use an authentication level.
  • V-234760CAT IExchange internal Receive connectors must require encryption.
  • V-234761CAT IExchange internal Send connectors must require encryption.
  • V-234762CAT IIThe version of Exchange running on the system must be a supported version.
  • V-234763CAT IIThe applications built-in Malware Agent must be disabled.
  • V-234764CAT IIA DoD-approved third party Exchange-aware malicious code protection application must be implemented.

Removed since V1R5 (63)

  • V-69783CAT IIExchange must limit the Receive connector timeout.
  • V-69785CAT IIExchange servers must use approved DoD certificates.
  • V-69787CAT IIExchange must have accepted domains configured.
  • V-69791CAT IIExchange external Receive connectors must be domain secure-enabled.
  • V-69793CAT IIThe Exchange email Diagnostic log level must be set to the lowest level.
  • V-69795CAT IIExchange Connectivity logging must be enabled.
  • V-69797CAT IIExchange Queue monitoring must be configured with threshold and action.
  • V-69799CAT IIExchange must not send Customer Experience reports to Microsoft.
  • V-69801CAT IIExchange Audit data must be protected against unauthorized access (read access).
  • V-69803CAT IIExchange Send Fatal Errors to Microsoft must be disabled.
  • V-69805CAT IIExchange audit data must be protected against unauthorized access for modification.
  • V-69807CAT IIExchange audit data must be protected against unauthorized access for deletion.
  • V-69809CAT IIExchange audit data must be on separate partitions.
  • V-69811CAT IIThe Exchange local machine policy must require signed scripts.
  • V-69813CAT IIExchange Internet-facing Send connectors must specify a Smart Host.
  • V-69817CAT IIExchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.
  • V-69819CAT IIExchange Outbound Connection Timeout must be 10 minutes or less.
  • V-69821CAT IIExchange Outbound Connection Limit per Domain Count must be controlled.
  • V-69823CAT IIIExchange Global Outbound Message size must be controlled.
  • V-69827CAT IIIExchange Send connector connections count must be limited.
  • V-69829CAT IIIExchange message size restrictions must be controlled on Send connectors.
  • V-69831CAT IIIExchange Send connectors delivery retries must be controlled.
  • V-69833CAT IIIExchange Send connectors must be clearly named.
  • V-69835CAT IIExchange Receive connector Maximum Hop Count must be 60.
  • V-69837CAT IIIExchange Receive connectors must be clearly named.
  • V-69839CAT IIIExchange Receive connectors must control the number of recipients chunked on a single message.
  • V-69855CAT IIExchange Receive connectors must control the number of recipients per message.
  • V-69857CAT IIIThe Exchange Internet Receive connector connections count must be set to default.
  • V-69859CAT IIIExchange Message size restrictions must be controlled on Receive connectors.
  • V-69861CAT IIExchange messages with a blank sender field must be rejected.
  • V-69863CAT IIExchange messages with a blank sender field must be filtered.
  • V-69865CAT IIExchange filtered messages must be archived.
  • V-69867CAT IIThe Exchange Sender filter must block unaccepted domains.
  • V-69869CAT IIExchange nonexistent recipients must not be blocked.
  • V-69871CAT IIThe Exchange Sender Reputation filter must be enabled.
  • V-69873CAT IIThe Exchange Sender Reputation filter must identify the spam block level.
  • V-69875CAT IIExchange Attachment filtering must remove undesirable attachments by file type.
  • V-69877CAT IIThe Exchange Spam Evaluation filter must be enabled.
  • V-69879CAT IIThe Exchange Block List service provider must be identified.
  • V-69881CAT IIExchange messages with malformed From address must be rejected.
  • V-69889CAT IIThe Exchange Recipient filter must be enabled.
  • V-69891CAT IIThe Exchange tarpitting interval must be set.
  • V-69893CAT IIExchange internal Receive connectors must not allow anonymous connections.
  • V-69895CAT IIExchange Simple Mail Transfer Protocol (SMTP) IP Allow List entries must be empty.
  • V-69897CAT IIThe Exchange Simple Mail Transfer Protocol (SMTP) IP Allow List Connection filter must be enabled.
  • V-69899CAT IIThe Exchange Simple Mail Transfer Protocol (SMTP) Sender filter must be enabled.
  • V-69901CAT IIExchange must have antispam filtering installed.
  • V-69903CAT IIExchange must have antispam filtering enabled.
  • V-69905CAT IIExchange must have antispam filtering configured.
  • V-69907CAT IIExchange Sender Identification Framework must be enabled.
  • V-69911CAT IIThe Exchange application directory must be protected from unauthorized access.
  • V-69913CAT IIThe Exchange software baseline copy must exist.
  • V-69915CAT IIExchange software must be monitored for unauthorized changes.
  • V-69917CAT IIExchange services must be documented and unnecessary services must be removed or disabled.
  • V-69919CAT IIExchange software must be installed on a separate partition from the OS.
  • V-69921CAT IIThe Exchange SMTP automated banner response must not reveal server details.
  • V-69927CAT IExchange must provide redundancy.
  • V-69929CAT IIExchange internal Send connectors must use an authentication level.
  • V-69931CAT IExchange internal Receive connectors must require encryption.
  • V-69933CAT IExchange internal Send connectors must require encryption.
  • V-69935CAT IIExchange must have the most current, approved service pack installed.
  • V-69937CAT IIThe applications built-in Malware Agent must be disabled.
  • V-69939CAT IIA DoD-approved third party Exchange-aware malicious code protection application must be implemented.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R6 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.