Microsoft Office 365 ProPlus Security Technical Implementation Guide

The Microsoft Office 365 ProPlus Security Technical Implementation Guide (V3 R5) has 139 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

139STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Apr 01 2026

Office applications must not load XML expansion packs with Smart Documents.

Microsoft Office 365 ProPlus Security Technical Implementation Guide

Assessment Title

Rule Text

Office applications must not load XML expansion packs with Smart Documents.

Description

Discussion Text

This policy setting controls whether Office 365 ProPlus applications can load an XML expansion pack manifest file with a Smart Document.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223294

Rule

SV-223294r961863_rule

Severity

medium

Rule Version

O365-CO-000012

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Smart Documents (Word, Excel) >> Disable Smart Document's use of manifests is set to "Enabled".

Use the Windows Registry Editor to navigate to the following key:

HKCU\software\policies\microsoft\office\common\smart tag

If the value for neverloadmanifests is REG_DWORD = 1, this is not a finding.

Implementation Procedure

Fix Text

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Smart Documents (Word, Excel) >> Disable Smart Document's use of manifests to "Enabled".

STIG check 14 of 139 in the Microsoft Office 365 ProPlus STIG checklist

← Previous · V-223293Users must be prevented from creating new trusted locations in the Trust Center.Next · V-223295 →The load of controls in Forms3 must be blocked.