What changed in Microsoft Outlook 2010 STIG V1R14V1R14 changes

Microsoft Outlook 2010 STIG V1R14 (2025-01-30) replaced V1R13 (2018-04-27): 85 checks added, 84 removed. It has 85 checks, against 84 in V1R13.

V1R14 checklistV1R13 checklist Compare V1R13 and V1R14 in STIG Compare

  • 85 added
  • 84 removed
  • 0 updated

Added in V1R14 (85)

  • V-242023CAT IIDisable user name and password syntax from being used in URLs
  • V-242024CAT IIEnabling IE Bind to Object functionality must be present.
  • V-242025CAT IISaved from URL mark to assure Internet zone processing must be enforced.
  • V-242026CAT IINavigation to URL's embedded in Office products must be blocked.
  • V-242027CAT IIScripted Window Security must be enforced.
  • V-242028CAT IIAdd-on Management functionality must be allowed.
  • V-242029CAT IIData Execution Prevention must be enforced.
  • V-242030CAT IILinks that invoke instances of IE from within an Office product must be blocked.
  • V-242031CAT IIFile Downloads must be configured for proper restrictions.
  • V-242032CAT IIProtection from zone elevation must be enforced.
  • V-242033CAT IIActiveX Installs must be configured for proper restriction.
  • V-242034CAT IIRead EMail as plain text must be enforced.
  • V-242035CAT IIRead signed email as plain text must be enforced.
  • V-242036CAT IIPublishing calendars to Office Online must be prevented.
  • V-242037CAT IIPublishing to a Web Distributed and Authoring (DAV) server must be prevented.
  • V-242038CAT IILevel of calendar details that a user can publish must be restricted.
  • V-242039CAT IIAccess restriction settings for published calendars must be configured.
  • V-242040CAT IIUpload method for publishing calendars to Office Online must be restricted.
  • V-242041CAT IIJunk Mail UI must be configured.
  • V-242042CAT IITrust EMail from senders in receiver's contact list must be enforced.
  • V-242043CAT IIRecipients of sent email must be unable to be added to the safe sender's list.
  • V-242044CAT IIOutlook Dial-up options to Warn user before allowing switch in dial-up access must be configured.
  • V-242045CAT IIDial-up and Hang up Options for Outlook must be configured.
  • V-242046CAT IIDigital signatures must be allowed.
  • V-242047CAT IIPlain Text Options for outbound email must be configured.
  • V-242048CAT IIOutlook must be enforced as the default email, calendar, and contacts program.
  • V-242049CAT IIFolders in non-default stores, set as folder home pages, must be disallowed.
  • V-242050CAT IIDragging Unicode eMail messages to file system must be disallowed.
  • V-242051CAT IIOutlook Object Model scripts must be disallowed to run for shared folders.
  • V-242052CAT IIOutlook Object Model scripts must be disallowed to run for public folders.
  • V-242053CAT IIActive X One-Off forms must be configured.
  • V-242054CAT IIThe Add-In Trust Level must be configured.
  • V-242055CAT IIThe "remember password" for internet e-mail accounts must be disabled.
  • V-242056CAT IIUsers customizing attachment security settings must be prevented.
  • V-242057CAT IIOutlook Security Mode must be configured to use Group Policy settings.
  • V-242058CAT IIThe ability to display level 1 attachments must be disallowed.
  • V-242059CAT IIAction to demote an EMail Level 1 attachment to Level 2 must be configured.
  • V-242060CAT IIPrompting behavior for Level 1 attachments on sending must be configured.
  • V-242061CAT IILevel 1 attachment close behaviors must be configured.
  • V-242062CAT IILevel 1 file extensions must be blocked and not removed.
  • V-242063CAT IILevel 2 file extensions must be blocked and not removed.
  • V-242064CAT IIScripts in One-Off Outlook forms must be disallowed.
  • V-242065CAT IICustom Outlook Object Model (OOM) action execution prompts must be configured.
  • V-242066CAT IIObject Model Prompt for programmatic email send behavior must be configured.
  • V-242067CAT IIObject Model Prompt behavior for programmatic address books must be configured.
  • V-242068CAT IIObject Model Prompt behavior for programmatic access of user address data must be configured.
  • V-242069CAT IIObject Model Prompt behavior for Meeting and Task Responses must be configured.
  • V-242070CAT IIObject Model Prompt behavior for the SaveAs method must be configured.
  • V-242071CAT IIObject Model Prompt behavior for accessing User Property Formula must be configured.
  • V-242072CAT IITrusted add-ins behavior for eMail must be configured.
  • V-242073CAT IIS/Mime interoperability with external clients for message handling must be configured.
  • V-242074CAT IIMessage formats must be set to use SMime.
  • V-242075CAT IIRun in FIPS compliant mode must be enforced.
  • V-242076CAT IIAll signed messages as clear signed messages must be configured.
  • V-242077CAT IIWarning about invalid signatures must be enforced.
  • V-242078CAT IIAutomatic sending s/Mime receipt requests must be disallowed.
  • V-242079CAT IIRetrieving of CRL data must be set for online action.
  • V-242080CAT IIMissing Root Certificates warning must be enforced.
  • V-242081CAT IIAttachments using generated name for secure temporary folders must be configured.
  • V-242082CAT IIExternal content and pictures in HTML eMail must be displayed.
  • V-242083CAT IIAutomatic download content for email in Safe Senders list must be disallowed.
  • V-242084CAT IIPermit download of content from safe zones must be configured.
  • V-242085CAT IIIE Trusted Zones assumed 'trusted' must be blocked.
  • V-242086CAT IIInternet with Safe Zones for Picture Download must be disabled.
  • V-242087CAT IIIntranet with Safe Zones for automatic picture downloads must be configured.
  • V-242088CAT IIAlways warn on untrusted macros must be enforced.
  • V-242089CAT IIHyperlinks in suspected phishing e-mail messages must be disallowed.
  • V-242090CAT IIAutomatically configure user profile based on Active Directory primary SMTP address must be enforced.
  • V-242091CAT IIRPC encryption between Outlook and Exchange server must be enforced.
  • V-242092CAT IIAuthentication with Exchange Server must be required.
  • V-242093CAT IIRSS feed synchronization with Common Feed List must be disallowed.
  • V-242094CAT IIRSS Feeds must be disallowed.
  • V-242095CAT IIDisabling download full text of articles as HTML must be configured.
  • V-242096CAT IIAutomatic download of Internet Calendar appointment attachments must be disallowed.
  • V-242097CAT IIDo not include Internet Calendar Integration in Outlook must be enforced.
  • V-242098CAT IIUser Entries to Server List must be disallowed.
  • V-242099CAT IIAutomatically downloading enclosures on RSS must be disallowed.
  • V-242100CAT IIDefault message format must be set to use Plain Text.
  • V-242101CAT IIOutlook must be configured not to prompt users to choose security settings if default settings fail.
  • V-242102CAT IIOutlook minimum encryption key length settings must be set.
  • V-242103CAT IIReplies or forwards to signed/encrypted messages must be signed/encrypted.
  • V-242104CAT IICheck e-mail addresses against addresses of certificates being used must be disallowed.
  • V-242105CAT IIOutlook Rich Text options must be set for converting to plain text format.
  • V-242106CAT IIText in Outlook that represents Internet and network paths must not be automatically turned into hyperlinks.
  • V-270894CAT IThe version of Outlook running on the system must be a supported version.

Removed since V1R13 (84)

  • V-17173CAT IIDisable user name and password syntax from being used in URLs
  • V-17174CAT IIEnabling IE Bind to Object functionality must be present.
  • V-17175CAT IISaved from URL mark to assure Internet zone processing must be enforced.
  • V-17183CAT IINavigation to URL's embedded in Office products must be blocked.
  • V-17184CAT IILinks that invoke instances of IE from within an Office product must be blocked.
  • V-17470CAT IIPermit download of content from safe zones must be configured.
  • V-17546CAT IIAccess restriction settings for published calendars must be configured.
  • V-17558CAT IIRecipients of sent email must be unable to be added to the safe sender's list.
  • V-17559CAT IIActive X One-Off forms must be configured.
  • V-17562CAT IIScripts in One-Off Outlook forms must be disallowed.
  • V-17564CAT IIIE Trusted Zones assumed 'trusted' must be blocked.
  • V-17566CAT IIThe Add-In Trust Level must be configured.
  • V-17568CAT IIObject Model Prompt behavior for programmatic address books must be configured.
  • V-17569CAT IIAction to demote an EMail Level 1 attachment to Level 2 must be configured.
  • V-17570CAT IIObject Model Prompt behavior for accessing User Property Formula must be configured.
  • V-17571CAT IIObject Model Prompt behavior for the SaveAs method must be configured.
  • V-17572CAT IIObject Model Prompt behavior for programmatic access of user address data must be configured.
  • V-17573CAT IIObject Model Prompt behavior for Meeting and Task Responses must be configured.
  • V-17574CAT IIObject Model Prompt for programmatic email send behavior must be configured.
  • V-17575CAT IITrusted add-ins behavior for eMail must be configured.
  • V-17585CAT IIDial-up and Hang up Options for Outlook must be configured.
  • V-17586CAT IIOutlook Dial-up options to Warn user before allowing switch in dial-up access must be configured.
  • V-17587CAT IIThe "remember password" for internet e-mail accounts must be disabled.
  • V-17601CAT IILevel 1 attachment close behaviors must be configured.
  • V-17602CAT IIPrompting behavior for Level 1 attachments on sending must be configured.
  • V-17610CAT IIDisabling download full text of articles as HTML must be configured.
  • V-17613CAT IIHyperlinks in suspected phishing e-mail messages must be disallowed.
  • V-17615CAT IIRPC encryption between Outlook and Exchange server must be enforced.
  • V-17624CAT IIJunk Mail UI must be configured.
  • V-17630CAT IIInternet with Safe Zones for Picture Download must be disabled.
  • V-17634CAT IIIntranet with Safe Zones for automatic picture downloads must be configured.
  • V-17671CAT IIThe ability to display level 1 attachments must be disallowed.
  • V-17672CAT IIExternal content and pictures in HTML eMail must be displayed.
  • V-17673CAT IIDigital signatures must be allowed.
  • V-17674CAT IIFolders in non-default stores, set as folder home pages, must be disallowed.
  • V-17675CAT IIOutlook Object Model scripts must be disallowed to run for public folders.
  • V-17676CAT IIOutlook Object Model scripts must be disallowed to run for shared folders.
  • V-17678CAT IIDo not include Internet Calendar Integration in Outlook must be enforced.
  • V-17733CAT IIAttachments using generated name for secure temporary folders must be configured.
  • V-17734CAT IIAuthentication with Exchange Server must be required.
  • V-17736CAT IIAutomatically configure user profile based on Active Directory primary SMTP address must be enforced.
  • V-17738CAT IIAutomatic download of Internet Calendar appointment attachments must be disallowed.
  • V-17739CAT IIAutomatic download content for email in Safe Senders list must be disallowed.
  • V-17753CAT IIOutlook must be enforced as the default email, calendar, and contacts program.
  • V-17755CAT IIMessage formats must be set to use SMime.
  • V-17756CAT IIMissing Root Certificates warning must be enforced.
  • V-17760CAT IIOutlook Security Mode must be configured to use Group Policy settings.
  • V-17761CAT IIPlain Text Options for outbound email must be configured.
  • V-17762CAT IIPublishing to a Web Distributed and Authoring (DAV) server must be prevented.
  • V-17763CAT IIPublishing calendars to Office Online must be prevented.
  • V-17766CAT IIUsers customizing attachment security settings must be prevented.
  • V-17770CAT IIRead EMail as plain text must be enforced.
  • V-17771CAT IIRead signed email as plain text must be enforced.
  • V-17774CAT IILevel 1 file extensions must be blocked and not removed.
  • V-17775CAT IILevel 2 file extensions must be blocked and not removed.
  • V-17776CAT IILevel of calendar details that a user can publish must be restricted.
  • V-17777CAT IIUpload method for publishing calendars to Office Online must be restricted.
  • V-17778CAT IIRetrieving of CRL data must be set for online action.
  • V-17787CAT IIRun in FIPS compliant mode must be enforced.
  • V-17790CAT IIS/Mime interoperability with external clients for message handling must be configured.
  • V-17795CAT IIAutomatic sending s/Mime receipt requests must be disallowed.
  • V-17798CAT IIAlways warn on untrusted macros must be enforced.
  • V-17800CAT IIAll signed messages as clear signed messages must be configured.
  • V-17802CAT IICustom Outlook Object Model (OOM) action execution prompts must be configured.
  • V-17803CAT IIWarning about invalid signatures must be enforced.
  • V-17806CAT IIRSS feed synchronization with Common Feed List must be disallowed.
  • V-17807CAT IITrust EMail from senders in receiver's contact list must be enforced.
  • V-17808CAT IIRSS Feeds must be disallowed.
  • V-17812CAT IIDragging Unicode eMail messages to file system must be disallowed.
  • V-17944CAT IIUser Entries to Server List must be disallowed.
  • V-26584CAT IIAdd-on Management functionality must be allowed.
  • V-26585CAT IIProtection from zone elevation must be enforced.
  • V-26586CAT IIActiveX Installs must be configured for proper restriction.
  • V-26587CAT IIFile Downloads must be configured for proper restrictions.
  • V-26588CAT IIScripted Window Security must be enforced.
  • V-26590CAT IIData Execution Prevention must be enforced.
  • V-26632CAT IIAutomatically downloading enclosures on RSS must be disallowed.
  • V-26633CAT IIOutlook Rich Text options must be set for converting to plain text format.
  • V-26634CAT IIDefault message format must be set to use Plain Text.
  • V-26635CAT IIOutlook must be configured not to prompt users to choose security settings if default settings fail.
  • V-26636CAT IIOutlook minimum encryption key length settings must be set.
  • V-26637CAT IIReplies or forwards to signed/encrypted messages must be signed/encrypted.
  • V-26702CAT IICheck e-mail addresses against addresses of certificates being used must be disallowed.
  • V-41493CAT IIText in Outlook that represents Internet and network paths must not be automatically turned into hyperlinks.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R14 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.