What changed in Microsoft Outlook 2013 STIG V1R14V1R14 changes

Microsoft Outlook 2013 STIG V1R14 (2025-01-30) replaced V1R13 (2018-10-26): 82 checks added, 81 removed. It has 82 checks, against 81 in V1R13.

V1R14 checklistV1R13 checklist Compare V1R13 and V1R14 in STIG Compare

  • 82 added
  • 81 removed
  • 0 updated

Added in V1R14 (82)

  • V-242664CAT IIDisabling of user name and password syntax from being used in URLs must be enforced.
  • V-242665CAT IIThe Internet Explorer Bind to Object functionality must be enabled.
  • V-242666CAT IIThe Saved from URL mark must be selected to enforce Internet zone processing.
  • V-242667CAT IINavigation to URLs embedded in Office products must be blocked.
  • V-242668CAT IIScripted Window Security must be enforced.
  • V-242669CAT IIAdd-on Management functionality must be allowed.
  • V-242670CAT IILinks that invoke instances of Internet Explorer from within an Office product must be blocked.
  • V-242671CAT IIFile Downloads must be configured for proper restrictions.
  • V-242672CAT IIProtection from zone elevation must be enforced.
  • V-242673CAT IIActiveX installs must be configured for proper restrictions.
  • V-242674CAT IIRead EMail as plain text must be enforced.
  • V-242675CAT IIRead signed email as plain text must be enforced.
  • V-242676CAT IIPublishing calendars to Office Online must be prevented.
  • V-242677CAT IIPublishing to a Web Distributed and Authoring (DAV) server must be prevented.
  • V-242678CAT IILevel of calendar details that a user can publish must be restricted.
  • V-242679CAT IIAccess restriction settings for published calendars must be configured.
  • V-242680CAT IIUpload method for publishing calendars to Office Online must be restricted.
  • V-242681CAT IIJunk Mail UI must be configured.
  • V-242682CAT IITrust EMail from senders in receivers contact list must be enforced.
  • V-242683CAT IIRecipients of sent email must be unable to be added to the safe senders list.
  • V-242684CAT IIThe ability to add signatures to email messages must be allowed.
  • V-242685CAT IIPlain Text Options for outbound email must be configured.
  • V-242686CAT IIOutlook must be enforced as the default email, calendar, and contacts program.
  • V-242687CAT IIFolders in non-default stores, set as folder home pages, must be disallowed.
  • V-242688CAT IIDragging Unicode email messages to file system must be disallowed.
  • V-242689CAT IIOutlook Object Model scripts must be disallowed to run for shared folders.
  • V-242690CAT IIOutlook Object Model scripts must be disallowed to run for public folders.
  • V-242691CAT IIActiveX One-Off forms must be configured.
  • V-242692CAT IIThe Add-In Trust Level must be configured.
  • V-242693CAT IIThe remember password for internet e-mail accounts must be disabled.
  • V-242694CAT IIUsers customizing attachment security settings must be prevented.
  • V-242695CAT IIOutlook Security Mode must be configured to use Group Policy settings.
  • V-242696CAT IIThe ability to display level 1 attachments must be disallowed.
  • V-242697CAT IIAction to demote an EMail Level 1 attachment to Level 2 must be configured.
  • V-242698CAT IIThe prompt to display level 1 attachments must be disallowed when sending an item.
  • V-242699CAT IIThe prompt to display level 1 attachments must be disallowed when closing an item.
  • V-242700CAT IILevel 1 file extensions must be blocked and not removed.
  • V-242701CAT IILevel 2 file extensions must be blocked and not removed.
  • V-242702CAT IIScripts in One-Off Outlook forms must be disallowed.
  • V-242703CAT IICustom Outlook Object Model (OOM) action execution prompts must be configured.
  • V-242704CAT IIObject Model Prompt for programmatic email send behavior must be configured.
  • V-242705CAT IIObject Model Prompt behavior for programmatic address books must be configured.
  • V-242706CAT IIObject Model Prompt behavior for programmatic access of user address data must be configured.
  • V-242707CAT IIObject Model Prompt behavior for Meeting and Task Responses must be configured.
  • V-242708CAT IIObject Model Prompt behavior for the SaveAs method must be configured.
  • V-242709CAT IIObject Model Prompt behavior for accessing User Property Formula must be configured.
  • V-242710CAT IITrusted add-ins behavior for email must be configured.
  • V-242711CAT IIS/Mime interoperability with external clients for message handling must be configured.
  • V-242712CAT IIMessage formats must be set to use SMime.
  • V-242713CAT IIRun in FIPS compliant mode must be enforced.
  • V-242714CAT IISend all signed messages as clear signed messages must be configured.
  • V-242715CAT IIWarning about invalid signatures must be enforced.
  • V-242716CAT IIAutomatic sending s/Mime receipt requests must be disallowed.
  • V-242717CAT IIRetrieving of CRL data must be set for online action.
  • V-242718CAT IIMissing Root Certificates warning must be enforced.
  • V-242719CAT IIAttachments using generated name for secure temporary folders must be configured.
  • V-242720CAT IIExternal content and pictures in HTML email must be displayed.
  • V-242721CAT IIAutomatic download content for email in Safe Senders list must be disallowed.
  • V-242722CAT IIPermit download of content from safe zones must be configured.
  • V-242723CAT IIIE Trusted Zones assumed trusted must be blocked.
  • V-242724CAT IIInternet with Safe Zones for Picture Download must be disabled.
  • V-242725CAT IIIntranet with Safe Zones for automatic picture downloads must be configured.
  • V-242726CAT IIAlways warn on untrusted macros must be enforced.
  • V-242727CAT IIHyperlinks in suspected phishing email messages must be disallowed.
  • V-242728CAT IIRPC encryption between Outlook and Exchange server must be enforced.
  • V-242729CAT IIOutlook must be configured to force authentication when connecting to an Exchange server.
  • V-242730CAT IIRSS feed synchronization with Common Feed List must be disallowed.
  • V-242731CAT IIRSS Feeds must be disallowed.
  • V-242732CAT IIDisabling download full text of articles as HTML must be configured.
  • V-242733CAT IIAutomatic download of Internet Calendar appointment attachments must be disallowed.
  • V-242734CAT IIInternet calendar integration in Outlook must be disabled.
  • V-242735CAT IIUser Entries to Server List must be disallowed.
  • V-242736CAT IIAutomatically downloading enclosures on RSS must be disallowed.
  • V-242737CAT IIDefault message format must be set to use Plain Text.
  • V-242738CAT IIOutlook must be configured not to prompt users to choose security settings if default settings fail.
  • V-242739CAT IIOutlook minimum encryption key length settings must be set.
  • V-242740CAT IIReplies or forwards to signed/encrypted messages must be signed/encrypted.
  • V-242741CAT IICheck e-mail addresses against addresses of certificates being used must be disallowed.
  • V-242742CAT IIOutlook Rich Text options must be set for converting to plain text format.
  • V-242743CAT IIThe use of the weather bar in Outlook must be disabled
  • V-242744CAT IIText in Outlook that represents Internet and network paths must not be automatically turned into hyperlinks.
  • V-270893CAT IThe version of Outlook running on the system must be a supported version.

Removed since V1R13 (81)

  • V-17173CAT IIDisabling of user name and password syntax from being used in URLs must be enforced.
  • V-17174CAT IIThe Internet Explorer Bind to Object functionality must be enabled.
  • V-17175CAT IIThe Saved from URL mark must be selected to enforce Internet zone processing.
  • V-17183CAT IINavigation to URLs embedded in Office products must be blocked.
  • V-17184CAT IILinks that invoke instances of Internet Explorer from within an Office product must be blocked.
  • V-17470CAT IIPermit download of content from safe zones must be configured.
  • V-17546CAT IIAccess restriction settings for published calendars must be configured.
  • V-17558CAT IIRecipients of sent email must be unable to be added to the safe senders list.
  • V-17559CAT IIActiveX One-Off forms must be configured.
  • V-17562CAT IIScripts in One-Off Outlook forms must be disallowed.
  • V-17564CAT IIIE Trusted Zones assumed trusted must be blocked.
  • V-17566CAT IIThe Add-In Trust Level must be configured.
  • V-17568CAT IIObject Model Prompt behavior for programmatic address books must be configured.
  • V-17569CAT IIAction to demote an EMail Level 1 attachment to Level 2 must be configured.
  • V-17570CAT IIObject Model Prompt behavior for accessing User Property Formula must be configured.
  • V-17571CAT IIObject Model Prompt behavior for the SaveAs method must be configured.
  • V-17572CAT IIObject Model Prompt behavior for programmatic access of user address data must be configured.
  • V-17573CAT IIObject Model Prompt behavior for Meeting and Task Responses must be configured.
  • V-17574CAT IIObject Model Prompt for programmatic email send behavior must be configured.
  • V-17575CAT IITrusted add-ins behavior for email must be configured.
  • V-17587CAT IIThe remember password for internet e-mail accounts must be disabled.
  • V-17601CAT IIThe prompt to display level 1 attachments must be disallowed when closing an item.
  • V-17602CAT IIThe prompt to display level 1 attachments must be disallowed when sending an item.
  • V-17610CAT IIDisabling download full text of articles as HTML must be configured.
  • V-17613CAT IIHyperlinks in suspected phishing email messages must be disallowed.
  • V-17615CAT IIRPC encryption between Outlook and Exchange server must be enforced.
  • V-17624CAT IIJunk Mail UI must be configured.
  • V-17630CAT IIInternet with Safe Zones for Picture Download must be disabled.
  • V-17634CAT IIIntranet with Safe Zones for automatic picture downloads must be configured.
  • V-17671CAT IIThe ability to display level 1 attachments must be disallowed.
  • V-17672CAT IIExternal content and pictures in HTML email must be displayed.
  • V-17673CAT IIThe ability to add signatures to email messages must be allowed.
  • V-17674CAT IIFolders in non-default stores, set as folder home pages, must be disallowed.
  • V-17675CAT IIOutlook Object Model scripts must be disallowed to run for public folders.
  • V-17676CAT IIOutlook Object Model scripts must be disallowed to run for shared folders.
  • V-17678CAT IIInternet calendar integration in Outlook must be disabled.
  • V-17733CAT IIAttachments using generated name for secure temporary folders must be configured.
  • V-17734CAT IIOutlook must be configured to force authentication when connecting to an Exchange server.
  • V-17738CAT IIAutomatic download of Internet Calendar appointment attachments must be disallowed.
  • V-17739CAT IIAutomatic download content for email in Safe Senders list must be disallowed.
  • V-17753CAT IIOutlook must be enforced as the default email, calendar, and contacts program.
  • V-17755CAT IIMessage formats must be set to use SMime.
  • V-17756CAT IIMissing Root Certificates warning must be enforced.
  • V-17760CAT IIOutlook Security Mode must be configured to use Group Policy settings.
  • V-17761CAT IIPlain Text Options for outbound email must be configured.
  • V-17762CAT IIPublishing to a Web Distributed and Authoring (DAV) server must be prevented.
  • V-17763CAT IIPublishing calendars to Office Online must be prevented.
  • V-17766CAT IIUsers customizing attachment security settings must be prevented.
  • V-17770CAT IIRead EMail as plain text must be enforced.
  • V-17771CAT IIRead signed email as plain text must be enforced.
  • V-17774CAT IILevel 1 file extensions must be blocked and not removed.
  • V-17775CAT IILevel 2 file extensions must be blocked and not removed.
  • V-17776CAT IILevel of calendar details that a user can publish must be restricted.
  • V-17777CAT IIUpload method for publishing calendars to Office Online must be restricted.
  • V-17778CAT IIRetrieving of CRL data must be set for online action.
  • V-17787CAT IIRun in FIPS compliant mode must be enforced.
  • V-17790CAT IIS/Mime interoperability with external clients for message handling must be configured.
  • V-17795CAT IIAutomatic sending s/Mime receipt requests must be disallowed.
  • V-17798CAT IIAlways warn on untrusted macros must be enforced.
  • V-17800CAT IISend all signed messages as clear signed messages must be configured.
  • V-17802CAT IICustom Outlook Object Model (OOM) action execution prompts must be configured.
  • V-17803CAT IIWarning about invalid signatures must be enforced.
  • V-17806CAT IIRSS feed synchronization with Common Feed List must be disallowed.
  • V-17807CAT IITrust EMail from senders in receivers contact list must be enforced.
  • V-17808CAT IIRSS Feeds must be disallowed.
  • V-17812CAT IIDragging Unicode email messages to file system must be disallowed.
  • V-17944CAT IIUser Entries to Server List must be disallowed.
  • V-26584CAT IIAdd-on Management functionality must be allowed.
  • V-26585CAT IIProtection from zone elevation must be enforced.
  • V-26586CAT IIActiveX installs must be configured for proper restrictions.
  • V-26587CAT IIFile Downloads must be configured for proper restrictions.
  • V-26588CAT IIScripted Window Security must be enforced.
  • V-26632CAT IIAutomatically downloading enclosures on RSS must be disallowed.
  • V-26633CAT IIOutlook Rich Text options must be set for converting to plain text format.
  • V-26634CAT IIDefault message format must be set to use Plain Text.
  • V-26635CAT IIOutlook must be configured not to prompt users to choose security settings if default settings fail.
  • V-26636CAT IIOutlook minimum encryption key length settings must be set.
  • V-26637CAT IIReplies or forwards to signed/encrypted messages must be signed/encrypted.
  • V-26702CAT IICheck e-mail addresses against addresses of certificates being used must be disallowed.
  • V-41492CAT IIThe use of the weather bar in Outlook must be disabled
  • V-41493CAT IIText in Outlook that represents Internet and network paths must not be automatically turned into hyperlinks.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R14 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.