Microsoft Office System 2016 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Encrypt document properties must be configured for OLE documents.
This policy setting allows you configure if the document properties are encrypted. This applies to OLE documents (Office 97-2003 compatible) if the application is configured for CAPI RC4. If you e...Rule Medium Severity -
SRG-APP-000141
Group -
SRG-APP-000210
Group -
The ability to create an online presentation programmatically must be disabled.
This policy setting allows you to restrict the ability to create an online presentation programmatically in PowerPoint and Word. If you enable this policy setting, an online presentation cannot be ...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
The ability to run unsecure Office web add-ins and Catalogs must be disabled.
This policy setting allows users to run unsecure web add-in, which are add-ins that have web page or catalog locations that are not SSL-secured (https://), and are not in users' Internet zones. If ...Rule Medium Severity -
SRG-APP-000516
Group -
The Office Telemetry Agent must be configured to obfuscate the file name, file path, and title of Office documents before uploading telemetry data to the shared folder.
This policy setting configures Office Telemetry Agent to disguise, or obfuscate, certain file properties that are reported in telemetry data. If this policy setting is enabled, Office Telemetry Age...Rule Medium Severity -
SRG-APP-000516
Group -
The Help Improve Proofing Tools feature for Office must be configured.
This policy setting controls whether the Help Improve Proofing Tools feature sends usage data to Microsoft. The Help Improve Proofing Tools feature collects data about use of the Proofing Tools, su...Rule Medium Severity -
Trust Bar notifications for Security messages must be enforced.
This policy setting controls whether Office 2016 applications notify users when potentially unsafe features or content are detected, or whether such features or content are silently disabled withou...Rule Medium Severity -
Document metadata for password protected files must be protected.
This policy setting determines whether metadata is encrypted when an Office Open XML file is password protected. If you enable this policy setting, Excel 2016, PowerPoint 2016, and Word 2016 encryp...Rule Medium Severity -
The encryption type for password protected Office 97 thru Office 2003 must be set.
This policy setting enables you to specify an encryption type for password-protected Office 97-2003 files. If you enable this policy setting, you can specify the type of encryption that Office appl...Rule Medium Severity -
Load controls in forms3 must be disabled from loading.
This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe For Initialization (SFI) or Unsafefor Initialization (UFI). Acti...Rule Medium Severity -
Automation Security to enforce macro level security in Office documents must be configured.
This policy setting controls whether macros can run in an Office 2016 application that is opened programmatically by another application. If you enable this policy setting, you can choose from thre...Rule Medium Severity -
Connection verification of permissions must be enforced.
This policy setting controls whether users are required to connect to the Internet or a local network to have their licenses confirmed every time they attempt to open Excel workbooks, InfoPath form...Rule Medium Severity -
Office Presentation Service must be removed as an option for presenting PowerPoint and Word online.
This policy setting allows you to remove Office Presentation Service from the list of online presentation services in PowerPoint and Word. This list appears when a user selects Present Online from ...Rule Medium Severity -
When using the Office Feedback tool, the ability to include a screenshot must be disabled.
This policy setting manages whether the Office Feedback Tool (a.k.a. Send a Smile) allows the user to send a screenshot of their desktop with their feedback to Microsoft. The Office Feedback Tool a...Rule Medium Severity -
The ability to send personal information to Office must be disabled.
This policy setting controls whether users can send personal information to Office. When users choose to send information Office 2016 applications automatically send information to Office. If you e...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.