Skip to content
ATO Pathways
  Log In

Microsoft Office 365 ProPlus Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000231

    <GroupDescription></GroupDescription>
    Group
    Show

  • Office applications must be configured to specify encryption type in password-protected Office 97-2003 files.

    &lt;VulnDiscussion&gt;This policy setting enables you to specify an encryption type for password-protected Office 97-2003 files. If you enable thi...
    Rule Medium Severity
    Show

  • SRG-APP-000231

    <GroupDescription></GroupDescription>
    Group
    Show

  • Office applications must be configured to specify encryption type in password-protected Office Open XML files.

    &lt;VulnDiscussion&gt;This policy setting allows you to specify an encryption type for Office Open XML files. If you enable this policy setting, y...
    Rule Medium Severity
    Show

  • SRG-APP-000340

    <GroupDescription></GroupDescription>
    Group
    Show

  • Users must be prevented from creating new trusted locations in the Trust Center.

    &lt;VulnDiscussion&gt;This policy setting controls whether trusted locations can be defined by users, the Office Customization Tool (OCT), and Grou...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Office applications must not load XML expansion packs with Smart Documents.

    &lt;VulnDiscussion&gt;This policy setting controls whether Office 365 ProPlus applications can load an XML expansion pack manifest file with a Smar...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • The load of controls in Forms3 must be blocked.

    &lt;VulnDiscussion&gt;This policy setting allows the user to control how ActiveX controls in UserForms should be initialized based upon whether the...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • Add-on Management must be enabled for all Office 365 ProPlus programs.

    &lt;VulnDiscussion&gt;Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons ma...
    Rule Medium Severity
    Show

  • SRG-APP-000179

    <GroupDescription></GroupDescription>
    Group
    Show

  • Consistent MIME handling must be enabled for all Office 365 ProPlus programs.

    &lt;VulnDiscussion&gt;Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified ...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • User name and password must be disabled in all Office programs.

    &lt;VulnDiscussion&gt;The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://usern...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Information Bar must be enabled in all Office programs.

    &lt;VulnDiscussion&gt;This policy setting controls whether Office 365 ProPlus applications notify users when potentially unsafe features or content...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Local Machine Zone Lockdown Security must be enabled in all Office programs.

    &lt;VulnDiscussion&gt;Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local compute...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules