Microsoft Excel 2016 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Add-on Management functionality must be allowed.
Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons may contain viruses or other malicious code. Disabling or not configuring ...Rule Medium Severity -
SRG-APP-000131
Group -
Add-ins to Office applications must be signed by a Trusted Publisher.
This policy setting controls whether add-ins for the specified Office 2016 applications must be digitally signed by a trusted publisher. If you enable this policy setting, this application checks t...Rule Medium Severity -
SRG-APP-000207
Group -
SRG-APP-000131
Group -
SRG-APP-000209
Group -
File Downloads must be configured for proper restrictions.
Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the download. User preferences may also allow the download to occur without...Rule Medium Severity -
SRG-APP-000210
Group -
All automatic loading from trusted locations must be disabled.
This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are ...Rule Medium Severity -
SRG-APP-000210
Group -
Disallowance of trusted locations on the network must be enforced.
This policy setting controls whether trusted locations on the network can be used. If you enable this policy setting, users can specify trusted locations on network shares or in other remote locati...Rule Medium Severity -
SRG-APP-000210
Group -
SRG-APP-000210
Group -
Macro storage must be in personal macro workbooks.
This policy setting controls the default location for storing macros in Excel. If this policy setting is enabled, Excel stores macros in users' personal macro workbook. If you disable or do not con...Rule Medium Severity -
SRG-APP-000141
Group -
Trust access for VBA must be disallowed.
This policy setting controls whether automation clients such as Microsoft Visual Studio 2005 Tools for Microsoft Office (VSTO) can access the Visual Basic for Applications project system in the spe...Rule Medium Severity -
SRG-APP-000112
Group -
Protection from zone elevation must be enforced.
Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine ...Rule Medium Severity -
SRG-APP-000488
Group -
SRG-APP-000210
Group -
Document behavior if file validation fails must be set.
This policy setting controls how Office handles documents when they fail file validation. If you enable this policy setting, you can configure the following options for files that fail file validat...Rule Medium Severity -
SRG-APP-000210
Group -
Excel attachments opened from Outlook must be in Protected View.
This policy setting allows you to determine if Excel files in Outlook attachments open in Protected View. If you enable this policy setting, Outlook attachments do not open in Protected View. If yo...Rule Medium Severity -
SRG-APP-000141
Group -
SRG-APP-000207
Group -
WEBSERVICE functions must be disabled.
This policy setting controls how Excel will warn users when WEBSERVICE functions are present. If you enable this policy setting, you can choose from three options for determining how the specified ...Rule Medium Severity -
SRG-APP-000207
Group -
Corrupt workbook options must be disallowed.
This policy setting controls whether Excel presents users with a list of data extraction options before beginning an Open and Repair operation when users choose to open a corrupt workbook in repair...Rule Medium Severity -
SRG-APP-000210
Group -
Macros must be blocked from running in Office files from the Internet.
This policy setting allows you to block macros from running in Office files that come from the Internet. If you enable this policy setting, macros are blocked from running, even if 'Enable all mac...Rule Medium Severity -
SRG-APP-000210
Group -
Files on local Intranet UNC must be opened in Protected View.
This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View. If you enable this policy setting, files on local Intranet UNC file shares open in Protecte...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.