Email Services Policy STIG

Version: 2

Updated: 01 Dec 2018

Findings: 21

Findings

V-18857 - Annual procedural reviews must be conducted at the site. (medium)
V-18864 - Email Configuration Management (CM) procedures must be implemented. (medium)
V-18865 - Email Administrator role must be assigned and authorized by the ISSO. (low)
V-18867 - Email Services must be documented in the EDSP (Email Domain Security Plan). (medium)
V-18868 - Email software installation account usage must be logged. (low)
V-18869 - Email audit trails must be reviewed daily. (low)
V-18877 - Email Administrator Groups must ensure least privilege. (medium)
V-18878 - Automated audit reporting tools must be available. (medium)
V-18879 - Email audit records must be retained for 1 year. (medium)
V-18880 - Audit logs must be documented and included in backups. (medium)
V-18881 - The email backup and recovery strategy must be documented and tested on an INFOCON compliant frequency. (low)
V-18882 - Email backup and recovery data must be protected. (medium)
V-18883 - Email backups must meet schedule and storage requirements. (medium)
V-18884 - Email critical software copies must be stored off-site in a fire-rated container. (medium)
V-18885 - Email acceptable use policy must be documented in the Email Domain Security Plan (EDSP). (low)
V-18886 - Email Acceptable Use Policy must contain required elements. (low)
V-19546 - Email domains must be protected by an Edge Server at the email transport path. (high)
V-19548 - Email domains must be protected by transaction proxy at the client access path. (high)
V-33389 - Email acceptable use policy must be renewed annually. (low)
V-35227 - Transaction proxies protecting email domains must interrupt and inspect web traffic on the client access path prior to its entry to the enclave. (medium)
V-39139 - Email client services for Commercial Mobile Devices must be documented in the Email Domain Security Plan (EDSP). (medium)