# Email scanning SHALL be capable of reviewing emails after delivery Email scanning SHALL be capable of reviewing emails after delivery. A Maester check for Exchange Online, Anti-malware. Source: https://maester.dev/docs/tests/CISA.MS.EXO.10.3

Contributed by Michael Soule with Jean-Philippe GeorgeAll contributors →

Part of CISA · Exchange Online · Anti-malware · All checks

```powershell title="Run this check" Invoke-Maester -TestId CISA.MS.EXO.10.3 ``` ## Overview Email scanning SHALL be capable of reviewing emails after delivery. Rationale: As known malware signatures are updated, it is possible for an email to be retroactively identified as containing malware after delivery. By scanning emails, the number of malware-infected in users' mailboxes can be reduced. #### Remediation action 1. Sign in to **Microsoft 365 Defender**. 2. In the left-hand menu, go to **Email & Collaboration** > **Policies & Rules**. 3. Select **Threat Policies**. 4. From the **Templated policies** section, select **Preset Security Policies**. 5. Under **Standard protection**, slide the toggle switch to the right so the text next to the toggle reads **Standard protection is on**. 6. Under **Strict protection**, slide the toggle switch to the right so the text next to the toggle reads **Strict protection is on**. Note: If the toggle slider in step 5 is grayed out, click on **Manage protection settings** instead and configure the policy settings according to [Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn](https://learn.microsoft.com/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). #### Related links * [Defender admin center - Preset security policies](https://security.microsoft.com/presetSecurityPolicies) * [Defender admin center - Order and precedence of email protection](https://learn.microsoft.com/defender-office-365/how-policies-and-protections-are-combined) * [CISA 10 Malware Scanning - MS.EXO.10.3v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo103v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/EXOConfig.rego#L597) * [Microsoft Learn - Zero-hour auto purge (ZAP) for malware](https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge#zero-hour-auto-purge-zap-for-email-messages) ## Details

Every attribute of this check

| Field | Value | | --- | --- | | Test ID | CISA.MS.EXO.10.3 | | Severity | High | | Suite | CISA | | Product | Exchange Online | | Related products | Defender | | Feature | Anti-malware | | Area | Email and collaboration protection | | Resource type | Policy | | User impact | Low | | Implementation cost | Low | | MITRE ATT&CK | T1204.002 Malicious File, T1566.001 Spearphishing Attachment | | Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.10.3 | | Criticality | SHALL | | Upstream requirement | Moved to MS.SECURITYSUITE.1.2v1 (was MS.EXO.10.3v1) | | Supports controls | cisa-scuba:MS.EXO.10.3, nist-800-53-r5:SI-3 | | PowerShell test | [Test-MtCisaMalwareZap](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.10.3.ps1) | | Services | ExchangeOnline |

## Source - Test: [`tests/cisa/exchange/Test.CISA.MS.EXO.10.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.10.3.ps1) - Documentation: [`tests/cisa/exchange/Test.CISA.MS.EXO.10.3.md`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.10.3.md)