SharePoint

20 checks20 Medium

External sharing12Sharing links6Access control2

Run theseInvoke-Maester -Product sharepointCopy

20 checks

Group byFeatureAreaSeveritySuiteNone

Columns

FeatureAreaSeverityUser impactEffortATT&CKControlsSourceReset to default

ID↕Check↕Feature↕Area↕Severity↕User impact↕Effort↕ATT&CK↕Controls↕Source↕

CIS.M365.7.2.1Ensure modern authentication for SharePoint applications is requiredNew in 3.0Access controlAuthenticationMediumMediumLowT1110cis-m365:7.2.1, nist-800-53-r5:IA-2CISCIS.M365.7.2.2Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledExternal sharingExternal access and sharingMediumLowLowT1078.004, T1213.002cis-m365:7.2.2CISCIS.M365.7.2.3Ensure external content sharing is restrictedNew in 3.0External sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.3, nist-800-53-r5:AC-21CISCIS.M365.7.2.4Ensure OneDrive content sharing is restrictedNew in 3.0External sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.4, nist-800-53-r5:AC-21CISCIS.M365.7.2.5Ensure that SharePoint guest users cannot share items they don't ownExternal sharingExternal access and sharingMediumLowLowT1213.002, T1530cis-m365:7.2.5, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.6Ensure SharePoint external sharing is managed through domain whitelist/blacklistsNew in 3.0External sharingExternal access and sharingMediumMediumMediumT1213.002, T1530 +1cis-m365:7.2.6, nist-800-53-r5:AC-21CISCIS.M365.7.2.7Ensure link sharing is restricted in SharePoint and OneDriveSharing linksAccess controlMediumLowLowT1213.002cis-m365:7.2.7, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.8Ensure external sharing is restricted by security groupNew in 3.0External sharingExternal access and sharingMediumMediumMediumT1213.002, T1530cis-m365:7.2.8, nist-800-53-r5:AC-21CISCIS.M365.7.2.9Ensure guest access to a site or OneDrive will expire automaticallyExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.9, nist-800-53-r5:AC-2(2)CISCIS.M365.7.2.10Ensure reauthentication with verification code is restrictedNew in 3.0External sharingAuthenticationMediumLowLowT1078.004cis-m365:7.2.10, nist-800-53-r5:IA-5CISCIS.M365.7.2.11Ensure the SharePoint default sharing link permission is setSharing linksAccess controlMediumLowLowT1080, T1565.001cis-m365:7.2.11, nist-800-53-r5:AC-6CISCIS.M365.7.3.1Ensure Office 365 SharePoint infected files are disallowed for downloadAccess controlEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:7.3.1, nist-800-53-r5:SI-3CISCISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.External sharingExternal access and sharingMediumHighMediumT1048, T1213.002cisa-scuba:MS.SHAREPOINT.1.1, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.External sharingExternal access and sharingMediumHighMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.External sharingExternal access and sharingMediumMediumMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.3, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.Sharing linksAccess controlMediumLowLowT1048, T1213.002cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.Sharing linksAccess controlMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.Sharing linksExternal access and sharingMediumLowLowT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.Sharing linksExternal access and sharingMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.External sharingAuthenticationMediumLowLowT1213.002, T1530cisa-scuba:MS.SHAREPOINT.3.3, nist-800-53-r5:IA-11CISA SCuBA