Checklist Summary:

The IIS 10.0 Server Security Technical Implementation Guide (STIG) provides direction on performing an assessment of a server being used in a web server role using IIS 10.0 and should be used to improve the security posture of a Department of Defense (DoD) web server and its associated websites. This document is meant for use in conjunction with the Enclave, Network Infrastructure, Application Security and Development, Windows 2012 R2 Server/Windows 8.1, and other appropriate operating system STIGs. Guidance for deployment of web servers within the DoD intranet and the Demilitarized Zone (DMZ) will be governed by the appropriate Network Infrastructure STIG provided by DISA. This STIG has been developed based on the Web Server SRG, which was published as guidance to comply with applicable NIST SP 800-53 cybersecurity controls. This guidance is scoped to the Web Server role of Microsoft’s Windows Server 2016/2019/Windows 10, using IIS 10.0. While no other server role or OS will be addressed, Windows Server 2012 does include .NET Framework 4.5 by default, and this STIG requires .NET Framework 4.5 use for enabling specific security settings such as session state. There are multiple STIG packages for IIS 10.0: one for IIS 10.0 server-related requirements and one for IIS 10.0 website-related requirements. Both STIGs must be applied to an IIS 10.0 web server. The individual packages are: • IIS 10.0 Server STIG • IIS 10.0 Site STIG

Checklist Role:

• Web Server

Known Issues:

Not provided.

Target Audience:

Developed by DISA for the DoD. This document is intended for those responsible for the configuration and management of information systems. It assumes that the reader has knowledge of web servers and is familiar with common computer terminology.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoD Directive 8500.2, DoD Directive 8520.2

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Only available to DoD customers.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

updated to FINAL - 5/18/2020
updated per DISA - 8/4/2020
Updated URL per DISA - 10/28/20
updated URLs per DISA - 4/28/2021

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 04/28/2021