Checklist Summary:

The IIS 10.0 Server Security Technical Implementation Guide (STIG) provides direction on performing an assessment of a server being used in a web server role using IIS 10.0 and should be used to improve the security posture of a Department of Defense (DoD) web server and its associated websites. This document is meant for use in conjunction with the Enclave, Network Infrastructure, Application Security and Development, Windows 2012 R2 Server/Windows 8.1, and other appropriate operating system STIGs. Guidance for deployment of web servers within the DoD intranet and the Demilitarized Zone (DMZ) will be governed by the appropriate Network Infrastructure STIG provided by DISA. This STIG has been developed based on the Web Server SRG, which was published as guidance to comply with applicable NIST SP 800-53 cybersecurity controls. This guidance is scoped to the Web Server role of Microsoft’s Windows Server 2016/2019/Windows 10, using IIS 10.0. While no other server role or OS will be addressed, Windows Server 2012 does include .NET Framework 4.5 by default, and this STIG requires .NET Framework 4.5 use for enabling specific security settings such as session state. There are multiple STIG packages for IIS 10.0: one for IIS 10.0 server-related requirements and one for IIS 10.0 website-related requirements. Both STIGs must be applied to an IIS 10.0 web server. The individual packages are: • IIS 10.0 Server STIG • IIS 10.0 Site STIG

Checklist Role:

• Web Server

Known Issues:

Not provided.

Target Audience:

Developed by DISA for the DoD. This document is intended for those responsible for the configuration and management of information systems. It assumes that the reader has knowledge of web servers and is familiar with common computer terminology.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoDI 8500.01

Comments/Warnings/Miscellaneous:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Disclaimer:

Not provided.

Product Support:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DoD Certificates can obtain the STIG from https://public.cyber.mil/.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

updated to FINAL - 5/18/2020
updated per DISA - 8/4/2020
Updated URL per DISA - 10/28/20
updated URLs per DISA - 4/28/2021
updated SHA - 5/12/2021
Updated resource per DISA - 7/29/21
updated URLs - 10/27/2021
updated URLs - 1/26/2022
null
Updated resource per DISA - 10/27/22
updated URLs per DISA - 1/17/2023
Updated resource per DISA - 4/27/23

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 04/28/2023