Title

To support the requirements and principles of least functionality; SharePoint must support the organizational requirement to provide only essential capabilities. (Cat II impact)

Discussion

Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from a single component of an information system, but doing so increases risk over limiting the services provided by any one component. Services not necessary to the SharePoint installation must not be installed on the servers in the farm.

Check Content

Verify only organizationally-approved (as documented in the site’s SSP) are installed and active in SharePoint. 1. Navigate to the Central Administration home page. 2. In the Application Management section, click Manage Service Applications. 3. From the Manage Service Applications page, view the list of active services, web parts, and applications. 4. Verify that installed services are documented in the site’s SSP. 5. Mark as a finding if active services, web parts, and applications are not documented in the SSP.

Fix Text

Follow these steps to access the management pages of a service application by using Central Administration. 1. Navigate to the Central Administration home page. 2. In the Application Management section, click Manage Service Applications. 3. From the Manage Service Applications page, select the service application to be removed. 4. Remove all services that are not needed or approved for use by the organization.

Additional Identifiers

Rule ID: SV-37768r1_rule

Vulnerability ID: V-28169

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.