MS.DEFENDER.1.1v1 - The standard and strict preset security policies SHALL be enabled.

800-53|AC-4

800-53|CA-7

800-53|CM-2

800-53|CM-6

800-53|IA-9

800-53|SC-7

800-53|SC-20

800-53|SC-44

800-53|SI-2

800-53|SI-3

800-53|SI-4

800-53|SI-8

MS.DEFENDER.1.2v1 - All users SHALL be added to Exchange Online Protection (EOP) in either the standard or strict preset security policy.

MS.DEFENDER.1.3v1 - All users SHALL be added to Defender for Office 365 protection in either the standard or strict preset security policy.

MS.DEFENDER.1.4v1 - Sensitive accounts SHALL be added to Exchange Online Protection in the strict preset security policy.

MS.DEFENDER.1.5v1 - Sensitive accounts SHALL be added to Defender for Office 365 protection in the strict preset security policy.

MS.DEFENDER.2.1v1 - User impersonation protection SHOULD be enabled for sensitive accounts in both the standard and strict preset policies.

MS.DEFENDER.2.2v1 - Domain impersonation protection SHOULD be enabled for domains owned by the agency in both the standard and strict preset policies.

MS.DEFENDER.2.3v1 - Domain impersonation protection SHOULD be added for important partners in both the standard and strict preset policies.

MS.DEFENDER.3.1v1 - Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams.

800-53|CM-7

800-53|SI-7

800-53|SI-10

MS.DEFENDER.4.1v2 - A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency. At a minimum, credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) SHALL be blocked.

800-53|AC-2

800-53|AC-3

800-53|AC-5

800-53|AC-6

800-53|AC-7

800-53|AC-16

800-53|AC-17

800-53|AC-18

800-53|AC-19

800-53|AC-20

800-53|AC-21

800-53|AC-23

800-53|CA-3

800-53|CA-8

800-53|CM-3

800-53|CM-5

800-53|CM-8

800-53|IA-2

800-53|IA-3

800-53|IA-4

800-53|IA-5

800-53|IA-6

800-53|IA-8

800-53|RA-5

800-53|SA-8

800-53|SA-9

800-53|SC-4

800-53|SC-28

800-53|SC-31

800-53|SI-12

800-53|SI-15

MS.DEFENDER.4.2v1 - The custom policy SHOULD be applied to Exchange, OneDrive, SharePoint, Teams chat, and Devices.

MS.DEFENDER.4.3v1 - The action for the custom policy SHOULD be set to block sharing sensitive information with everyone.

MS.DEFENDER.4.4v1 - Notifications to inform users and help educate them on the proper use of sensitive information SHOULD be enabled in the custom policy.

800-53|CM-6b.

MS.DEFENDER.4.5v1 - A list of apps that are restricted from accessing files protected by DLP policy SHOULD be defined.

800-53|CP-2

800-53|CP-6

800-53|CP-7

800-53|CP-9

800-53|CP-10

800-53|SC-36

800-53|SI-16

MS.DEFENDER.4.6v1 - The custom policy SHOULD include an action to block access to sensitive

MS.DEFENDER.5.1v1 - At a minimum, the alerts required by the CISA M365 Security Configuration Baseline for Exchange Online SHALL be enabled.

800-53|CM-10

800-53|SC-8

800-53|SC-23

MS.DEFENDER.5.2v1 - The alerts SHOULD be sent to a monitored address or incorporated into a Security Information and Event Management (SIEM).

MS.DEFENDER.6.1v1 - Microsoft Purview Audit (Standard) logging SHALL be enabled.

MS.DEFENDER.6.2v1 - Microsoft Purview Audit (Premium) logging SHALL be enabled for ALL users.

MS.DEFENDER.6.3v1 - Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31.

Detections

Analytics

CISA SCuBA Microsoft 365 Defender v1.5.0

Audit Details

File Details

Audit Changelog

No revisions found