IIS 10.0 Server STIG (Y26M01) Checklist

20 items · Security · Medium difficulty · 4 hours

STIG-based checklist to assess and harden IIS 10.0 web servers.

• Review the IIS 10.0 Server STIG documentation and supporting resources

  Download STIG packages, XCCDF, and DISA reference docs before starting.

• Inventory all IIS 10.0 servers, roles, and hosted sites

  List hostnames, OS versions, site names, app pools, and network zones.

• Backup IIS configuration and website content

  Export applicationHost.config, web.configs, and site files before changes.

• Download and install the IIS 10.0 Server STIG package

  Obtain the Server STIG XCCDF/SCC content from DISA.

• Download and install the IIS 10.0 Site STIG package

  Obtain the Site STIG XCCDF/SCC content and site-level rules.

• Apply STIG automated content (SCC/XCCDF) to assess baseline compliance

  Run automated scans to generate findings before manual hardening.

• Apply the latest Windows Server and IIS security patches

  Update OS and IIS binaries to the current security baseline.

• Install and validate server TLS/SSL certificates

  Ensure certs are trusted, not expiring, and match hostnames.

• Enforce TLS 1.2 or higher and disable older SSL/TLS protocols

  Disable SSLv2/3 and TLS 1.0/1.1 to meet STIG cryptography guidance.

• Require HTTPS and configure HTTP-to-HTTPS redirects

  Force secure transport for all site traffic and HSTS when appropriate.

• Configure application pools to run with least privilege

  Use dedicated service accounts and disable unused identities.

• Disable unnecessary IIS modules and features

  Remove or disable modules not required by applications to reduce attack surface.

• Remove default documents and disable directory browsing

  Prevent exposure of directory listings and default pages that leak info.

• Restrict file and folder permissions for IIS content

  Apply least-privilege NTFS permissions to site files and config files.

• Disable unnecessary HTTP verbs and enable request filtering

  Block TRACE, TRACK, PUT, DELETE if not required and set size limits.

• Enable detailed IIS logging and centralize logs for analysis

  Capture client IPs, request details; forward logs to SIEM or central store.

• Enable OS-level auditing and configure security event monitoring

  Audit IIS service changes, configuration edits, and privileged logins.

• Run vulnerability scans, validate STIG findings, and remediate

  Use automated tools and manual review to confirm compliance and fix issues.

• Implement firewall rules and DMZ segmentation per network guidance

  Restrict management ports and limit traffic between zones.

• Document changes, maintain STIG records, and schedule regular reviews

  Record applied controls, exceptions, and plan periodic re-assessments.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.