Microsoft IIS 10.0 Server STIG Checklist

21 items · Security · Hard difficulty · 2 hours

Essential STIG tasks to secure IIS 10.0 web servers.

• Download the IIS 10.0 Server STIG and supporting resources

  Obtain DISA XCCDF, SCC content, and STIG PDF for reference and automated scans.

• Inventory IIS servers and installed versions

  Record hostnames, OS versions, IIS build, and site roles.

• Verify .NET Framework 4.5 or later is installed where required

  Needed for specific security settings like session state.

• Apply both IIS 10.0 Server and IIS 10.0 Site STIG packages

  Ensure server- and site-level STIGs are both enforced.

• Run automated SCAP/XCCDF or SCC scans with DISA content

  Use provided automated content to generate findings.

• Review scan findings and create a remediation plan

  Prioritize fixes by severity and mission impact.

• Harden IIS by disabling unnecessary modules and features

  Reduce attack surface by removing unused components.

• Disable WebDAV module

  Prevent remote write access unless explicitly needed.

• Disable TRACE and TRACK HTTP methods

  Block methods that can expose sensitive headers.

• Remove default sample files and sample applications

  Delete example content to avoid information exposure.

• Enforce TLS 1.2 or higher and disable weak ciphers

  Configure Schannel/registry or IIS bindings to use strong ciphers.

• Configure authentication and authorization settings

  Choose the least-privilege auth methods required by the app.

• Set secure cookie and session state settings in .NET/IIS

  Enable HttpOnly, Secure flags and appropriate timeout values.

• Apply least privilege to IIS service and application pool accounts

  Use dedicated low-privilege accounts for app pools.

• Enable detailed IIS logging and forward logs to a SIEM

  Capture access, error logs and centralize for monitoring.

• Implement strict file and directory permissions for web content

  Grant only required read/write rights to content folders.

• Disable directory browsing on sites

  Prevent listing of directory contents to visitors.

• Validate web applications for OWASP Top 10 vulnerabilities

  Use scanners or manual testing to find common flaws.

• Patch and update Windows Server and IIS components regularly

  Apply security updates and test before production rollout.

• Schedule regular STIG scans and compliance audits

  Set recurring scans and track remediation status.

• Document IIS configuration and maintain change control records

  Record STIG versions, change tickets, and baselines.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.