Office 365 ProPlus STIG Implementation Checklist (Ver 3, Rel 7)

16 items · Security · Hard difficulty · 4 hours

Implement the Office 365 ProPlus STIG: gather resources, apply policies, scan, remediate, and document.

• Gather STIG resources from DISA

  Collect STIG document, SCAP/XCCDF files, GPO packages, and Intune policies.

• Download SCAP 1.3 content

  Grab the SCAP benchmark content for automated assessments.

• Download Standalone XCCDF 1.1.4

  Obtain the XCCDF checklist for manual or tool-based checks.

• Download Intune policies (latest)

  Retrieve the published Intune policy package for Office 365 ProPlus.

• Download GPO package for Office 365 ProPlus

  Save the Group Policy Objects distributed by DISA for deployment.

• Review the STIG document and checklist details

  Read requirements, scope, exceptions, and change history before implementing.

• Identify target systems running Office 365 ProPlus

  List endpoints, user groups, and managed device types in scope.

• Inventory current Office configurations and versions

  Record build numbers, update channels, and installed Office components.

• Map STIG requirements to existing controls

  Determine which controls are already implemented and identify gaps.

• Import SCAP/XCCDF content into assessment tools

  Load benchmark content into your scanner or compliance tool.

• Run automated STIG scan and review results

  Execute scans, export findings, and prioritize by risk level.

• Apply GPOs to managed devices

  Import and link DISA GPOs to appropriate OUs in your AD environment.

• Deploy Intune policies to managed endpoints

  Publish and assign Intune configurations to device groups.

• Remediate high-risk findings

  Apply fixes, config changes, or compensating controls for critical items.

• Document configuration changes and approvals

  Record what changed, why, and who approved it for audit purposes.

• Schedule recurring reviews and update STIG resources

  Plan periodic reassessments and refresh DISA resources as they update.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.