Debug must be turned off on a production website.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-26011	WA000-WI6140 IIS7	SV-32662r2_rule		Low

Description
Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being display to users.

STIG	Date
IIS 7.0 WEB SITE STIG	2017-12-21

Details

Check Text ( C-32876r1_chk )
1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click .NET Compilation. 4. Scroll down to the Behavior section and ensure the value for Debug is set to False. If not, this is a finding. NOTE: If the .NET feature is not installed, this check is not applicable.

Fix Text (F-29027r1_fix)
1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click .NET Compilation 4. Scroll down to the Behavior section and set the value for Debug to False.