SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28114	SHPT-00-000315	SV-37767r1_rule	ECAT-1 ECAT-2	Medium

Description
Without auditing enabled, individual system accesses cannot be tracked and malicious activity cannot be detected and traced back to an individual account.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2011-12-20

Details

Check Text ( C-37305r1_chk )
The auditing information management policy needs to be configured to available in new site and list policies. This feature makes auditing services available for auditing user actions on documents and list items to the Audit Log. Information in the Audit Log can help in determining accountability. 1. Log in to Central Administration. 2. Navigate to Operations > Security Configuration. 3. Select Information management policy configuration. 4. Select Auditing. 5. Select the Status option and verify the option "Available for use in new site and list policies" is checked. 6. Mark this as a finding if the Status option "Available for use in new site and list policies" is not set.

Check Text ( C-37305r1_chk )

The auditing information management policy needs to be configured to available in new site and list policies. This feature makes auditing services available for auditing user actions on documents and list items to the Audit Log. Information in the Audit Log can help in determining accountability.

1. Log in to Central Administration.
2. Navigate to Operations > Security Configuration.
3. Select Information management policy configuration.
4. Select Auditing.
5. Select the Status option and verify the option "Available for use in new site and list policies" is checked.
6. Mark this as a finding if the Status option "Available for use in new site and list policies" is not set.

Fix Text (F-32543r1_fix)
Ensure the auditing information management policy is configured to be available. 1. Log in to Central Administration. 2. Navigate to Operations > Security Configuration. 3. Select Information management policy configuration. 4. Select Auditing. 5. Select the Status option "Available for use in new site and list policies". 6. Select Save.