To support the requirements and principles of least functionality; SharePoint must support the organizational requirement to provide only essential capabilities.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28169	SHPT-00-000475	SV-37768r1_rule	DCPP-1	Medium

Description
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from a single component of an information system, but doing so increases risk over limiting the services provided by any one component. Services not necessary to the SharePoint installation must not be installed on the servers in the farm.

Description

Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from a single component of an information system, but doing so increases risk over limiting the services provided by any one component. Services not necessary to the SharePoint installation must not be installed on the servers in the farm.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2013-10-03

Details

Check Text ( C-37496r1_chk )
Verify only organizationally-approved (as documented in the site’s SSP) are installed and active in SharePoint. 1. Navigate to the Central Administration home page. 2. In the Application Management section, click Manage Service Applications. 3. From the Manage Service Applications page, view the list of active services, web parts, and applications. 4. Verify that installed services are documented in the site’s SSP. 5. Mark as a finding if active services, web parts, and applications are not documented in the SSP.

Check Text ( C-37496r1_chk )

Verify only organizationally-approved (as documented in the site’s SSP) are installed and active in SharePoint.
1. Navigate to the Central Administration home page.
2. In the Application Management section, click Manage Service Applications.
3. From the Manage Service Applications page, view the list of active services, web parts, and applications.
4. Verify that installed services are documented in the site’s SSP.
5. Mark as a finding if active services, web parts, and applications are not documented in the SSP.

Fix Text (F-32744r1_fix)
Follow these steps to access the management pages of a service application by using Central Administration. 1. Navigate to the Central Administration home page. 2. In the Application Management section, click Manage Service Applications. 3. From the Manage Service Applications page, select the service application to be removed. 4. Remove all services that are not needed or approved for use by the organization.

Fix Text (F-32744r1_fix)

Follow these steps to access the management pages of a service application by using Central Administration.
1. Navigate to the Central Administration home page.
2. In the Application Management section, click Manage Service Applications.
3. From the Manage Service Applications page, select the service application to be removed.
4. Remove all services that are not needed or approved for use by the organization.