SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.

From MS SharePoint 2010 Security Technical Implementation Guide

Associated with: CCI-000171

SV-37767r2_rule SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.

Vulnerability discussion

Without auditing enabled, individual system accesses cannot be tracked and malicious activity cannot be detected and traced back to an individual account.

Check content

The auditing information management policy needs to be configured to available in new site and list policies. This feature makes auditing services available for auditing user actions on documents and list items to the Audit Log. Information in the Audit Log can help in determining accountability. 1. In SharePoint Central Administration, click Security. 2. On the Security page, on the Information policy list, click Configure Information Management Policy. 3. On the Information Management Policy Configuration page, select Auditing. 4. Verify the option Available for use in new site and list policies is selected. 5. Mark this as a finding if the option Available for use in new site and list policies is not set.

Fix text

Ensure the auditing information management policy is configured to be available. 1. In SharePoint Central Administration, click Security. 2. On the Security page, in the Information policy list, click Configure Information Management Policy. 3. On the Information Management Policy Configuration page, select Auditing. 4. Select the option Available for use in new site and list policies. 5. Click Save.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.