To support the requirements and principles of least functionality; SharePoint must support the organizational requirement to provide only essential capabilities.

From MS SharePoint 2010 Security Technical Implementation Guide

Associated with: CCI-000381

SV-37768r1_rule To support the requirements and principles of least functionality; SharePoint must support the organizational requirement to provide only essential capabilities.

Vulnerability discussion

Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from a single component of an information system, but doing so increases risk over limiting the services provided by any one component. Services not necessary to the SharePoint installation must not be installed on the servers in the farm.

Check content

Verify only organizationally-approved (as documented in the site’s SSP) are installed and active in SharePoint. 1. Navigate to the Central Administration home page. 2. In the Application Management section, click Manage Service Applications. 3. From the Manage Service Applications page, view the list of active services, web parts, and applications. 4. Verify that installed services are documented in the site’s SSP. 5. Mark as a finding if active services, web parts, and applications are not documented in the SSP.

Fix text

Follow these steps to access the management pages of a service application by using Central Administration. 1. Navigate to the Central Administration home page. 2. In the Application Management section, click Manage Service Applications. 3. From the Manage Service Applications page, select the service application to be removed. 4. Remove all services that are not needed or approved for use by the organization.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.