Cybersecurity and Infrastructure Security Agency Logo

Secure Cloud Business Applications (SCuBA)

Baseline Documents

Light mode

Details

SharePoint Online Baseline Report


Tenant Display NameTenant Domain NameReport DateBaseline VersionModule Version
tqhjytqhjy.onmicrosoft.com10/15/2026 21:46:53 Coordinated Universal Time12.0.0
Policy Indicators:
BOD 25-01 Requirement Required by CISA BOD 25-01
Automated Check Automatically verified by ScubaGear

SHAREPOINT-1 External Sharing

Control IDRequirementResultCriticalityDetails
MS.SHAREPOINT.1.1v1External sharing for SharePoint SHALL be limited to "Existing guests" or "Only people in your organization."
BOD 25-01 RequirementAutomated Check
FailShallRequirement not met
MS.SHAREPOINT.1.2v1External sharing for OneDrive SHALL be limited to "Existing guests" or "Only people in your organization."
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.SHAREPOINT.1.3v1External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met: Note that we currently only check for approved external domains. Approved security groups are currently not being checked, see the baseline policy for instructions on a manual check.

SHAREPOINT-2 File and Folder Default Sharing Settings

Control IDRequirementResultCriticalityDetails
MS.SHAREPOINT.2.1v1File and folder default sharing scope SHALL be set to "Specific people (only the people the user specifies)."
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.SHAREPOINT.2.2v1File and folder default sharing permissions SHALL be set to view only.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met

SHAREPOINT-3 Securing "Anyone" Links and Verification Code Users

Control IDRequirementResultCriticalityDetails
MS.SHAREPOINT.3.1v1Expiration days for "Anyone" links SHALL be set to 30 days or less.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.SHAREPOINT.3.2v1The allowable file and folder permissions for links SHALL be set to view only.
BOD 25-01 RequirementAutomated Check
FailShallRequirement not met: folders are not limited to view for Anyone
MS.SHAREPOINT.3.3v2Reauthentication days for people who use a verification code SHALL be set to 30 days or less.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met