Does the United States Government Configuration Baseline allow for IIS Express installations as part of a software install (self-contained in the user's home account)?

Is there a waiver process?

  • Perhaps you should ask your manager.
    – rook
    Dec 17 '13 at 0:55

Respectfully disagree that policy discussions are offtopic for Information Security. Good information security starts with good information security policies.

IIS is a prohibited install on workstations under USGCB. This would suggest that any waiver must be based on a business case and approved by your agency's Designated Approval Authority as part of the Authority to Operate for your Major Application or General Support System.

Refer to your agency's security policy documentation and the NIST website.

  • good on you for answering, I take back my earlier comment
    – roo2
    Dec 17 '13 at 3:20
  • I appreciate the input. As a contractor my visibility into the agency I'm providing services for is limited by the knowledge and openness of the ISSO I'm working with, plus intermediaries between myself and the actual knowledge source. Dec 17 '13 at 14:15
  • My sincere sympathies.
    – user35648
    Dec 17 '13 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.