Ensure SharePoint implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Finding if: the Central Administration server is in the DMZ; Central Administration can be reached from a production network without first connecting to the management VPN; or a remote desktop session to a SharePoint server can be opened from a production network without the management VPN.

How it is fixed

Fix method: Guidance or infrastructure patch

Move Central Administration servers to an isolated management network segment reachable only via the management VPN.