Submit consolidated change document for CISA review and approval (Iceberg Release)

[ahuynhMITRE]

💡 Summary

Several SCuBA M365 baseline policy updates and additions are in the process of being reviewed, developed, and made. As part of the new continuous baseline update process, we will have to submit a consolidated change word document which reflect any additions/revisions/deletions to the baselines.

Motivation and context

Baseline changes are necessary to keep pace with changing services and evolving guidance. The change document is also required to get CISA approval of latest baseline updates for Iceberg's release.

Implementation notes

Please provide details for implementation, such as:

• Developers review each issue for fix or enhancement against current baseline
• Perform testing necessary to validate behavior and understand settings
• Make recommendation to group for policy updates or changes
• Create updates and issue PR for review of small changes

current document is hosted at the link below on lan-a
​ SCuBA M365 Consolidated Changes Iceberg.docx

Acceptance criteria

The following changes are captured as a part of the document

• Successfully created discontinued policies template in markdown Create template markdown for discontinued policy IDs for M365 & GWS #1016
• MITRE ATT&CK mappings added to baselines Add MITRE ATT&CK TTP Mappings to M365 SCBs #937
• SPF policy items in Exchange Online baseline have been reviewed and revised Revise SPF Requirements #900
• Decouple the remaining EXO mixed Shall/Should Policies Decouple the remaining EXO mixed Shall/Should Policies #524
• Update AAD baseline references from Azure AD to Microsoft Entra ID Update AAD baseline references from Azure AD to Microsoft Entra ID #921
• Azure AD policy (MS.AAD.5.2v1) instructions need an update. Azure AD policy (MS.AAD.5.2v1) instructions need an update. #1044
• MS.EXO.16.1v1 instructions contain a circular reference with the Defender baseline MS.EXO.16.1v1 instructions contain a circular reference with the Defender baseline #565

[ahuynhMITRE]

@mitchelbaker-cisa tagging you just for awareness on where we are with the change document as well as the location of the document

[schrolla]

@ahuynhMITRE Looks like this issue is complete based on all the associated issues being closed. Ready to close this one out?

[ahuynhMITRE]

@ahuynhMITRE Looks like this issue is complete based on all the associated issues being closed. Ready to close this one out?

agree good to close!