CISA.MS.EXO.9.1 - Emails SHALL be filtered by attachment file types.

Contributed by Michael Soule with Jean-Philippe GeorgeAll contributors →

Overview

Emails SHALL be filtered by attachment file types.

Rationale: Malicious attachments often take the form of click-to-run files. Sharing high risk file types, when necessary, is better left to a means other than email; the dangers of allowing them to be sent over email outweigh any potential benefits. Filtering email attachments based on file types can prevent spread of malware distributed via click-to-run email attachments.

Remediation action

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
6. Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.

Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.

Related links

• Defender admin center - Preset security policies
• Defender admin center - Order and precedence of email protection
• CISA 9 Attachment File Type - MS.EXO.9.1v2
• CISA ScubaGear Rego Reference
• Microsoft Learn - Common attachments filter in anti-malware policies

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.9.1
Severity	Medium
Suite	CISA
Product	Exchange Online
Related products	Defender
Feature	Anti-malware
Area	Email and collaboration protection
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566.001 Spearphishing Attachment, T1204.002 Malicious File
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.9.1
Criticality	SHALL
Upstream requirement	Moved to MS.SECURITYSUITE.1.1v1 (was MS.EXO.9.1v2)
Supports controls	cisa-scuba:MS.EXO.9.1, nist-800-53-r5:SI-3
PowerShell test	Test-MtCheckCISAMSEXO91
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.9.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.9.1.md