Skip to content
MitoMito Docs

CISA.MS.EXO.10.2: Emails identified as containing malware SHALL be quarantined or dropped.
ID CISA.MS.EXO.10.2
Severity High
Suite CISA SCuBA baselines
Product Exchange Online
Related products Defender
Feature Anti-malware
Security area Email and collaboration protection
Resource type Policy
User impact of fixing Low
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.10.2 (SHALL)
Framework controls cisa-scuba:MS.EXO.10.2
nist-800-53-r5:SI-3 Malicious Code Protection
MITRE ATT&CK T1204.002, T1566.001
Reads from Exchange Online, Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Emails identified as containing malware SHALL be quarantined or dropped.

Rationale: Email can be used as a mechanism for delivering malware. Preventing emails with known malware from reaching user mailboxes helps ensure users cannot interact with those emails.

Remediation action

Section titled “Remediation action”
  1. Sign in to Microsoft 365 Defender.
  2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
  3. Select Threat Policies.
  4. From the Templated policies section, select Preset Security Policies.
  5. Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
  6. Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.

Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.

Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: JeanPhilippeGeorge. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.