CIS SQL Server 2022 Database L1 AWS RDS v1.1.0

Audit Details

Name: CIS SQL Server 2022 Database L1 AWS RDS v1.1.0

Updated: 5/15/2024

Authority: CIS

Plugin: MS_SQLDB

Revision: 1.0

Estimated Item Count: 30

File Details

Filename: CIS_Microsoft_SQL_Server_2022_Database_v1.1.0_Level_1_AWS_RDS_Database.audit

Size: 98.9 kB

MD5: 4c33e96877569b8373d9ca66978b3657
SHA256: ff5b3694bc3c2993e607fa50f34000b55ef58bf92d667b41a6ba1bad6c12ba03

Audit Items

DescriptionCategories
1.1 Ensure Latest SQL Server Cumulative and Security Updates are Installed

SYSTEM AND SERVICES ACQUISITION

1.2 Ensure Single-Function Member Servers are Used

SYSTEM AND COMMUNICATIONS PROTECTION

2.1 Ensure 'Ad Hoc Distributed Queries' Server Configuration Option is set to '0'

SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

2.2 Ensure 'CLR Enabled' Server Configuration Option is set to '0'

CONFIGURATION MANAGEMENT

2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0'

ACCESS CONTROL, MEDIA PROTECTION

2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0'

SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

2.6 Ensure 'Remote Access' Server Configuration Option is set to '0'

SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

2.11 Ensure SQL Server is configured to use non-standard ports

SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

2.13 Ensure the 'sa' Login Account is set to 'Disabled'

ACCESS CONTROL

2.15 Ensure 'AUTO_CLOSE' is set to 'OFF' on contained databases

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

2.16 Ensure no login exists with the name 'sa'

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

2.17 Ensure 'clr strict security' Server Configuration Option is set to '1'

CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

3.2 Ensure CONNECT permissions on the 'guest' user is Revoked within all SQL Server databases

ACCESS CONTROL, MEDIA PROTECTION

3.3 Ensure 'Orphaned Users' are Dropped From SQL Server Databases

ACCESS CONTROL

3.4 Ensure SQL Authentication is not used in contained databases

ACCESS CONTROL

3.5 Ensure the SQL Server's MSSQL Service Account is Not an Administrator

ACCESS CONTROL

3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator

ACCESS CONTROL

3.7 Ensure the SQL Server's Full-Text Service Account is Not an Administrator

ACCESS CONTROL

3.8 Ensure only the default permissions specified by Microsoft are granted to the public server role

ACCESS CONTROL, MEDIA PROTECTION

3.9 Ensure Windows BUILTIN groups are not SQL Logins

ACCESS CONTROL, MEDIA PROTECTION

3.10 Ensure Windows local groups are not SQL Logins

ACCESS CONTROL, MEDIA PROTECTION

4.2 Ensure 'CHECK_EXPIRATION' Option is set to 'ON' for All SQL Authenticated Logins Within the Sysadmin Role

ACCESS CONTROL

4.3 Ensure 'CHECK_POLICY' Option is set to 'ON' for All SQL Authenticated Logins

IDENTIFICATION AND AUTHENTICATION

5.1 Ensure 'Maximum number of error log files' is set to greater than or equal to '12'

AUDIT AND ACCOUNTABILITY

5.2 Ensure 'Default Trace Enabled' Server Configuration Option is set to '1'

AUDIT AND ACCOUNTABILITY

5.3 Ensure 'Login Auditing' is set to 'failed logins'

AUDIT AND ACCOUNTABILITY

5.4 Ensure 'SQL Server Audit' is set to capture both 'failed' and 'successful logins'

AUDIT AND ACCOUNTABILITY

6.2 Ensure 'CLR Assembly Permission Set' is set to 'SAFE_ACCESS' for All CLR Assemblies

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

7.1 Ensure 'Symmetric Key encryption algorithm' is set to 'AES_128' or higher in non-system databases

ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

7.2 Ensure Asymmetric Key Size is set to 'greater than or equal to 2048' in non-system databases

ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION