DISA_STIG_MSSQL_2014_Instance-OS_v2r3.audit from DISA MS SQL Server 2014 Instance v2r3 STIG

SQL4-00-014000 - SQL Server and/or the operating system must protect its audit configuration from unauthorized modification.

800-53|AU-9

CAT|II

CCI|CCI-001494

Rule-ID|SV-213824r395832_rule

STIG-ID|SQL4-00-014000

STIG-Legacy|SV-82293

STIG-Legacy|V-67803

Vuln-ID|V-213824

SQL4-00-014100 - SQL Server and the operating system must protect SQL Server audit features from unauthorized removal.

CCI|CCI-001495

Rule-ID|SV-213825r395835_rule

STIG-ID|SQL4-00-014100

STIG-Legacy|SV-82295

STIG-Legacy|V-67805

Vuln-ID|V-213825

SQL4-00-015350 - Software, applications, and configuration files that are part of, or related to, the SQL Server  installation must be monitored to discover unauthorized changes.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-213827r395850_rule

STIG-ID|SQL4-00-015350

STIG-Legacy|SV-82297

STIG-Legacy|V-67807

Vuln-ID|V-213827

SQL4-00-015400 - SQL Server software installation account(s) must be restricted to authorized users.

Rule-ID|SV-213828r395850_rule

STIG-ID|SQL4-00-015400

STIG-Legacy|SV-82301

STIG-Legacy|V-67811

Vuln-ID|V-213828

SQL4-00-015500 - Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

CAT|III

Rule-ID|SV-213829r395850_rule

STIG-ID|SQL4-00-015500

STIG-Legacy|SV-82303

STIG-Legacy|V-67813

Vuln-ID|V-213829

SQL4-00-016500 - SQL Server must have the SQL Server Data Tools (SSDT) software component removed if it is unused.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-213833r395853_rule

STIG-ID|SQL4-00-016500

STIG-Legacy|SV-82313

STIG-Legacy|V-67823

Vuln-ID|V-213833

SQL4-00-016600 - SQL Server must have the SQL Server Reporting Services (SSRS) software component removed if it is unused.

Rule-ID|SV-213834r395853_rule

STIG-ID|SQL4-00-016600

STIG-Legacy|SV-82315

STIG-Legacy|V-67825

Vuln-ID|V-213834

SQL4-00-016700 - SQL Server must have the SQL Server Integration Services (SSIS) software component removed if it is unused.

Rule-ID|SV-213835r395853_rule

STIG-ID|SQL4-00-016700

STIG-Legacy|SV-82317

STIG-Legacy|V-67827

Vuln-ID|V-213835

SQL4-00-016800 - SQL Server must have the SQL Server Analysis Services (SSAS) software component removed if it is unused.

Rule-ID|SV-213836r395853_rule

STIG-ID|SQL4-00-016800

STIG-Legacy|SV-82319

STIG-Legacy|V-67829

Vuln-ID|V-213836

SQL4-00-016805 - SQL Server must have the SQL Server Distributed Replay Client software component removed if it is unused.

Rule-ID|SV-213837r395853_rule

STIG-ID|SQL4-00-016805

STIG-Legacy|SV-82321

STIG-Legacy|V-67831

Vuln-ID|V-213837

SQL4-00-016810 - SQL Server must have the SQL Server Distributed Replay Controller software component removed if it is unused.

Rule-ID|SV-213838r395853_rule

STIG-ID|SQL4-00-016810

STIG-Legacy|SV-82323

STIG-Legacy|V-67833

Vuln-ID|V-213838

SQL4-00-016815 - SQL Server must have the Full-Text Search software component removed if it is unused.

Rule-ID|SV-213839r395853_rule

STIG-ID|SQL4-00-016815

STIG-Legacy|SV-82325

STIG-Legacy|V-67835

Vuln-ID|V-213839

SQL4-00-016820 - SQL Server must have the Master Data Services software component removed if it is unused.

Rule-ID|SV-213840r395853_rule

STIG-ID|SQL4-00-016820

STIG-Legacy|SV-82327

STIG-Legacy|V-67837

Vuln-ID|V-213840

SQL4-00-016826 - SQL Server must have the SQL Server Replication software component removed if it is unused.

Rule-ID|SV-213841r395853_rule

STIG-ID|SQL4-00-016826

STIG-Legacy|SV-82329

STIG-Legacy|V-67839

Vuln-ID|V-213841

SQL4-00-016830 - SQL Server must have the Data Quality Client software component removed if it is unused.

Rule-ID|SV-213842r395853_rule

STIG-ID|SQL4-00-016830

STIG-Legacy|SV-82331

STIG-Legacy|V-67841

Vuln-ID|V-213842

SQL4-00-016845 - SQL Server must have the Client Tools SDK software component removed if it is unused.

Rule-ID|SV-213844r395853_rule

STIG-ID|SQL4-00-016845

STIG-Legacy|SV-82335

STIG-Legacy|V-67845

Vuln-ID|V-213844

SQL4-00-016850 - SQL Server must have the Management Tools software component removed if it is unused.

Rule-ID|SV-213845r395853_rule

STIG-ID|SQL4-00-016850

STIG-Legacy|SV-82337

STIG-Legacy|V-67847

Vuln-ID|V-213845

SQL4-00-031100 - SQL Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

800-53|IA-7

800-53|SC-13

CAT|I

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-213862r863333_rule

STIG-ID|SQL4-00-031100

STIG-Legacy|SV-82361

STIG-Legacy|V-67871

Vuln-ID|V-213862

SQL4-00-033600 - SQL Server must produce time stamps that can be mapped to Coordinated Universal Time (UTC, formerly GMT).

800-53|AU-8b.

CCI|CCI-001890

Rule-ID|SV-213871r855543_rule

STIG-ID|SQL4-00-033600

STIG-Legacy|SV-82387

STIG-Legacy|V-67897

Vuln-ID|V-213871

SQL4-00-034200 - SQL Server must disable communication protocols not required for operation.

800-53|CM-7(1)(b)

CCI|CCI-001762

Rule-ID|SV-213875r855547_rule

STIG-ID|SQL4-00-034200

STIG-Legacy|SV-82395

STIG-Legacy|V-67905

Vuln-ID|V-213875

SQL4-00-034800 - SQL Server must implement and/or support cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.

800-53|SC-28(1)

CCI|CCI-002476

Rule-ID|SV-213876r855548_rule

STIG-ID|SQL4-00-034800

STIG-Legacy|SV-82397

STIG-Legacy|V-67907

Vuln-ID|V-213876

SQL4-00-035400 - Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).

800-53|SI-2c.

CCI|CCI-002605

Rule-ID|SV-213879r855551_rule

STIG-ID|SQL4-00-035400

STIG-Legacy|SV-82403

STIG-Legacy|V-67913

Vuln-ID|V-213879

SQL4-00-039100 - The SQL Server Browser service must be disabled if its use is not necessary..

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-213898r401224_rule

STIG-ID|SQL4-00-039100

STIG-Legacy|SV-85245

STIG-Legacy|V-70623

Vuln-ID|V-213898

Detections

Analytics

Revision 1.3

Oct 6, 2023

Functional Update

Informational Update

Miscellaneous