SQL6-D0-000100 - SQL Server databases must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-2(1)

CAT|I

CCI|CCI-000015

Rule-ID|SV-213900r1043176_rule

STIG-ID|SQL6-D0-000100

STIG-Legacy|SV-93767

STIG-Legacy|V-79061

Vuln-ID|V-213900

SQL6-D0-000300 - SQL Server must enforce approved authorizations for logical access to database information and system resources in accordance with applicable access control policies.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-213901r1112497_rule

STIG-ID|SQL6-D0-000300

STIG-Legacy|SV-93771

STIG-Legacy|V-79065

Vuln-ID|V-213901

SQL6-D0-000400 - SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the database.

800-53|AU-10

CAT|II

CCI|CCI-000166

Rule-ID|SV-213902r960864_rule

STIG-ID|SQL6-D0-000400

STIG-Legacy|SV-93773

STIG-Legacy|V-79067

Vuln-ID|V-213902

SQL6-D0-000500 - SQL Server must protect against a user falsely repudiating by use of system-versioned tables (Temporal Tables).

CAT|III

Rule-ID|SV-213903r960864_rule

STIG-ID|SQL6-D0-000500

STIG-Legacy|SV-93775

STIG-Legacy|V-79069

Vuln-ID|V-213903

SQL6-D0-000600 - SQL Server must protect against a user falsely repudiating by ensuring databases are not in a trust relationship.

Rule-ID|SV-213904r960864_rule

STIG-ID|SQL6-D0-000600

STIG-Legacy|SV-93777

STIG-Legacy|V-79071

Vuln-ID|V-213904

SQL6-D0-000700 - SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-213905r960882_rule

STIG-ID|SQL6-D0-000700

STIG-Legacy|SV-93779

STIG-Legacy|V-79073

Vuln-ID|V-213905

SQL6-D0-001100 - SQL Server must limit privileges to change software modules, to include stored procedures, functions, and triggers.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-213906r960960_rule

STIG-ID|SQL6-D0-001100

STIG-Legacy|SV-93781

STIG-Legacy|V-79075

Vuln-ID|V-213906

SQL6-D0-001200 - SQL Server must limit privileges to change software modules, to include stored procedures, functions, and triggers, and links to software external to SQL Server.

Rule-ID|SV-213907r960960_rule

STIG-ID|SQL6-D0-001200

STIG-Legacy|SV-93783

STIG-Legacy|V-79077

Vuln-ID|V-213907

SQL6-D0-001300 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.

Rule-ID|SV-213908r960960_rule

STIG-ID|SQL6-D0-001300

STIG-Legacy|SV-93785

STIG-Legacy|V-79079

Vuln-ID|V-213908

SQL6-D0-001400 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.

Rule-ID|SV-213909r960960_rule

STIG-ID|SQL6-D0-001400

STIG-Legacy|SV-93787

STIG-Legacy|V-79081

Vuln-ID|V-213909

SQL6-D0-001500 - In the event of a system failure, hardware loss or disk failure, SQL Server must be able to restore necessary databases with least disruption to mission processes.

800-53|SC-24

CCI|CCI-001665

Rule-ID|SV-213910r961125_rule

STIG-ID|SQL6-D0-001500

STIG-Legacy|SV-93789

STIG-Legacy|V-79083

Vuln-ID|V-213910

SQL6-D0-001600 - The Database Master Key encryption password must meet DOD password complexity requirements.

800-53|SC-28

CCI|CCI-001199

Rule-ID|SV-213911r961128_rule

STIG-ID|SQL6-D0-001600

STIG-Legacy|SV-93791

STIG-Legacy|V-79085

Vuln-ID|V-213911

SQL6-D0-001700 - The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.

Rule-ID|SV-213912r961128_rule

STIG-ID|SQL6-D0-001700

STIG-Legacy|SV-93793

STIG-Legacy|V-79087

Vuln-ID|V-213912

SQL6-D0-001800 - The Certificate used for encryption must be backed up and stored in a secure location that is not on the SQL Server.

Rule-ID|SV-213913r961128_rule

STIG-ID|SQL6-D0-001800

STIG-Legacy|SV-93795

STIG-Legacy|V-79089

Vuln-ID|V-213913

SQL6-D0-001900 - SQL Server must isolate security functions from non-security functions.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-213914r961131_rule

STIG-ID|SQL6-D0-001900

STIG-Legacy|SV-93797

STIG-Legacy|V-79091

Vuln-ID|V-213914

SQL6-D0-002000 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-213915r961149_rule

STIG-ID|SQL6-D0-002000

STIG-Legacy|SV-93799

STIG-Legacy|V-79093

Vuln-ID|V-213915

SQL6-D0-002100 - SQL Server must check the validity of all data inputs except those specifically identified by the organization.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-213916r961158_rule

STIG-ID|SQL6-D0-002100

STIG-Legacy|SV-93801

STIG-Legacy|V-79095

Vuln-ID|V-213916

SQL6-D0-002400 - SQL Server must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-213917r961167_rule

STIG-ID|SQL6-D0-002400

STIG-Legacy|SV-93803

STIG-Legacy|V-79097

Vuln-ID|V-213917

SQL6-D0-002500 - SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.

800-53|AC-16a.

CCI|CCI-002262

Rule-ID|SV-213918r961269_rule

STIG-ID|SQL6-D0-002500

STIG-Legacy|SV-93805

STIG-Legacy|V-79099

Vuln-ID|V-213918

SQL6-D0-002600 - SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.

CCI|CCI-002263

Rule-ID|SV-213919r961272_rule

STIG-ID|SQL6-D0-002600

STIG-Legacy|SV-93807

STIG-Legacy|V-79101

Vuln-ID|V-213919

SQL6-D0-002700 - SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.

CCI|CCI-002264

Rule-ID|SV-213920r961275_rule

STIG-ID|SQL6-D0-002700

STIG-Legacy|SV-93809

STIG-Legacy|V-79103

Vuln-ID|V-213920

SQL6-D0-002800 - SQL Server must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

800-53|AC-3(4)

CCI|CCI-002165

Rule-ID|SV-213921r961317_rule

STIG-ID|SQL6-D0-002800

STIG-Legacy|SV-93811

STIG-Legacy|V-79105

Vuln-ID|V-213921

SQL6-D0-002900 - Execution of stored procedures and functions that utilize execute as must be restricted to necessary cases only.

800-53|AC-6(8)

CCI|CCI-002233

Rule-ID|SV-213922r961359_rule

STIG-ID|SQL6-D0-002900

STIG-Legacy|SV-93813

STIG-Legacy|V-79107

Vuln-ID|V-213922

SQL6-D0-003000 - SQL Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

800-53|CM-11(2)

CCI|CCI-001812

CCI|CCI-003980

Rule-ID|SV-213923r1018608_rule

STIG-ID|SQL6-D0-003000

STIG-Legacy|SV-93815

STIG-Legacy|V-79109

Vuln-ID|V-213923

SQL6-D0-003100 - SQL Server must enforce access restrictions associated with changes to the configuration of the database(s).

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-213924r961461_rule

STIG-ID|SQL6-D0-003100

STIG-Legacy|SV-93817

STIG-Legacy|V-79111

Vuln-ID|V-213924

SQL6-D0-003200 - SQL Server must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-251040r962034_rule

STIG-ID|SQL6-D0-003200

STIG-Legacy|SV-93819

STIG-Legacy|V-79113

Vuln-ID|V-251040

SQL6-D0-003300 - SQL Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

800-53|SC-28(1)

CCI|CCI-002475

Rule-ID|SV-213926r1018576_rule

STIG-ID|SQL6-D0-003300

Detections

Analytics

DISA MS SQL Server 2016 Database STIG v3r3

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous