SQLI-22-003600 - SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

CAT|II

CCI|CCI-000054

Rule-ID|SV-271263r1108405_rule

STIG-ID|SQLI-22-003600

Vuln-ID|V-271263

SQLI-22-003700 - SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-271265r1108933_rule

STIG-ID|SQLI-22-003700

Vuln-ID|V-271265

SQLI-22-003800 - SQL Server must be configured to use the most-secure authentication method available.

Rule-ID|SV-271264r1111061_rule

STIG-ID|SQLI-22-003800

Vuln-ID|V-271264

SQLI-22-003900 - SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

CCI|CCI-000213

Rule-ID|SV-271266r1137654_rule

STIG-ID|SQLI-22-003900

Vuln-ID|V-271266

SQLI-22-004000 - SQL Server must protect against a user falsely repudiating by ensuring all accounts are individual, unique, and not shared.

CCI|CCI-000166

CCI|CCI-004045

Rule-ID|SV-271269r1108423_rule

STIG-ID|SQLI-22-004000

Vuln-ID|V-271269

SQLI-22-004100 - SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.

Rule-ID|SV-271268r1136917_rule

STIG-ID|SQLI-22-004100

Vuln-ID|V-271268

SQLI-22-004200 - SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.

Rule-ID|SV-271267r1108417_rule

STIG-ID|SQLI-22-004200

Vuln-ID|V-271267

SQLI-22-004250 - SQL Server must protect against a user falsely repudiating by ensuring that only clearly unique Active Directory user accounts can connect to the database.

Rule-ID|SV-274453r1109109_rule

STIG-ID|SQLI-22-004250

Vuln-ID|V-274453

SQLI-22-004300 - SQL Server must be configured to generate audit records for DOD-defined auditable events within all DBMS/database components.

CCI|CCI-000169

Rule-ID|SV-271270r1108426_rule

STIG-ID|SQLI-22-004300

Vuln-ID|V-271270

SQLI-22-004400 - SQL Server must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

CCI|CCI-000171

Rule-ID|SV-271271r1108429_rule

STIG-ID|SQLI-22-004400

Vuln-ID|V-271271

SQLI-22-004600 - SQL Server must generate audit records when attempts to access privileges, categorized information, and security objects occur.

CCI|CCI-000172

Rule-ID|SV-271272r1109110_rule

STIG-ID|SQLI-22-004600

Vuln-ID|V-271272

SQLI-22-004700 - SQL Server must initiate session auditing upon startup.

CCI|CCI-001464

Rule-ID|SV-271273r1109234_rule

STIG-ID|SQLI-22-004700

Vuln-ID|V-271273

SQLI-22-005500 - SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

CCI|CCI-000135

Rule-ID|SV-271280r1108456_rule

STIG-ID|SQLI-22-005500

Vuln-ID|V-271280

SQLI-22-005900 - The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-271282r1109273_rule

STIG-ID|SQLI-22-005900

Vuln-ID|V-271282

SQLI-22-006300 - SQL Server must protect its audit configuration from authorized and unauthorized access and modification.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-271283r1108465_rule

STIG-ID|SQLI-22-006300

Vuln-ID|V-271283

SQLI-22-006500 - SQL Server must limit privileges to change software modules and links to software external to SQL Server.

CCI|CCI-001499

Rule-ID|SV-271285r1109236_rule

STIG-ID|SQLI-22-006500

Vuln-ID|V-271285

SQLI-22-006600 - SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.

Rule-ID|SV-271284r1109111_rule

STIG-ID|SQLI-22-006600

Vuln-ID|V-271284

SQLI-22-006700 - SQL Server software installation account must be restricted to authorized users.

Rule-ID|SV-271286r1108474_rule

STIG-ID|SQLI-22-006700

Vuln-ID|V-271286

SQLI-22-006800 - Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-271287r1108843_rule

STIG-ID|SQLI-22-006800

Vuln-ID|V-271287

SQLI-22-006900 - Default demonstration and sample databases, database objects, and applications must be removed.

CCI|CCI-000381

Rule-ID|SV-271290r1109112_rule

STIG-ID|SQLI-22-006900

Vuln-ID|V-271290

SQLI-22-007000 - Unused database components, DBMS software, and database objects must be removed.

Rule-ID|SV-271291r1108899_rule

STIG-ID|SQLI-22-007000

Vuln-ID|V-271291

SQLI-22-007200 - Access to xp_cmdshell must be disabled unless specifically required and approved.

Rule-ID|SV-271302r1109113_rule

STIG-ID|SQLI-22-007200

Vuln-ID|V-271302

SQLI-22-007300 - Access to common language runtime (CLR) code must be disabled or restricted unless specifically required and approved.

Rule-ID|SV-271301r1109114_rule

STIG-ID|SQLI-22-007300

Vuln-ID|V-271301

SQLI-22-007400 - Access to nonstandard, extended stored procedures must be disabled or restricted, unless specifically required and approved.

Rule-ID|SV-271300r1109264_rule

STIG-ID|SQLI-22-007400

Vuln-ID|V-271300

SQLI-22-007500 - Access to linked servers must be disabled or restricted, unless specifically required and approved.

Rule-ID|SV-271299r1108513_rule

STIG-ID|SQLI-22-007500

Vuln-ID|V-271299

SQLI-22-007600 - SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-271304r1109265_rule

STIG-ID|SQLI-22-007600

Vuln-ID|V-271304

SQLI-22-007700 - SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

Rule-ID|SV-271303r1109116_rule

STIG-ID|SQLI-22-007700

Vuln-ID|V-271303

SQLI-22-007800 - SQL Server must uniquely identify and authenticate users (or processes acting on behalf of organizational users).

CCI|CCI-000764

CCI|CCI-000804

Rule-ID|SV-271305r1109239_rule

STIG-ID|SQLI-22-007800

Vuln-ID|V-271305

SQLI-22-007900 - If DBMS authentication using passwords is employed, SQL Server must enforce the DOD standards for password complexity and lifetime.

CCI|CCI-003627

CCI|CCI-004066

Rule-ID|SV-271307r1109241_rule

STIG-ID|SQLI-22-007900

Vuln-ID|V-271307

SQLI-22-008000 - Contained databases must use Windows principals.

Rule-ID|SV-271306r1109119_rule

STIG-ID|SQLI-22-008000

Vuln-ID|V-271306

SQLI-22-008200 - If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-271309r1109243_rule

STIG-ID|SQLI-22-008200

Vuln-ID|V-271309

SQLI-22-009500 - SQL Server must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-271324r1109248_rule

STIG-ID|SQLI-22-009500

Vuln-ID|V-271324

SQLI-22-009600 - The Service Master Key must be backed up and stored in a secure location that is not on the SQL Server.

Rule-ID|SV-271323r1108585_rule

STIG-ID|SQLI-22-009600

Vuln-ID|V-271323

SQLI-22-009700 - The Master Key must be backed up and stored in a secure location that is not on the SQL Server.

Rule-ID|SV-271322r1108582_rule

STIG-ID|SQLI-22-009700

Vuln-ID|V-271322

SQLI-22-009800 - SQL Server must prevent unauthorized and unintended information transfer via shared system resources.

CCI|CCI-001090

Rule-ID|SV-271328r1137657_rule

STIG-ID|SQLI-22-009800

Vuln-ID|V-271328

SQLI-22-009900 - SQL Server must prevent unauthorized and unintended information transfer via Instant File Initialization (IFI).

Rule-ID|SV-271327r1137657_rule

STIG-ID|SQLI-22-009900

Vuln-ID|V-271327

SQLI-22-010000 - Access to database files must be limited to relevant processes and to authorized, administrative users.

Rule-ID|SV-271329r1137658_rule

STIG-ID|SQLI-22-010000

Vuln-ID|V-271329

SQLI-22-010010 - SQL Server and associated applications must reserve the use of dynamic code execution for situations that require it.

CCI|CCI-001310

Rule-ID|SV-271331r1108609_rule

STIG-ID|SQLI-22-010010

Vuln-ID|V-271331

SQLI-22-010020 - SQL Server and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.

Rule-ID|SV-271332r1108612_rule

STIG-ID|SQLI-22-010020

Vuln-ID|V-271332

SQLI-22-010100 - SQL Server must reveal detailed error messages only to documented and approved individuals or roles.

CCI|CCI-001314

Rule-ID|SV-271334r1109125_rule

STIG-ID|SQLI-22-010100

Vuln-ID|V-271334

SQLI-22-010400 - SQL Server must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

CCI|CCI-002235

Rule-ID|SV-271341r1111081_rule

STIG-ID|SQLI-22-010400

Vuln-ID|V-271341

SQLI-22-010500 - Use of credentials and proxies must be restricted to necessary cases only.

CCI|CCI-002233

Rule-ID|SV-271342r1108642_rule

STIG-ID|SQLI-22-010500

Vuln-ID|V-271342

SQLI-22-010900 - SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

Detections

Analytics

DISA Microsoft SQL Server 2022 Instance STIG v1r3 MS_SQLDB

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous