| 1.1 Ensure Latest SQL Server Cumulative and Security Updates are Installed | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SYSTEM AND SERVICES ACQUISITION |
| 1.21 WN19-00-000210 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.21 WN19-00-000210 | CIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT II | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.39 WN19-00-000390 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II | Windows | CONFIGURATION MANAGEMENT |
| 1.115 WN19-CC-000220 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT I | Windows | CONFIGURATION MANAGEMENT |
| 1.132 WN19-CC-000390 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II | Windows | CONFIGURATION MANAGEMENT |
| 1.143 WN19-CC-000500 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT I | Windows | MAINTENANCE |
| 1.228 WN19-SO-000210 | CIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT I | Windows | CONFIGURATION MANAGEMENT |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS SQL Server 2012 Database L1 DB v1.6.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS SQL Server 2014 Database L1 DB v1.5.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS SQL Server 2017 Database L1 DB v1.3.0 | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0' | CIS SQL Server 2008 R2 DB Engine L1 v1.7.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.8 Ensure 'Scan For Startup Procs' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT |
| 2.9 Ensure 'Trustworthy' Database Property is set to 'Off' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.10 Ensure Unnecessary SQL Server Protocols are set to 'Disabled' | CIS SQL Server 2012 Database L1 OS v1.6.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.11 Ensure SQL Server is configured to use non-standard ports | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.13 Ensure the 'sa' Login Account is set to 'Disabled' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 2.14 Ensure the 'sa' Login Account has been renamed | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 2.15 Ensure 'AUTO_CLOSE' is set to 'OFF' on contained databases | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 2.16 Ensure no login exists with the name 'sa' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 2.17 Ensure 'clr strict security' Server Configuration Option is set to '1' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3 Ensure 'Orphaned Users' are Dropped From SQL Server Databases | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's Full-Text Service Account is Not an Administrator | CIS SQL Server 2008 R2 DB OS L1 v1.7.0 | Windows | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 3.8 Ensure only the default permissions specified by Microsoft are granted to the public server role | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.11 Ensure the public role in the msdb database is not granted access to SQL Agent proxies | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.13 Ensure no admin role membership in MSDB database | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 4.1 Ensure 'MUST_CHANGE' Option is set to 'ON' for All SQL Authenticated Logins | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 4.2 Ensure 'CHECK_EXPIRATION' Option is set to 'ON' for All SQL Authenticated Logins Within the Sysadmin Role | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 5.1 Ensure 'Maximum number of error log files' is set to greater than or equal to '12' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 5.2 Ensure 'Default Trace Enabled' Server Configuration Option is set to '1' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 6.1 Ensure Database and Application User Input is Sanitized | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SYSTEM AND SERVICES ACQUISITION |
| 6.2 Ensure 'CLR Assembly Permission Set' is set to 'SAFE_ACCESS' for All CLR Assemblies | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 6.4 Ensure no security groups allow ingress from ::/0 to remote server administration ports | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.18.1 Ensure 'Enable App Installer' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.1 Ensure 'Enable App Installer' is set to 'Disabled' | CIS Microsoft Windows Server 2025 Stand-alone v2.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.1 Ensure 'Enable App Installer' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| SQL4-00-037400 - Trace or Audit records must be generated when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur - Event ID 82 | DISA STIG SQL Server 2014 Database Audit v1r7 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL4-00-037400 - Trace or Audit records must be generated when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur - Event ID 91 | DISA STIG SQL Server 2014 Database Audit v1r7 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL4-00-037400 - Trace or Audit records must be generated when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur. | DISA STIG SQL Server 2014 Database Audit v1r7 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL4-00-038300 - Microsoft SQL Server products must be a version supported by the vendor. | DISA STIG SQL Server 2014 Database Audit v1r7 | MS_SQLDB | SYSTEM AND SERVICES ACQUISITION |
| SQL4-00-039200 - Microsoft SQL Server products must be a version supported by the vendor. | DISA STIG SQL Server 2014 Instance DB Audit v2r4 | MS_SQLDB | SYSTEM AND SERVICES ACQUISITION |
| SQL6-D0-017000 - Ole Automation Procedures feature must be disabled, unless specifically required and approved. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT |
| SQLI-22-018300 - Microsoft SQL Server products must be a version supported by the vendor. | DISA Microsoft SQL Server 2022 Instance STIG v1r4 MS_SQLDB | MS_SQLDB | SYSTEM AND SERVICES ACQUISITION |
| WN19-CC-000020 - Windows Server 2019 must have WDigest Authentication disabled. | DISA Microsoft Windows Server 2019 STIG v3r9 | Windows | CONFIGURATION MANAGEMENT |
