| 1.2 Ensure Single-Function Member Servers are Used | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1 Ensure 'Ad Hoc Distributed Queries' Server Configuration Option is set to '0' | CIS SQL Server 2012 Database L1 DB v1.6.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.2.5 Ensure 'REMOTE_LISTENER' Is Empty | CIS Oracle Server 18c DB Unified Auditing v1.1.0 | OracleDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.3.13 Ensure 'REMOTE_LISTENER' Is Empty | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS OracleDB | OracleDB | CONFIGURATION MANAGEMENT |
| 2.3.13 Ensure 'REMOTE_LISTENER' Is Empty | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Windows Server Host OS OracleDB | OracleDB | CONFIGURATION MANAGEMENT |
| 2.11 Ensure SQL Server is configured to use non-standard ports | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2 Ensure 'PASSWORD_LOCK_TIME' Is Greater than or Equal to '1' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 3.3 Ensure 'Orphaned Users' are Dropped From SQL Server Databases | CIS SQL Server 2012 Database L1 AWS RDS v1.6.0 | MS_SQLDB | ACCESS CONTROL |
| 3.3 Ensure 'PASSWORD_LIFE_TIME' Is Less than or Equal to '90' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 3.4 Ensure 'PASSWORD_REUSE_MAX' Is Greater than or Equal to '20' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | IDENTIFICATION AND AUTHENTICATION |
| 3.5 Ensure 'PASSWORD_REUSE_TIME' Is Greater than or Equal to '365' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | IDENTIFICATION AND AUTHENTICATION |
| 4.1.2 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_CRYPTO' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.5 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_JOB' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.6 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_LDAP' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.7 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_LOB' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.10 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_SCHEDULER' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.11 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_SQL' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.13 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_XMLQUERY' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.14 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'UTL_FILE' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.19 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'UTL_DBWS' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.1.21 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'UTL_HTTP' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.2.2 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_BACKUP_RESTORE' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.2.13 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_IJOB' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.2.14 Ensure 'EXECUTE' Is Revoked from 'PUBLIC' on 'DBMS_FILE_TRANSFER' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.3.2 Ensure 'SELECT ANY TABLE' Is Revoked from Unauthorized 'GRANTEE' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.5.2 Ensure 'ALL' Is Revoked from Unauthorized 'GRANTEE' on 'USER_HISTORY$' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | ACCESS CONTROL |
| 4.5.7 Ensure 'SYS.USER$MIG' Has Been Dropped | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.7 Ensure 'DBA_SYS_PRIVS.%' Is Revoked from Unauthorized 'GRANTEE' with 'ADMIN_OPTION' Set to 'YES' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 4.9 Ensure 'EXECUTE ANY PROCEDURE' Is Revoked from 'OUTLN' | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | |
| 5.4 Ensure 'SQL Server Audit' is set to capture both 'failed' and 'successful logins' - 'FAILED_LOGIN_GROUP' | CIS SQL Server 2012 Database L1 AWS RDS v1.6.0 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 5.10 Enable 'PUBLIC DATABASE LINK' Audit Option | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 5.14 Enable 'SELECT ANY DICTIONARY' Audit Option | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 5.16 Enable 'GRANT ANY PRIVILEGE' Audit Option | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 5.17 Enable 'DROP ANY PROCEDURE' Audit Option | CIS Oracle Server 11g R2 DB v2.2.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 6.1.17 Secure SETSESSIONUSER Privilege | CIS IBM DB2 11 v1.2.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 6.5.1 Ensure 'DBA_COL_PRIVS' Is Revoked from Unauthorized 'GRANTEE' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| CD12-00-009100 - Access to external executables must be disabled or restricted. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | CONFIGURATION MANAGEMENT |
| CD16-00-003400 - Access to external executables must be disabled or restricted. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | CONFIGURATION MANAGEMENT |
| F5BI-LT-000165 - To protect against data mining, the BIG-IP Core implementation providing content filtering must be configured to detect SQL injection attacks being launched against data storage objects, including, at a minimum, databases, database records, and database fields. | DISA F5 BIG-IP Local Traffic Manager STIG v2r4 | F5 | ACCESS CONTROL |
| PGS9-00-009100 - Access to external executables must be disabled or restricted. | DISA STIG PostgreSQL 9.x on RHEL DB v2r5 | PostgreSQLDB | CONFIGURATION MANAGEMENT |
| PPS9-00-004300 - If passwords are used for authentication, the EDB Postgres Advanced Server must store only hashed, salted representations of passwords. | EDB PostgreSQL Advanced Server DB Audit v2r3 | PostgreSQLDB | IDENTIFICATION AND AUTHENTICATION |
| SQL2-00-000500 - SQL Server must maintain and support organization-defined security labels on data in transmission. | DISA STIG SQL Server 2012 Database Audit v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-002300 - SQL Server must enforce access control policies to restrict Alter server state permissions to only authorized roles. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-004000 - SQL Server must enforce access control policies to restrict the Alter trace permission to only authorized roles. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-005600 - SQL Server must enforce access control policies to restrict the Alter resources permission to only authorized roles. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-006700 - SQL Server must enforce access control policies to restrict the Create availability group permission to only authorized roles. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-025200 - The OS must limit privileges to the SQL Server data directories and their subordinate directories and files. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| SQL4-00-016835 - SQL Server must have the Data Quality Services software component removed if it is unused. | DISA STIG SQL Server 2014 Instance DB Audit v2r4 | MS_SQLDB | CONFIGURATION MANAGEMENT |
| SQL4-00-033600 - SQL Server must produce time stamps that can be mapped to Coordinated Universal Time (UTC, formerly GMT). | DISA STIG SQL Server 2014 Instance OS Audit v2r4 | Windows | AUDIT AND ACCOUNTABILITY |
| SQL6-D0-003600 - SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
