| 1.1 Ensure Latest SQL Server Service Packs and Hotfixes are Installed | CIS SQL Server 2012 Database L1 AWS RDS v1.6.0 | MS_SQLDB | CONFIGURATION MANAGEMENT |
| 1.1 Ensure Latest SQL Server Service Packs and Hotfixes are Installed | CIS SQL Server 2014 Database L1 AWS RDS v1.5.0 | MS_SQLDB | CONFIGURATION MANAGEMENT |
| 1.60 SQLI-22-016000 | CIS Microsoft SQL Server 2022 Instance STIG v1.0.0 CAT II Windows | Windows | CONFIGURATION MANAGEMENT |
| 1.63 SQLI-22-016300 | CIS Microsoft SQL Server 2022 Instance STIG v1.0.0 CAT II MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT |
| 2.3.5 Ensure 'OS_ROLES' Is Set To 'FALSE' | CIS Oracle Database 19c v2.0.0 L1 RDBMS | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.6 Ensure 'OS_ROLES' Is Set To 'FALSE' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.8 Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is Set To '3' Or Less | CIS Oracle Database 26ai v1.0.0 L1 RDBMS | OracleDB | ACCESS CONTROL |
| 2.3.8 Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is Set To '3' Or Less | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Windows Server Host OS OracleDB | OracleDB | ACCESS CONTROL |
| 2.3.8 Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is Set To '3' Or Less | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS OracleDB | OracleDB | ACCESS CONTROL |
| 2.3.10 Ensure 'SEC_RETURN_SERVER_RELEASE_BANNER' Is Set To 'FALSE' | CIS Oracle Database 19c v2.0.0 L1 RDBMS | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.11 Ensure 'SEC_RETURN_SERVER_RELEASE_BANNER' Is Set To 'FALSE' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS OracleDB | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.11 Ensure 'SEC_RETURN_SERVER_RELEASE_BANNER' Is Set To 'FALSE' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Windows Server Host OS OracleDB | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.10 Ensure Unnecessary SQL Server Protocols are set to 'Disabled' - 'Shared Memory protocol is disabled' | CIS SQL Server 2014 Database L1 OS v1.5.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.10 Ensure Unnecessary SQL Server Protocols are set to 'Disabled' - 'TCP/IP protocol is disabled' | CIS SQL Server 2014 Database L1 OS v1.5.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.10 Ensure Unnecessary SQL Server Protocols are set to 'Disabled' - 'VIA protocol is disabled' | CIS SQL Server 2014 Database L1 OS v1.5.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.11 Ensure Unnecessary SQL Server Protocols are set to 'Disabled' - 'TCP/IP protocol is disabled' | CIS SQL Server 2008 R2 DB OS L1 v1.7.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.11 Ensure Unnecessary SQL Server Protocols are set to 'Disabled' - 'VIA protocol is disabled' | CIS SQL Server 2008 R2 DB OS L1 v1.7.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 3.1.22 Ensure 'log_line_prefix' is set correctly | CIS PostgreSQL 10 DB v1.0.0 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.1.26 Ensure 'log_line_prefix' is set correctly | CIS PostgreSQL 9.5 DB v1.1.0 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.2 Ensure CONNECT permissions on the 'guest user' is Revoked within all SQL Server databases excluding the master, msdb and tempdb | CIS SQL Server 2014 Database L1 AWS RDS v1.5.0 | MS_SQLDB | ACCESS CONTROL |
| 4.8 Log successful and failed login attempt - success | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 6.1.2.8 Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule | CIS Microsoft Azure Foundations v6.0.0 L1 | microsoft_azure | AUDIT AND ACCOUNTABILITY |
| 6.9 Ensure that PAN-DB URL Filtering is used | CIS Palo Alto Firewall 7 Benchmark L1 v1.0.0 | Palo_Alto | CONFIGURATION MANAGEMENT |
| 6.9 Ensure that PAN-DB URL Filtering is used | CIS Palo Alto Firewall 8 Benchmark L1 v1.0.0 | Palo_Alto | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 7.1 Ensure 'Symmetric Key encryption algorithm' is set to 'AES_128' or higher in non-system databases | CIS Microsoft SQL Server 2019 v1.6.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.1.4 Ensure Audit is Enabled Within the Instance | CIS IBM DB2 11 v1.2.0 Linux OS Level 1 | Unix | AUDIT AND ACCOUNTABILITY |
| 7.1.4 Ensure Audit is Enabled Within the Instance | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | AUDIT AND ACCOUNTABILITY |
| 7.4 Ensure Network Encryption is Configured and Enabled | CIS Microsoft SQL Server 2022 v1.3.0 L2 Database Engine | MS_SQLDB | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| DISA_STIG_VMware_vSphere_8.0_vCenter_Appliance_ESX_Agent_Manager_EAM_v2r4.audit from DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | Unix | |
| MYS8-00-002500 - The MySQL Database Server 8.0 must generate audit records when unsuccessful attempts to add privileges/permissions occur. | DISA Oracle MySQL 8.0 v2r2 DB | MySQLDB | AUDIT AND ACCOUNTABILITY |
| MYS8-00-002600 - The MySQL Database Server 8.0 must generate audit records when privileges/permissions are modified. | DISA Oracle MySQL 8.0 v2r2 DB | MySQLDB | AUDIT AND ACCOUNTABILITY |
| MYS8-00-002700 - The MySQL Database Server 8.0 must generate audit records when unsuccessful attempts to modify privileges/permissions occur. | DISA Oracle MySQL 8.0 v2r2 DB | MySQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Browser' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Distributed Replay Controller' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Integration Services 11.0' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Reporting Services' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server VSS Writer' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL2-00-009900 - OS and domain accounts utilized to run external procedures called by SQL Server must have limited privileges. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| SQL2-00-015350 - Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be monitored to discover unauthorized changes. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| SQL2-00-015355 - Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be audited. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| SQL2-00-015500 - Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| SQL2-00-016500 - SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| SQL2-00-016600 - SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| SQL2-00-016700 - SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| SQL6-D0-000600 - SQL Server must protect against a user falsely repudiating by ensuring databases are not in a trust relationship. | DISA MS SQL Server 2016 Database STIG v3r5 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL6-D0-000700 - SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. | DISA MS SQL Server 2016 Database STIG v3r5 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL6-D0-001800 - The Certificate used for encryption must be backed up and stored in a secure location that is not on the SQL Server. | DISA MS SQL Server 2016 Database STIG v3r5 | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| SQL6-D0-002000 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy. | DISA MS SQL Server 2016 Database STIG v3r5 | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| SQL6-D0-002100 - SQL Server must check the validity of all data inputs except those specifically identified by the organization. | DISA MS SQL Server 2016 Database STIG v3r5 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
