STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

MS SQL Server 2014 Instance Security Technical Implementation Guide

Version

V2R4

Benchmark ID

MS_SQL_Server_2014_Instance_STIG

Total Checks

93

Tags

database
CAT I: 5CAT II: 85CAT III: 3

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (93)

V-213807MEDIUMThe number of concurrent SQL Server sessions for each system account must be limited.V-213808MEDIUMSQL Server must enforce approved authorizations for logical access to server-level system resources in accordance with applicable access control policies.V-213809LOWSQL Server default account [sa] must have its name changed.V-213810MEDIUMWhere SQL Server Trace is in use for auditing purposes, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be traced.V-213811MEDIUMWhere SQL Server Audit is in use, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the server level.V-213812MEDIUMWhere SQL Server Audit is in use, SQL Server must generate audit records when privileges/permissions are retrieved.V-213813MEDIUMSQL Server must produce Trace or Audit records containing sufficient information to establish when the events occurred.V-213814MEDIUMSQL Server must produce Trace or Audit records containing sufficient information to establish where the events occurred.V-213815MEDIUMSQL Server must produce Trace or Audit records containing sufficient information to establish the sources (origins) of the events.V-213816MEDIUMSQL Server must produce Trace or Audit records containing sufficient information to establish the outcome (success or failure) of the events.V-213817MEDIUMSQL Server must produce Trace or Audit records containing sufficient information to establish the identity of any user/subject associated with the event.V-213818MEDIUMSQL Server must include organization-defined additional, more detailed information in Trace or Audit records for events identified by type, location, or subject.V-213819MEDIUMUnless it has been determined that availability is paramount, SQL Server must shut down upon the failure of an Audit, or a Trace used for auditing purposes, to include the unavailability of space for more audit/trace log records.V-213820MEDIUMThe audit information produced by SQL Server must be protected from unauthorized read access.V-213821MEDIUMThe audit information produced by SQL Server must be protected from unauthorized modification.V-213822MEDIUMThe audit information produced by SQL Server must be protected from unauthorized deletion.V-213823MEDIUMAudit tools used in, or in conjunction with, SQL Server must be protected from unauthorized access.V-213824MEDIUMSQL Server and/or the operating system must protect its audit configuration from unauthorized modification.V-213825MEDIUMSQL Server and the operating system must protect SQL Server audit features from unauthorized removal.V-213826MEDIUMSQL Server security-relevant configuration settings must be monitored to discover unauthorized changes.V-213827MEDIUMSoftware, applications, and configuration files that are part of, or related to, the SQL Server installation must be monitored to discover unauthorized changes.V-213828MEDIUMSQL Server software installation account(s) must be restricted to authorized users.V-213829LOWDatabase software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.V-213830MEDIUMSQL Server must have the publicly available Northwind sample database removed.V-213831MEDIUMSQL Server must have the publicly available pubs sample database removed.V-213832MEDIUMSQL Server must have the publicly available AdventureWorks sample database removed.V-213833MEDIUMSQL Server must have the SQL Server Data Tools (SSDT) software component removed if it is unused.V-213834MEDIUMSQL Server must have the SQL Server Reporting Services (SSRS) software component removed if it is unused.V-213835MEDIUMSQL Server must have the SQL Server Integration Services (SSIS) software component removed if it is unused.V-213836MEDIUMSQL Server must have the SQL Server Analysis Services (SSAS) software component removed if it is unused.V-213837MEDIUMSQL Server must have the SQL Server Distributed Replay Client software component removed if it is unused.V-213838MEDIUMSQL Server must have the SQL Server Distributed Replay Controller software component removed if it is unused.V-213839MEDIUMSQL Server must have the Full-Text Search software component removed if it is unused.V-213840MEDIUMSQL Server must have the Master Data Services software component removed if it is unused.V-213841MEDIUMSQL Server must have the SQL Server Replication software component removed if it is unused.V-213842MEDIUMSQL Server must have the Data Quality Client software component removed if it is unused.V-213843MEDIUMSQL Server must have the Data Quality Services software component removed if it is unused.V-213844MEDIUMSQL Server must have the Client Tools SDK software component removed if it is unused.V-213845MEDIUMSQL Server must have the Management Tools software component removed if it is unused.V-213846MEDIUMSQL Server must have the Filestream feature disabled if it is unused.V-213847MEDIUMUnused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.V-213848MEDIUMThe SQL Server default account [sa] must be disabled.V-213849MEDIUMAccess to xp_cmdshell must be disabled, unless specifically required and approved.V-213850MEDIUMSQL Server must be configured to prohibit or restrict the use of unauthorized network protocols.V-213851MEDIUMSQL Server must be configured to prohibit or restrict the use of unauthorized network ports.V-213852MEDIUMSQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-213853MEDIUMSQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-213854MEDIUMSQL Server must be configured to separate user functionality (including user interface services) from database management functionality.V-213855MEDIUMSQL Server must isolate security functions from nonsecurity functions.V-213856MEDIUMSQL Server must protect against an individual using a shared account from falsely denying having performed a particular action.V-213857MEDIUMThe Service Master Key must be backed up, stored offline and off-site.V-213858MEDIUMSQL Server authentication and identity management must be integrated with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.V-213859MEDIUMWhere SQL Server Audit is in use, SQL Server must generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.V-213860HIGHWhere availability is paramount, the SQL Server must continue processing (preferably overwriting existing records, oldest first), in the event of lack of space for more Audit/Trace log records; and must keep processing after any failure of an Audit/Trace.V-213861MEDIUMThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.V-213862HIGHSQL Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.V-213863MEDIUMAccess to database files must be limited to relevant processes and to authorized, administrative users.V-213864MEDIUMSQL Server must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.V-213865MEDIUMSQL Server must prevent non-privileged users from executing privileged functionality, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.V-213866MEDIUMExecution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.V-213867MEDIUMSQL Server must utilize centralized management of the content captured in audit records generated by all components of the DBMS.V-213868MEDIUMSQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.V-213869MEDIUMSQL Server, the operating system, or the storage system must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.V-213870MEDIUMSQL Server or software monitoring SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.V-213871MEDIUMSQL Server must produce time stamps that can be mapped to Coordinated Universal Time (UTC, formerly GMT).V-213872MEDIUMSQL Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.V-213873MEDIUMSQL Server and Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance or database(s).V-213874MEDIUMSQL Server must produce Trace or Audit records of its enforcement of access restrictions associated with changes to the configuration of the DBMS or database(s).V-213875MEDIUMSQL Server must disable communication protocols not required for operation.V-213876MEDIUMSQL Server must implement and/or support cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.V-213877MEDIUMThe confidentiality and integrity of information managed by SQL Server must be maintained during preparation for transmission.V-213878MEDIUMThe confidentiality and integrity of information managed by SQL Server must be maintained during reception.V-213879MEDIUMSecurity-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).V-213880MEDIUMSoftware updates to SQL Server must be tested before being applied to production systems.V-213881MEDIUMSQL Server must produce Trace or Audit records when security objects are accessed.V-213882MEDIUMSQL Server must produce Trace or Audit records when unsuccessful attempts to access security objects occur.V-213883MEDIUMSQL Server must generate Trace or Audit records when privileges/permissions are added.V-213884MEDIUMSQL Server must generate Trace or Audit records when unsuccessful attempts to add privileges/permissions occur.V-213885MEDIUMSQL Server must generate Trace or Audit records when privileges/permissions are deleted.V-213886MEDIUMSQL Server must generate Trace or Audit records when unsuccessful attempts to delete privileges/permissions occur.V-213887MEDIUMSQL Server must generate Trace or Audit records when successful logons or connections occur.V-213888MEDIUMSQL Server must generate Trace or Audit records when unsuccessful logons or connection attempts occur.V-213889MEDIUMSQL Server must generate Trace or Audit records for all privileged activities or other system-level access.V-213890MEDIUMSQL Server must generate Trace or Audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.V-213891MEDIUMSQL Server must generate Trace or Audit records when logoffs or disconnections occur.V-213892MEDIUMSQL Server must generate Trace or Audit records when concurrent logons/connections by the same user from different workstations occur.V-213893MEDIUMSQL Server must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.V-213894MEDIUMIf SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity.V-213895MEDIUMIf SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password lifetime.V-213896HIGHApplications must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.V-213897HIGHWhen using command-line tools such as SQLCMD in a mixed-mode authentication environment, users must use a logon method that does not expose the password.V-213898LOWThe SQL Server Browser service must be disabled if its use is not necessary..V-265639HIGHMicrosoft SQL Server products must be a version supported by the vendor.