STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 05 Jan 2026:

SQL Server must generate audit records when attempts to access privileges, categorized information, and security objects occur.

DISA Rule

SV-213939r1167477_rule

Vulnerability Number

V-213939

Group Title

SRG-APP-000091-DB-000325

Rule Version

SQL6-D0-004600

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".

Check Contents

Review the system documentation to determine if SQL Server is required to audit when the following events occur:

- Attempts to retrieve privilege/permission/role membership information.
- Security objects are accessed, modified, or deleted.
- Data classifications (e.g., classification levels/security levels) are accessed, modified, or deleted.
- Any other specified objects are accessed, modified, or deleted as required by the site.

If SQL Server is not required to audit any of the above, this is not a finding.

If the documentation does not exist, this is a finding.

Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding.

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status

If auditing the retrieval of the above information or objects is required, execute the following to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification:

SELECT a.name AS 'AuditName',
s.name AS 'SpecName',
d.audit_action_name AS 'ActionName',
d.audited_result AS 'Result'
FROM sys.server_audit_specifications s
JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP'

If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.

Vulnerability Number

V-213939

Documentable

False

Rule Version

SQL6-D0-004600

Severity Override Guidance

Review the system documentation to determine if SQL Server is required to audit when the following events occur:

- Attempts to retrieve privilege/permission/role membership information.
- Security objects are accessed, modified, or deleted.
- Data classifications (e.g., classification levels/security levels) are accessed, modified, or deleted.
- Any other specified objects are accessed, modified, or deleted as required by the site.

If SQL Server is not required to audit any of the above, this is not a finding.

If the documentation does not exist, this is a finding.

Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding.

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status

If auditing the retrieval of the above information or objects is required, execute the following to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification:

SELECT a.name AS 'AuditName',
s.name AS 'SpecName',
d.audit_action_name AS 'ActionName',
d.audited_result AS 'Result'
FROM sys.server_audit_specifications s
JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP'

If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.

Check Content Reference

M

Target Key

3993