STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements.

DISA Rule

SV-255320r962034_rule

Vulnerability Number

V-255320

Group Title

SRG-APP-000416-DB-000380

Rule Version

ASQL-00-003200

Severity

CAT I

CCI(s)

• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Use the ALTER DATABASE command to enable encryption on the database.

ALTER DATABASE [Database Name Between Brackets] SET ENCRYPTION ON

Check Contents

Use the TSQL query below to determine database encryption state:

SELECT DB_NAME(database_id) AS DatabaseName,
encryption_state_desc AS EncryptionState,
key_algorithm+CAST(key_length AS nvarchar(128)) AS EncryptionAlgorithm,
encryptor_type
FROM sys.dm_database_encryption_keys

Validate that for each database the [EncryptionState] is "ENCRYPTED" and the [EncryptionAlgorithm] returns one of the following values: [AES128], [AES192], or [AES256].

If any other value is returned for either the [EncryptionState] or [EncryptionAlgorithm], this is a finding.

Vulnerability Number

V-255320

Documentable

False

Rule Version

ASQL-00-003200

Severity Override Guidance

Use the TSQL query below to determine database encryption state:

SELECT DB_NAME(database_id) AS DatabaseName,
encryption_state_desc AS EncryptionState,
key_algorithm+CAST(key_length AS nvarchar(128)) AS EncryptionAlgorithm,
encryptor_type
FROM sys.dm_database_encryption_keys

Validate that for each database the [EncryptionState] is "ENCRYPTED" and the [EncryptionAlgorithm] returns one of the following values: [AES128], [AES192], or [AES256].

If any other value is returned for either the [EncryptionState] or [EncryptionAlgorithm], this is a finding.

Check Content Reference

M

Target Key

5500