STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-255339r961128_rule

Vulnerability Number

V-255339

Group Title

SRG-APP-000231-DB-000154

Rule Version

ASQL-00-009500

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

If Azure SQL Database Transparent Data Encryption is disabled, use the Set-AzSqlDatabaseTransparentDataEncryption command to enable.

$LogicalServerName = "myServerName"
$RGname = "myRG"
$DBName = "myDatabaseName"
$TDEstate = "Enabled"
Set-AzSqlDatabaseTransparentDataEncryption -ResourceGroupName $RGname -ServerName $LogicalServerName -DatabaseName $DBname -State $TDEstate

Check Contents

Run the PowerShell command below to determine database encryption status:
$LogicalServerName = "myServerName"
$RGname = "myRG"
$DBName = "myDatabaseName"
Get-AzSqlDatabaseTransparentDataEncryption -ServerName $LogicalServerName -ResourceGroupName $RGname -DatabaseName $Dbname

If the application owner and Authorizing Official have determined that encryption of data at rest is required and the "EncryptionState" column returns "UNENCRYPTED" or "DECRYPTION_IN_PROGRESS", this is a finding.

Vulnerability Number

V-255339

Documentable

False

Rule Version

ASQL-00-009500

Severity Override Guidance

Run the PowerShell command below to determine database encryption status:
$LogicalServerName = "myServerName"
$RGname = "myRG"
$DBName = "myDatabaseName"
Get-AzSqlDatabaseTransparentDataEncryption -ServerName $LogicalServerName -ResourceGroupName $RGname -DatabaseName $Dbname

If the application owner and Authorizing Official have determined that encryption of data at rest is required and the "EncryptionState" column returns "UNENCRYPTED" or "DECRYPTION_IN_PROGRESS", this is a finding.

Check Content Reference

M

Target Key

5500