STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must maintain the confidentiality and integrity of information during reception.

DISA Rule

SV-255349r961641_rule

Vulnerability Number

V-255349

Group Title

SRG-APP-000442-DB-000379

Rule Version

ASQL-00-012600

Severity

CAT II

CCI(s)

• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.

Weight

10

Fix Recommendation

Implement and document protective measures against unauthorized disclosure and modification during transmission reception.

https://docs.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings

https://docs.microsoft.com/en-us/azure/azure-sql/database/connectivity-architecture

https://docs.microsoft.com/en-us/azure/azure-sql/database/network-access-controls-overview

Check Contents

Document reception protection mechanisms based on organizationally defined requirements, if this documentation does not exist this is a finding.

Validate that reception protection mechanisms match documentation of organizationally defined requirements, if discrepancies exist this is a finding.

Run the following PowerShell script to check the TLS version:
$ResourceGroupName = '<Resource Group Name>'
Get-AzSqlServer -ResourceGroupName $ResourceGroupName | Format-Table ServerName,MinimalTlsVersion

Verify that the minimum TLS version property is set to the latest available TLS version. If a less secure TLS version is set, this is a finding.

Vulnerability Number

V-255349

Documentable

False

Rule Version

ASQL-00-012600

Severity Override Guidance

Document reception protection mechanisms based on organizationally defined requirements, if this documentation does not exist this is a finding.

Validate that reception protection mechanisms match documentation of organizationally defined requirements, if discrepancies exist this is a finding.

Run the following PowerShell script to check the TLS version:
$ResourceGroupName = '<Resource Group Name>'
Get-AzSqlServer -ResourceGroupName $ResourceGroupName | Format-Table ServerName,MinimalTlsVersion

Verify that the minimum TLS version property is set to the latest available TLS version. If a less secure TLS version is set, this is a finding.

Check Content Reference

M

Target Key

5500