STIGQter: STIG Summary: Microsoft SQL Server 2022 Database Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Apr 2026:

The Database Master Key encryption password must meet DOD password complexity requirements.

DISA Rule

SV-271169r1109188_rule

Vulnerability Number

V-271169

Group Title

SRG-APP-000231-DB-000154

Rule Version

SQLD-22-001600

Severity

CAT II

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Assign an encryption password to the Database Master Key that is a minimum of 15 characters with at least one uppercase character, one lowercase character, one special character, one numeric character, and at least eight characters changed from the previous password. To change the Database Master Key encryption password:

USE [database name];
ALTER MASTER KEY REGENERATE WITH ENCRYPTION BY PASSWORD = 'new password';

Note: Do not change the Database Master Key encryption method until the effects are thoroughly reviewed. Changing the master key encryption causes all encryption using the Database Master Key to be decrypted and reencrypted. This action should not be taken during a high-demand time.

Refer to the SQL Server documentation found here prior to reencrypting the Database Master Key:
https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/create-a-database-master-key?

Check Contents

From the query prompt:

SELECT name
FROM [master].sys.databases
WHERE state = 0

Repeat for each database:
From the query prompt:

USE [database name]
SELECT COUNT(name)
FROM sys.symmetric_keys s, sys.key_encryptions k
WHERE s.name = '##MS_DatabaseMasterKey##'
AND s.symmetric_key_id = k.key_id
AND k.crypt_type in ('ESKP', 'ESP2', 'ESP3')

If the value returned is zero, this is not applicable.

If the value returned is greater than zero, a Database Master Key exists and is encrypted with a password.

Review procedures and evidence of password requirements used to encrypt Database Master Keys.

If the passwords do not meet DOD password standards, this is a finding.

Vulnerability Number

V-271169

Documentable

False

Rule Version

SQLD-22-001600

Severity Override Guidance

From the query prompt:

SELECT name
FROM [master].sys.databases
WHERE state = 0

Repeat for each database:
From the query prompt:

USE [database name]
SELECT COUNT(name)
FROM sys.symmetric_keys s, sys.key_encryptions k
WHERE s.name = '##MS_DatabaseMasterKey##'
AND s.symmetric_key_id = k.key_id
AND k.crypt_type in ('ESKP', 'ESP2', 'ESP3')

If the value returned is zero, this is not applicable.

If the value returned is greater than zero, a Database Master Key exists and is encrypted with a password.

Review procedures and evidence of password requirements used to encrypt Database Master Keys.

If the passwords do not meet DOD password standards, this is a finding.

Check Content Reference

M

Target Key

5676