STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must use NIST FIPS 140-2 or 140-3 validated cryptographic operations for encryption, hashing, and signing.

DISA Rule

SV-271314r1109121_rule

Vulnerability Number

V-271314

Group Title

SRG-APP-000179-DB-000114

Rule Version

SQLI-22-008700

Severity

CAT I

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.
• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Configure Windows to require the use of FIPS compliant algorithms for the unclassified information that requires it.

1. Click "Start".
2. Type "Local Security Policy".
3. Press "Enter".
4. Expand "Local Policies".
5. Select "Security Options".
6. Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".
7. Change the Setting option to "Enabled".
8. Restart Windows.

Check Contents

Verify that Windows is configured to require the use of FIPS compliant algorithms.

1. Click "Start".
2. Type "Local Security Policy".
3. Press "Enter".
4. Expand "Local Policies".
5. Select "Security Options".
6. Review the Security Setting for "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".

If the Security Setting for this option is "Disabled", this is a finding.

Alternatively, run the following code in PowerShell:

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy | Select Enabled

If the returned value is "0", this is a finding.

Vulnerability Number

V-271314

Documentable

False

Rule Version

SQLI-22-008700

Severity Override Guidance

Verify that Windows is configured to require the use of FIPS compliant algorithms.

1. Click "Start".
2. Type "Local Security Policy".
3. Press "Enter".
4. Expand "Local Policies".
5. Select "Security Options".
6. Review the Security Setting for "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".

If the Security Setting for this option is "Disabled", this is a finding.

Alternatively, run the following code in PowerShell:

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy | Select Enabled

If the returned value is "0", this is a finding.

Check Content Reference

M

Target Key

5677