STIGQter STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-271324r1192911_rule

Vulnerability Number

V-271324

Group Title

SRG-APP-000231-DB-000154

Rule Version

SQLI-22-009500

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption.

To enable database encryption, create a master key, create a database encryption key, protect it by using mechanisms tied to the master key, and then turn encryption on.

Implement physical security measures, operating system access control lists, and organizational controls appropriate to the sensitivity level of the data in the database(s).

Check Contents

Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check is downgraded to CAT II.

If the application owner and authorizing official (AO) have determined that encryption of data at rest is required, verify the data on secondary devices is encrypted.

If full-disk encryption is being used, this is not a finding.

If data encryption is required, verify the data is encrypted before being put on the secondary device by executing the following:

SELECT
db.name AS DatabaseName,
db.is_encrypted AS IsEncrypted,
CASE
WHEN dm.encryption_state = 0 THEN 'No database encryption key present, no encryption'
WHEN dm.encryption_state = 1 THEN 'Unencrypted'
WHEN dm.encryption_state = 2 THEN 'Encryption in progress'
WHEN dm.encryption_state = 3 THEN 'Encrypted'
WHEN dm.encryption_state = 4 THEN 'Key change in progress'
WHEN dm.encryption_state = 5 THEN 'Decryption in progress'
WHEN dm.encryption_state = 6 THEN 'Protection change in progress'
END AS EncryptionState,
dm.encryption_state AS EncryptionState,
dm.key_algorithm AS KeyAlgorithm,
dm.key_length AS KeyLength
FROM
sys.databases db
LEFT JOIN sys.dm_database_encryption_keys dm ON db.database_id = dm.database_id
WHERE db.database_id > 4
ORDER BY [DatabaseName] ;

For each user database where encryption is required, verify encryption is in effect. If it is not, this is a finding.

Verify there are physical security measures, operating system access control lists, and organizational controls appropriate to the sensitivity level of the data in the database(s); if not, this is a finding.

Vulnerability Number

V-271324

Documentable

False

Rule Version

SQLI-22-009500

Severity Override Guidance

Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check is downgraded to CAT II.

If the application owner and authorizing official (AO) have determined that encryption of data at rest is required, verify the data on secondary devices is encrypted.

If full-disk encryption is being used, this is not a finding.

If data encryption is required, verify the data is encrypted before being put on the secondary device by executing the following:

SELECT
db.name AS DatabaseName,
db.is_encrypted AS IsEncrypted,
CASE
WHEN dm.encryption_state = 0 THEN 'No database encryption key present, no encryption'
WHEN dm.encryption_state = 1 THEN 'Unencrypted'
WHEN dm.encryption_state = 2 THEN 'Encryption in progress'
WHEN dm.encryption_state = 3 THEN 'Encrypted'
WHEN dm.encryption_state = 4 THEN 'Key change in progress'
WHEN dm.encryption_state = 5 THEN 'Decryption in progress'
WHEN dm.encryption_state = 6 THEN 'Protection change in progress'
END AS EncryptionState,
dm.encryption_state AS EncryptionState,
dm.key_algorithm AS KeyAlgorithm,
dm.key_length AS KeyLength
FROM
sys.databases db
LEFT JOIN sys.dm_database_encryption_keys dm ON db.database_id = dm.database_id
WHERE db.database_id > 4
ORDER BY [DatabaseName] ;

For each user database where encryption is required, verify encryption is in effect. If it is not, this is a finding.

Verify there are physical security measures, operating system access control lists, and organizational controls appropriate to the sensitivity level of the data in the database(s); if not, this is a finding.

Check Content Reference

M

Target Key

5677