STIGQter STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must prevent unauthorized and unintended information transfer via shared system resources.

DISA Rule

SV-271328r1137657_rule

Vulnerability Number

V-271328

Group Title

SRG-APP-000243-DB-000373

Rule Version

SQLI-22-009800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another process or user.

To enable the use of [Common Criteria Compliance], from the query prompt:

EXEC SP_CONFIGURE 'show advanced options', 1;
RECONFIGURE WITH OVERRIDE;
EXEC SP_CONFIGURE 'common criteria compliance enabled', 1;
RECONFIGURE WITH OVERRIDE;
EXEC SP_CONFIGURE 'show advanced options', 0;
RECONFIGURE WITH OVERRIDE;

Check Contents

Review system documentation to determine whether common criteria compliance is required due to potential impact on system performance.

SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs.

Review the Instance configuration:

SELECT value_in_use
FROM sys.configurations
WHERE name = 'common criteria compliance enabled'

If "value_in_use" is set to "1" this is not a finding.

If "value_in_use" is set to "0" this is a finding.

If no results are returned, common criteria compliance is not available in the installed version of SQL Server, this is a finding. Common criteria compliance is only supported in Enterprise and Developer editions of SQL Server.

Note: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server RIP to disabled (value_in_use set to "0") has been documented and approved, then this is downgraded to a CAT III finding.

Vulnerability Number

V-271328

Documentable

False

Rule Version

SQLI-22-009800

Severity Override Guidance

Review system documentation to determine whether common criteria compliance is required due to potential impact on system performance.

SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs.

Review the Instance configuration:

SELECT value_in_use
FROM sys.configurations
WHERE name = 'common criteria compliance enabled'

If "value_in_use" is set to "1" this is not a finding.

If "value_in_use" is set to "0" this is a finding.

If no results are returned, common criteria compliance is not available in the installed version of SQL Server, this is a finding. Common criteria compliance is only supported in Enterprise and Developer editions of SQL Server.

Note: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server RIP to disabled (value_in_use set to "0") has been documented and approved, then this is downgraded to a CAT III finding.

Check Content Reference

M

Target Key

5677