STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Execution of startup stored procedures must be restricted to necessary cases only.

DISA Rule

SV-274446r1111106_rule

Vulnerability Number

V-274446

Group Title

SRG-APP-000342-DB-000302

Rule Version

SQLI-22-016400

Severity

CAT II

CCI(s)

• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

To disable startup stored procedure(s), run the following in Master for each undocumented procedure:
sp_procoption @procname = '<procedure name>', @OptionName = 'Startup', @optionValue = 'Off'

Check Contents

Review the system documentation to obtain a listing of documented stored procedures used by SQL Server during startup. Execute the following query:
Select [name] as StoredProc
From sys.procedures
Where OBJECTPROPERTY(OBJECT_ID, 'ExecIsStartup') = 1

If any stored procedures are returned that are not documented, this is a finding.

Vulnerability Number

V-274446

Documentable

False

Rule Version

SQLI-22-016400

Severity Override Guidance

Review the system documentation to obtain a listing of documented stored procedures used by SQL Server during startup. Execute the following query:
Select [name] as StoredProc
From sys.procedures
Where OBJECTPROPERTY(OBJECT_ID, 'ExecIsStartup') = 1

If any stored procedures are returned that are not documented, this is a finding.

Check Content Reference

M

Target Key

5677