STIGQter STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

The SQL Server Mirroring endpoint must use AES encryption.

DISA Rule

SV-274447r1111109_rule

Vulnerability Number

V-274447

Group Title

SRG-APP-000516-DB-000363

Rule Version

SQLI-22-016500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Run the following to enable encryption on the mirroring endpoint:
ALTER ENDPOINT <Endpoint Name>
FOR DATABASE_MIRRORING
(ENCRYPTION = REQUIRED ALGORITHM AES)

Check Contents

If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding.

If Database Mirroring is in use, run the following to check for encrypted transmissions:
SELECT name, type_desc, encryption_algorithm_desc
FROM sys.database_mirroring_endpoints
WHERE encryption_algorithm != 2

If any records are returned, this is a finding.

Vulnerability Number

V-274447

Documentable

False

Rule Version

SQLI-22-016500

Severity Override Guidance

If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding.

If Database Mirroring is in use, run the following to check for encrypted transmissions:
SELECT name, type_desc, encryption_algorithm_desc
FROM sys.database_mirroring_endpoints
WHERE encryption_algorithm != 2

If any records are returned, this is a finding.

Check Content Reference

M

Target Key

5677