STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-276251r1149662_rule

Vulnerability Number

V-276251

Group Title

SRG-APP-000231-DB-000154

Rule Version

MSQL-00-009500

Severity

CAT I

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

For each database indicating "UNENCRYPTED" or "DECRYPTION_IN_PROGRESS", execute the TSQL command below to enable encryption:

ALTER DATABASE [<database name between brackets>] SET ENCRYPTION ON

Check Contents

Run the following TSQL to determine database encryption status:

SELECT db.name AS DatabaseName, db.is_encrypted AS IsEncrypted,
CASE
WHEN dm.encryption_state = 0 THEN 'No database encryption key present, no encryption'
WHEN dm.encryption_state = 1 THEN 'Unencrypted'
WHEN dm.encryption_state = 2 THEN 'Encryption in progress'
WHEN dm.encryption_state = 3 THEN 'Encrypted'
WHEN dm.encryption_state = 4 THEN 'Key change in progress'
WHEN dm.encryption_state = 5 THEN 'Decryption in progress'
WHEN dm.encryption_state = 6 THEN 'Protection change in progress'
END AS EncryptionState,
dm.encryption_state AS EncryptionState,
dm.key_algorithm AS KeyAlgorithm,
dm.key_length AS KeyLength
FROM sys.databases db
LEFT OUTER JOIN sys.dm_database_encryption_keys dm ON db.database_id = dm.database_id
WHERE db.database_id NOT IN (1,2,3,4)

If the application owner and authorizing official have determined that encryption of data at rest is required and the EncryptionState column returns "UNENCRYPTED" or "DECRYPTION_IN_PROGRESS", this is a finding.

Vulnerability Number

V-276251

Documentable

False

Rule Version

MSQL-00-009500

Severity Override Guidance

Run the following TSQL to determine database encryption status:

SELECT db.name AS DatabaseName, db.is_encrypted AS IsEncrypted,
CASE
WHEN dm.encryption_state = 0 THEN 'No database encryption key present, no encryption'
WHEN dm.encryption_state = 1 THEN 'Unencrypted'
WHEN dm.encryption_state = 2 THEN 'Encryption in progress'
WHEN dm.encryption_state = 3 THEN 'Encrypted'
WHEN dm.encryption_state = 4 THEN 'Key change in progress'
WHEN dm.encryption_state = 5 THEN 'Decryption in progress'
WHEN dm.encryption_state = 6 THEN 'Protection change in progress'
END AS EncryptionState,
dm.encryption_state AS EncryptionState,
dm.key_algorithm AS KeyAlgorithm,
dm.key_length AS KeyLength
FROM sys.databases db
LEFT OUTER JOIN sys.dm_database_encryption_keys dm ON db.database_id = dm.database_id
WHERE db.database_id NOT IN (1,2,3,4)

If the application owner and authorizing official have determined that encryption of data at rest is required and the EncryptionState column returns "UNENCRYPTED" or "DECRYPTION_IN_PROGRESS", this is a finding.

Check Content Reference

M

Target Key

5711