STIGQter STIGQter: STIG Summary:

Database Security Requirements Guide

Version: 4

Release: 5 Benchmark Date: 01 Apr 2026

CheckedNameTitle
☐SV-206519r960735_ruleThe DBMS must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.
☐SV-206520r1043176_ruleThe DBMS must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
☐SV-206521r1137654_ruleThe DBMS must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
☐SV-206522r960864_ruleThe DBMS must protect against a user falsely repudiating having performed organization-defined actions.
☐SV-206523r960879_ruleThe DBMS must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.
☐SV-206524r960882_ruleThe DBMS must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
☐SV-206525r960885_ruleThe DBMS must be able to generate audit records when privileges/permissions are retrieved.
☐SV-206526r960885_ruleThe DBMS must be able to generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.
☐SV-206527r960888_ruleThe DBMS must initiate session auditing upon startup.
☐SV-206528r960891_ruleThe DBMS must produce audit records containing sufficient information to establish what type of events occurred.
☐SV-206529r960894_ruleThe DBMS must produce audit records containing time stamps to establish when the events occurred.
☐SV-206530r960897_ruleThe DBMS must produce audit records containing sufficient information to establish where the events occurred.
☐SV-206531r960900_ruleThe DBMS must produce audit records containing sufficient information to establish the sources (origins) of the events.
☐SV-206532r960903_ruleThe DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
☐SV-206533r960906_ruleThe DBMS must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.
☐SV-206534r960909_ruleThe DBMS must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
☐SV-206537r960927_ruleThe DBMS must use system clocks to generate time stamps for use in audit records and application data.
☐SV-206538r960930_ruleThe audit information produced by the DBMS must be protected from unauthorized read access.
☐SV-206539r960933_ruleThe audit information produced by the DBMS must be protected from unauthorized modification.
☐SV-206540r960936_ruleThe audit information produced by the DBMS must be protected from unauthorized deletion.
☐SV-206541r960939_ruleThe DBMS must protect its audit features from unauthorized access.
☐SV-206542r960942_ruleThe DBMS must protect its audit configuration from unauthorized modification.
☐SV-206543r960945_ruleThe DBMS must protect its audit features from unauthorized removal.
☐SV-206544r960960_ruleThe DBMS must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the DBMS.
☐SV-206545r960960_ruleThe DBMS software installation account must be restricted to authorized users.
☐SV-206546r960960_ruleDatabase software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.
☐SV-206547r960960_ruleDatabase objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be owned by database/DBMS principals authorized for ownership.
☐SV-206548r960960_ruleThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be restricted to authorized users.
☐SV-206549r960963_ruleDefault demonstration and sample databases, database objects, and applications must be removed.
☐SV-206550r960963_ruleUnused database components, DBMS software, and database objects must be removed.
☐SV-206551r960963_ruleUnused database components that are integrated in the DBMS and cannot be uninstalled must be disabled.
☐SV-206552r960963_ruleAccess to external executables must be disabled or restricted.
☐SV-206553r1043177_ruleThe DBMS must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
☐SV-206554r1051115_ruleThe DBMS must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
☐SV-206555r981946_ruleIf DBMS authentication, using passwords, is employed, the DBMS must enforce the DOD standards for password complexity and lifetime.
☐SV-206556r981949_ruleThe DBMS must for password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
☐SV-206557r961029_ruleIf passwords are used for authentication, the DBMS must transmit only encrypted representations of passwords.
☐SV-206558r961038_ruleThe DBMS, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.
☐SV-206559r961041_ruleThe DBMS must enforce authorized access to all PKI private keys stored/utilized by the DBMS.
☐SV-206560r961044_ruleThe DBMS must map the PKI-authenticated identity to an associated user account.
☐SV-206561r961047_ruleThe DBMS must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
☐SV-206562r961050_ruleThe DBMS must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.
☐SV-206563r961053_ruleThe DBMS must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
☐SV-206564r1137655_ruleThe DBMS must separate user functionality (including user interface services) from database management functionality.
☐SV-206565r1043179_ruleThe DBMS must invalidate session identifiers upon user logout or other session termination.
☐SV-206566r1043180_ruleThe DBMS must recognize only system-generated session identifiers.
☐SV-206567r1043181_ruleThe DBMS must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.
☐SV-206568r961122_ruleThe DBMS must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.
☐SV-206569r961125_ruleIn the event of a system failure, the DBMS must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.
☐SV-206570r961128_ruleThe DBMS must protect the confidentiality and integrity of all information at rest.
☐SV-206571r961131_ruleThe DBMS must isolate security functions from non-security functions.
☐SV-206572r1137656_ruleDatabase contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
☐SV-206573r1137657_ruleThe DBMS must prevent unauthorized and unintended information transfer via shared system resources.
☐SV-206574r1137658_ruleAccess to database files must be limited to relevant processes and to authorized, administrative users.
☐SV-206575r961158_ruleThe DBMS must check the validity of all data inputs except those specifically identified by the organization.
☐SV-206576r961158_ruleThe DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.
☐SV-206577r961158_ruleThe DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
☐SV-206578r961167_ruleThe DBMS must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
☐SV-206579r961170_ruleThe DBMS must reveal detailed error messages only to the ISSO, ISSM, SA and DBA.
☐SV-206580r1043182_ruleThe DBMS must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
☐SV-206581r961224_ruleThe DBMS must provide logout functionality to allow the user to manually terminate a session initiated by that user.
☐SV-206582r1138540_ruleThe DBMS must associate organization-defined types of security labels having organization-defined security label values with information in storage.
☐SV-206583r1138541_ruleThe DBMS must associate organization-defined types of security labels having organization-defined security label values with information in process.
☐SV-206584r1138542_ruleThe DBMS must associate organization-defined types of security labels having organization-defined security label values with information in transmission.
☐SV-206585r961317_ruleThe DBMS must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.
☐SV-206586r961353_ruleThe DBMS must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
☐SV-206587r961359_ruleExecution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
☐SV-206591r961392_ruleThe DBMS must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.
☐SV-206592r961398_ruleThe DBMS must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.
☐SV-206593r961401_ruleThe DBMS must provide an immediate real-time alert to appropriate support staff of all audit log failures.
☐SV-206594r961443_ruleThe DBMS must record time stamps, in audit records and application data, that can be mapped to Coordinated Universal Time (UTC, formerly GMT).
☐SV-206595r961446_ruleThe DBMS must generate time stamps, for audit records and application data, with a minimum granularity of one second.
☐SV-206596r981956_ruleThe DBMS must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.
☐SV-206597r961461_ruleThe DBMS must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
☐SV-206598r981958_ruleThe DBMS must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the DBMS or database(s).
☐SV-206599r961470_ruleThe DBMS must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.
☐SV-206600r1050788_ruleThe DBMS must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
☐SV-206601r961521_ruleThe DBMS must prohibit the use of cached authenticators after an organization-defined time period.
☐SV-206603r1193220_ruleThe DBMS must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.
☐SV-206604r1018552_ruleThe DBMS must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
☐SV-206605r1018553_ruleThe DBMS must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.
☐SV-206606r1137659_ruleThe DBMS must maintain a separate execution domain for each executing process.
☐SV-206607r961638_ruleThe DBMS must maintain the confidentiality and integrity of information during preparation for transmission.
☐SV-206608r961641_ruleThe DBMS must maintain the confidentiality and integrity of information during reception.
☐SV-206609r961656_ruleWhen invalid inputs are received, the DBMS must behave in a predictable and documented manner that reflects organizational and system objectives.
☐SV-206610r961677_ruleWhen updates are applied to the DBMS software, any software components that have been replaced or made unnecessary must be removed.
☐SV-206611r1137667_ruleSecurity-relevant software updates to the DBMS must be installed within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
☐SV-206612r961791_ruleThe DBMS must be able to generate audit records when security objects are accessed.
☐SV-206613r961791_ruleThe DBMS must generate audit records when unsuccessful attempts to access security objects occur.
☐SV-206614r961797_ruleThe DBMS must generate audit records when categories of information (e.g., classification levels/security levels) are accessed.
☐SV-206615r961797_ruleThe DBMS must generate audit records when unsuccessful attempts to access categories of information (e.g., classification levels/security levels) occur.
☐SV-206616r961800_ruleThe DBMS must generate audit records when privileges/permissions are added.
☐SV-206617r961800_ruleThe DBMS must generate audit records when unsuccessful attempts to add privileges/permissions occur.
☐SV-206618r961800_ruleThe DBMS must generate audit records when privileges/permissions are modified.
☐SV-206619r961800_ruleThe DBMS must generate audit records when unsuccessful attempts to modify privileges/permissions occur.
☐SV-206620r961803_ruleThe DBMS must generate audit records when security objects are modified.
☐SV-206621r961803_ruleThe DBMS must generate audit records when unsuccessful attempts to modify security objects occur.
☐SV-206622r961809_ruleThe DBMS must generate audit records when categories of information (e.g., classification levels/security levels) are modified.
☐SV-206623r961809_ruleThe DBMS must generate audit records when unsuccessful attempts to modify categories of information (e.g., classification levels/security levels) occur.
☐SV-206624r961812_ruleThe DBMS must generate audit records when privileges/permissions are deleted.
☐SV-206625r961812_ruleThe DBMS must generate audit records when unsuccessful attempts to delete privileges/permissions occur.
☐SV-206626r961818_ruleThe DBMS must generate audit records when security objects are deleted.
☐SV-206627r961818_ruleThe DBMS must generate audit records when unsuccessful attempts to delete security objects occur.
☐SV-206628r961821_ruleThe DBMS must generate audit records when categories of information (e.g., classification levels/security levels) are deleted.
☐SV-206629r961821_ruleThe DBMS must generate audit records when unsuccessful attempts to delete categories of information (e.g., classification levels/security levels) occur.
☐SV-206630r961824_ruleThe DBMS must generate audit records when successful logons or connections occur.
☐SV-206631r961824_ruleThe DBMS must generate audit records when unsuccessful logons or connection attempts occur.
☐SV-206632r961827_ruleThe DBMS must generate audit records for all privileged activities or other system-level access.
☐SV-206633r961827_ruleThe DBMS must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.
☐SV-206634r961830_ruleThe DBMS must generate audit records showing starting and ending time for user access to the database(s).
☐SV-206635r961833_ruleThe DBMS must generate audit records when concurrent logons/connections by the same user from different workstations occur.
☐SV-206636r961836_ruleThe DBMS must be able to generate audit records when successful accesses to objects occur.
☐SV-206637r961836_ruleThe DBMS must generate audit records when unsuccessful accesses to objects occur.
☐SV-206638r961839_ruleThe DBMS must generate audit records for all direct access to the database(s).
☐SV-206639r1137660_ruleThe DBMS must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to provision digital signatures.
☐SV-206640r1137661_ruleThe DBMS must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to generate and validate cryptographic hashes.
☐SV-206641r1137664_ruleThe DBMS must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.
☐SV-206642r961860_ruleThe DBMS must off-load audit data to a separate log management facility; this shall be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.
☐SV-206643r961863_ruleThe DBMS must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.
☐SV-233495r1117186_ruleThe DBMS must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.
☐SV-263602r982479_ruleThe DBMS must disable accounts when the accounts have expired.
☐SV-263603r982481_ruleThe DBMS must disable accounts when the accounts are no longer associated to a user.
☐SV-263604r982483_ruleThe DBMS must implement the capability to centrally review and analyze audit records from multiple components within the system.
☐SV-263605r982485_ruleThe DBMS must alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
☐SV-263606r981976_ruleThe DBMS must prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate recognized and approved by the organization.
☐SV-263607r982487_ruleThe DBMS must require users to be individually authenticated before granting access to the shared accounts or resources.
☐SV-263608r981982_ruleThe DBMS must implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.
☐SV-263609r982489_ruleThe DBMS must implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements.
☐SV-263610r981988_ruleThe DBMS must, for password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.
☐SV-263611r982491_ruleThe DBMS must, for password-based authentication, update the list of passwords on an organization-defined frequency.
☐SV-263612r982493_ruleThe DBMS must, for password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.
☐SV-263613r982495_ruleThe DBMS must, for password-based authentication, verify that when users create or update passwords, the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
☐SV-263614r982497_ruleThe DBMS must, for password-based authentication, require immediate selection of a new password upon account recovery.
☐SV-263615r982499_ruleThe DBMS must, for password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.
☐SV-263616r982501_ruleThe DBMS must, for password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.
☐SV-263617r982009_ruleThe DBMS must, for public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
☐SV-263618r982503_ruleThe DBMS must protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.
☐SV-263619r982505_ruleThe DBMS must include only approved trust anchors in trust stores or certificate stores managed by the organization.
☐SV-263620r982507_ruleThe DBMS must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.
☐SV-263621r982509_ruleThe DBMS must synchronize system clocks within and between systems or system components.
☐SV-263622r982511_ruleThe DBMS must compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.
☐SV-278969r1137670_ruleThe DBMS must be a version supported by the vendor.