STIGQter STIGQter: STIG Summary:

Microsoft Azure SQL Database Security Technical Implementation Guide

Version: 2

Release: 3 Benchmark Date: 02 Jul 2025

CheckedNameTitle
☐SV-255301r1043176_ruleAzure SQL Databases must integrate with Azure Active Directory for providing account management and automation for all users, groups, roles, and any other principals.
☐SV-255302r1112451_ruleAzure SQL Database must enforce approved authorizations for logical access to server information and system resources in accordance with applicable access control policies.
☐SV-255303r1112454_ruleAzure SQL Database must enforce approved authorizations for logical access to database information and system resources in accordance with applicable access control policies.
☐SV-255304r960864_ruleAzure SQL Database must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the database.
☐SV-255305r960864_ruleAzure SQL Database must protect against a user falsely repudiating by use of system-versioned tables (Temporal Tables).
☐SV-255306r960960_ruleDatabase objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to Azure SQL Database, etc.) must be owned by database/Azure SQL Database principals authorized for ownership.
☐SV-255307r960960_ruleThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to Azure SQL Database, etc.) must be restricted to authorized users.
☐SV-255308r961131_ruleThe Azure SQL Database must isolate security functions from nonsecurity functions.
☐SV-255309r961149_ruleAzure SQL Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
☐SV-255310r961158_ruleAzure SQL Database must check the validity of all data inputs except those specifically identified by the organization.
☐SV-255311r1112455_ruleThe Azure SQL Database and associated applications must reserve the use of dynamic code execution for situations that require it.
☐SV-255312r1112456_ruleThe Azure SQL Database and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
☐SV-255313r961269_ruleAzure SQL Database must associate organization-defined types of security labels having organization-defined security label values with information in storage.
☐SV-255314r961272_ruleAzure SQL Database must associate organization-defined types of security labels having organization-defined security label values with information in process.
☐SV-255315r961275_ruleAzure SQL Database must associate organization-defined types of security labels having organization-defined security label values with information in transmission.
☐SV-255316r961317_ruleAzure SQL Database must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.
☐SV-255317r961359_ruleAzure SQL Database must restrict execution of stored procedures and functions that utilize [execute as] to necessary cases only.
☐SV-255318r1018606_ruleAzure SQL Database must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.
☐SV-255319r961461_ruleAzure SQL Database must enforce access restrictions associated with changes to the configuration of the Azure SQL Database server or database(s).
☐SV-255320r962034_ruleAzure SQL Database must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements.
☐SV-255321r1018558_ruleAzure SQL Database must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
☐SV-255322r1018559_ruleAzure SQL Database must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.
☐SV-255323r961656_ruleWhen invalid inputs are received, the Azure SQL Database must behave in a predictable and documented manner that reflects organizational and system objectives.
☐SV-255324r960879_ruleThe Azure SQL Database must be configured to generate audit records for DOD-defined auditable events within all DBMS/database components.
☐SV-255325r960882_ruleAzure SQL Database must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
☐SV-255326r960885_ruleThe Azure SQL Database must be able to generate audit records when privileges/permissions are retrieved.
☐SV-255327r960885_ruleThe Azure SQL Database must be able to generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.
☐SV-255328r960888_ruleAzure SQL Database must initiate session auditing upon startup.
☐SV-255329r960909_ruleAzure SQL Database must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
☐SV-255330r960930_ruleThe audit information produced by Azure SQL Database must be protected from unauthorized read access.
☐SV-255331r960933_ruleThe audit information produced by Azure SQL Database must be protected from unauthorized modification.
☐SV-255332r960936_ruleThe audit information produced by Azure SQL Database must be protected from unauthorized deletion.
☐SV-255333r960963_ruleAzure SQL Database default demonstration and sample databases, database objects, and applications must be removed.
☐SV-255334r1043177_ruleThe Azure SQL Database must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
☐SV-255335r1051115_ruleAzure SQL Database must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
☐SV-255336r961044_ruleAzure SQL Database must map the PKI-authenticated identity to an associated user account.
☐SV-255337r961053_ruleAzure SQL Database must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).
☐SV-255338r961095_ruleAzure SQL Database must separate user functionality (including user interface services) from database management functionality.
☐SV-255339r961128_ruleAzure SQL Database must protect the confidentiality and integrity of all information at rest.
☐SV-255340r1043182_ruleAzure SQL Database must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
☐SV-255341r961353_ruleAzure SQL Database must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
☐SV-255343r961392_ruleAzure SQL Database must be able to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.
☐SV-255344r961398_ruleAzure SQL Database must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.
☐SV-255345r1018607_ruleAzure SQL Database must produce audit records of its enforcement of access restrictions associated with changes to the configuration of Azure SQL Database(s).
☐SV-255346r961470_ruleAzure SQL Database must only use approved firewall settings deemed by the organization to be secure, including denying public network access.
☐SV-255347r961470_ruleAzure SQL Database must only use approved firewall settings deemed by the organization to be secure, including denying azure services access to the server.
☐SV-255348r961638_ruleAzure SQL Database must maintain the confidentiality and integrity of information during preparation for transmission.
☐SV-255349r961641_ruleAzure SQL Database must maintain the confidentiality and integrity of information during reception.
☐SV-255350r961791_ruleAzure SQL DB must be able to generate audit records when security objects are accessed.
☐SV-255351r961791_ruleAzure SQL DB must generate audit records when unsuccessful attempts to access security objects occur.
☐SV-255352r961797_ruleAzure SQL DB must generate audit records when categorized information (e.g., classification levels/security levels) is accessed.
☐SV-255353r961797_ruleAzure SQL DB must generate audit records when unsuccessful attempts to access categories of information (e.g., classification levels/security levels) occur.
☐SV-255354r961800_ruleAzure SQL DB must generate audit records when privileges/permissions are added.
☐SV-255355r961800_ruleAzure SQL DB must generate audit records when unsuccessful attempts to add privileges/permissions occur.
☐SV-255356r961800_ruleAzure SQL DB must generate audit records when privileges/permissions are modified.
☐SV-255357r961800_ruleAzure SQL DB must generate audit records when unsuccessful attempts to modify privileges/permissions occur.
☐SV-255358r961803_ruleAzure SQL Database must generate audit records when security objects are modified.
☐SV-255359r961803_ruleAzure SQL DB must generate audit records when unsuccessful attempts to modify security objects occur.
☐SV-255360r961809_ruleAzure SQL Database must generate audit records when categorized information (e.g., classification levels/security levels) is modified.
☐SV-255361r961809_ruleAzure SQL Database must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.
☐SV-255362r961812_ruleAzure SQL Database must generate audit records when privileges/permissions are deleted.
☐SV-255363r961812_ruleAzure SQL Database must generate audit records when unsuccessful attempts to delete privileges/permissions occur.
☐SV-255364r961818_ruleAzure SQL Database must generate audit records when security objects are deleted.
☐SV-255365r961818_ruleAzure SQL Database must generate audit records when unsuccessful attempts to delete security objects occur.
☐SV-255366r961821_ruleAzure SQL Database must generate audit records when categories of information (e.g., classification levels/security levels) are deleted.
☐SV-255367r961821_ruleAzure SQL Database must generate audit records when unsuccessful attempts to delete categories of information (e.g., classification levels/security levels) occur.
☐SV-255368r961824_ruleAzure SQL Database must generate audit records when successful logons or connections occur.
☐SV-255369r961824_ruleAzure SQL Database must generate audit records when unsuccessful logons or connection attempts occur.
☐SV-255370r961827_ruleAzure SQL Database must generate audit records for all privileged activities or other system-level access.
☐SV-255371r961827_ruleAzure SQL Database must generate audit records for all unsuccessful attempts to execute privileged activities or other system-level access.
☐SV-255372r961830_ruleAzure SQL Database must generate audit records when concurrent logons/connections by the same user from different workstations occur.
☐SV-255373r961833_ruleAzure SQL Database must generate audit records when concurrent logons/connections by the same user from different workstations occur.
☐SV-255374r961836_ruleAzure SQL Database must be able to generate audit records when successful accesses to objects occur.
☐SV-255375r961836_ruleAzure SQL Database must generate audit records when unsuccessful accesses to objects occur.
☐SV-255376r961839_ruleAzure SQL Database must generate audit records for all direct access to the database(s).
☐SV-255377r961860_ruleAzure SQL Database must offload audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.