SQL4-00-014000 - SQL Server and/or the operating system must protect its audit configuration from unauthorized modification.

CAT|II

CCI|CCI-001494

Group-ID|V-67803

Rule-ID|SV-213824r395832_rule

STIG-ID|SQL4-00-014000

STIG-Legacy|SV-82293

STIG-Legacy|V-67803

Vuln-ID|V-213824

SQL4-00-014100 - SQL Server and the operating system must protect SQL Server audit features from unauthorized removal.

CCI|CCI-001495

Group-ID|V-67805

Rule-ID|SV-213825r395835_rule

STIG-ID|SQL4-00-014100

STIG-Legacy|SV-82295

STIG-Legacy|V-67805

Vuln-ID|V-213825

SQL4-00-015350 - Software, applications, and configuration files that are part of, or related to, the SQL Server  installation must be monitored to discover unauthorized changes.

800-53|AC-6(7)

800-53|CM-6

CCI|CCI-001499

CSCv6|3.1

Group-ID|V-67807

Rule-ID|SV-213827r395850_rule

STIG-ID|SQL4-00-015350

STIG-Legacy|SV-82297

STIG-Legacy|V-67807

Vuln-ID|V-213827

SQL4-00-015400 - SQL Server software installation account(s) must be restricted to authorized users.

Group-ID|V-67811

Rule-ID|SV-213828r395850_rule

STIG-ID|SQL4-00-015400

STIG-Legacy|SV-82301

STIG-Legacy|V-67811

Vuln-ID|V-213828

SQL4-00-015500 - Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

CAT|III

Group-ID|V-67813

Rule-ID|SV-213829r395850_rule

STIG-ID|SQL4-00-015500

STIG-Legacy|SV-82303

STIG-Legacy|V-67813

Vuln-ID|V-213829

SQL4-00-016500 - SQL Server must have the SQL Server Data Tools (SSDT) software component removed if it is unused.

800-53|CM-7(4)

CCI|CCI-000381

Group-ID|V-67823

Rule-ID|SV-213833r395853_rule

STIG-ID|SQL4-00-016500

STIG-Legacy|SV-82313

STIG-Legacy|V-67823

Vuln-ID|V-213833

SQL4-00-016600 - SQL Server must have the SQL Server Reporting Services (SSRS) software component removed if it is unused.

Group-ID|V-67825

Rule-ID|SV-213834r395853_rule

STIG-ID|SQL4-00-016600

STIG-Legacy|SV-82315

STIG-Legacy|V-67825

Vuln-ID|V-213834

SQL4-00-016700 - SQL Server must have the SQL Server Integration Services (SSIS) software component removed if it is unused.

Group-ID|V-67827

Rule-ID|SV-213835r395853_rule

STIG-ID|SQL4-00-016700

STIG-Legacy|SV-82317

STIG-Legacy|V-67827

Vuln-ID|V-213835

SQL4-00-016800 - SQL Server must have the SQL Server Analysis Services (SSAS) software component removed if it is unused.

Group-ID|V-67829

Rule-ID|SV-213836r395853_rule

STIG-ID|SQL4-00-016800

STIG-Legacy|SV-82319

STIG-Legacy|V-67829

Vuln-ID|V-213836

SQL4-00-016805 - SQL Server must have the SQL Server Distributed Replay Client software component removed if it is unused.

Group-ID|V-67831

Rule-ID|SV-213837r395853_rule

STIG-ID|SQL4-00-016805

STIG-Legacy|SV-82321

STIG-Legacy|V-67831

Vuln-ID|V-213837

SQL4-00-016810 - SQL Server must have the SQL Server Distributed Replay Controller software component removed if it is unused.

Group-ID|V-67833

Rule-ID|SV-213838r395853_rule

STIG-ID|SQL4-00-016810

STIG-Legacy|SV-82323

STIG-Legacy|V-67833

Vuln-ID|V-213838

SQL4-00-016815 - SQL Server must have the Full-Text Search software component removed if it is unused.

Group-ID|V-67835

Rule-ID|SV-213839r395853_rule

STIG-ID|SQL4-00-016815

STIG-Legacy|SV-82325

STIG-Legacy|V-67835

Vuln-ID|V-213839

SQL4-00-016820 - SQL Server must have the Master Data Services software component removed if it is unused.

Group-ID|V-67837

Rule-ID|SV-213840r395853_rule

STIG-ID|SQL4-00-016820

STIG-Legacy|SV-82327

STIG-Legacy|V-67837

Vuln-ID|V-213840

SQL4-00-016826 - SQL Server must have the SQL Server Replication software component removed if it is unused.

Group-ID|V-67839

Rule-ID|SV-213841r395853_rule

STIG-ID|SQL4-00-016826

STIG-Legacy|SV-82329

STIG-Legacy|V-67839

Vuln-ID|V-213841

SQL4-00-016830 - SQL Server must have the Data Quality Client software component removed if it is unused.

Group-ID|V-67841

Rule-ID|SV-213842r395853_rule

STIG-ID|SQL4-00-016830

STIG-Legacy|SV-82331

STIG-Legacy|V-67841

Vuln-ID|V-213842

SQL4-00-016845 - SQL Server must have the Client Tools SDK software component removed if it is unused.

Group-ID|V-67845

Rule-ID|SV-213844r395853_rule

STIG-ID|SQL4-00-016845

STIG-Legacy|SV-82335

STIG-Legacy|V-67845

Vuln-ID|V-213844

SQL4-00-016850 - SQL Server must have the Management Tools software component removed if it is unused.

Group-ID|V-67847

Rule-ID|SV-213845r395853_rule

STIG-ID|SQL4-00-016850

STIG-Legacy|SV-82337

STIG-Legacy|V-67847

Vuln-ID|V-213845

SQL4-00-031100 - SQL Server must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.

800-53|SC-13

CAT|I

CCI|CCI-000803

CCI|CCI-002450

Group-ID|V-67871

Rule-ID|SV-213862r397606_rule

STIG-ID|SQL4-00-031100

STIG-Legacy|SV-82361

STIG-Legacy|V-67871

Vuln-ID|V-213862

SQL4-00-033600 - SQL Server must produce time stamps that can be mapped to Coordinated Universal Time (UTC, formerly GMT).

CCI|CCI-001890

Group-ID|V-67897

Rule-ID|SV-213871r399928_rule

STIG-ID|SQL4-00-033600

STIG-Legacy|SV-82387

STIG-Legacy|V-67897

Vuln-ID|V-213871

SQL4-00-034200 - SQL Server must disable communication protocols not required for operation.

CCI|CCI-001762

Group-ID|V-67905

Rule-ID|SV-213875r400015_rule

STIG-ID|SQL4-00-034200

STIG-Legacy|SV-82395

STIG-Legacy|V-67905

Vuln-ID|V-213875

SQL4-00-034800 - SQL Server must implement and/or support cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.

CCI|CCI-002476

Group-ID|V-67907

Rule-ID|SV-213876r400384_rule

STIG-ID|SQL4-00-034800

STIG-Legacy|SV-82397

STIG-Legacy|V-67907

Vuln-ID|V-213876

SQL4-00-035400 - Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).

CCI|CCI-002605

Group-ID|V-67913

Rule-ID|SV-213879r400525_rule

STIG-ID|SQL4-00-035400

STIG-Legacy|SV-82403

STIG-Legacy|V-67913

Vuln-ID|V-213879

SQL4-00-039100 - The SQL Server Browser service must be disabled if its use is not necessary..

800-53|CM-7

CCI|CCI-000366

CSCv6|9.1

Group-ID|V-70623

Rule-ID|SV-213898r401224_rule

STIG-ID|SQL4-00-039100

STIG-Legacy|SV-85245

STIG-Legacy|V-70623

Vuln-ID|V-213898

Detections

Analytics

DISA STIG SQL Server 2014 Instance OS Audit v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Feb 7, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated. Variables updated.
Revision 1.2 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.1 Apr 25, 2022 Miscellaneous References updated.