# stig_rules

vuln_id: V-245852
rule_id: SV-245852r1136794_rule
severity: CAT III
title: Position of Trust - Knowledge of Responsibility to Self Report Derogatory Information
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to inform personnel of the expected standards of conduct while holding a position of trust and their responsibility to self-report derogatory information to the organization security manager can result in conduct by the individual that will require them being removed from that position

  REFERENCES:
  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraph 7.f. and Enclosure C, paragraph 4.e. and 5.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PS-1, PS-6, AT-1, AT-3 and PL-4.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), April 3, 2017, Paragraphs 7.4. ADJUDICATIVE GUIDELINES, 9.2., 11.2. a. (1), (2), (3) and b. 12.1. 

  White House Memorandum and Intelligence Community Policy Guidance 704.2, December 29, 2005, Subject: Adjudicative Guidelines

  DOD 5200.2-R, Personnel Security Program, Chapter 9, paragraph C9.1.4 - Individual Responsibility (rescinded but provided for purpose of historical reference).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that Individuals are familiar with pertinent personnel security regulations, such as DOD Manual 5200.02 and are aware of standards of conduct required of persons holding positions of trust, including (and especially) the requirement to report derogatory information to their local security manager.
   
  Compliance can be validated by:

  1. Ensuring that organizational personnel security initial and annual refresher training records include the topic of standards of conduct for individuals holding a security clearance in addition to covering each individual's responsibility to self-report derogatory information to their security manager.
   
  2. Conducting a general survey of multiple employees to ascertain their familiarity with personal responsibilities while holding a security clearance.

check_text:
  Check to ensure that Individuals are familiar with pertinent personnel security regulations, such as DOD Manual 5200.02 and are aware of standards of conduct required of persons holding positions of trust, including (and especially) the requirement to report derogatory information to their local security manager.

  This check can be validated by:

  1. Checking organizational personnel security initial and annual refresher training records to ensure that the topic of standards of conduct for individuals holding a security clearance and each individual's responsibility to self- report derogatory information to their security manager are covered. 

  2. Conducting a general survey of multiple employees to determine if they understand the standards of conduct and their responsibility to self-report. 

  The results should be based on a compilation of survey results rather than a single instance of an employee who is not familiar with personal responsibilities (standards and self-reporting).
   
  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments AND is applicable to a field/mobile environment.


vuln_id: V-245853
rule_id: SV-245853r1136797_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Position of Trust - Local Policy Covering Employee Personal Standards of Conduct and Responsibilities

description:
  <VulnDiscussion>Failure to inform personnel of the expected standards of conduct while holding a position of trust can result in conduct by the individual that will require them being removed from that position and/or result in an untrustworthy person continuing in a position of trust without proper vetting of new derogatory information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraph 7.f. and Enclosure C, paragraph 4.e. and 5.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PS-1, PS-6, AT-1, AT-3 and PL-4.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), April 3, 2017, Paragraphs 7.4. ADJUDICATIVE GUIDELINES, 9.2., 11.2. a. (1), (2), (3) and b. 12.1. 

  White House Memorandum and Intelligence Community Policy Guidance 704.2, December 29, 2005, Subject: Adjudicative Guidelines

  DOD 5200.2-R, Personnel Security Program, Chapter 9, paragraph C9.1.2 - Management Responsibility (rescinded but provided for purpose of historical perspective/reference).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that a local policy exists and is readily available to employees that informs them about pertinent security regulations and standards of conduct required of persons holding positions of trust, including (and especially) the requirement to report derogatory information to their local security manager.
   
  SOPs should be readily available to all employees in a common reading library or more efficiently, accessible on line in a common file or organization intranet.

check_text:
  Check to ensure that a local policy exists and is readily available to employees that informs them about pertinent security regulations and standards of conduct required of persons holding positions of trust, including (and especially) the requirement to report derogatory information to their local security manager.
   
  SOPs should be readily available to all employees in a common reading library or more efficiently, accessible on line in a common file or organization intranet.
       
  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245854
rule_id: SV-245854r1136800_rule
severity: CAT III
title: Position of Trust - Training Covering Employee Standards of Conduct and Personal Responsibilities
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to inform personnel of the expected standards of conduct while holding a position of trust can result in conduct by the individual that will require them being removed from that position or result in a person no longer meeting standards criteria continuing to hold a position of trust without proper vetting for suitability.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraph 7.f. & 11. and Enclosure C, paragraph 4.e. & 5.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PS-1, PS-6, AT-1, AT-3 and PL-4.

  DOD 5220.22-M (NISPOM), Incorporating Change 2, 18 May 2016, Chapter 1, Section 2, paragraph 1-205 and Chapter 3.

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), April 3, 2017, Paragraphs 9.2.,11.2.a. and 12.1.

  DOD 5200.2-R, Personnel Security Program, Chapter 2, paragraph C2.2., Chapter 9, paragraphs C9.1.4. & C9.2.3. (rescinded but provided for purpose of historical perspective/reference).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), April 3, 2017, Paragraphs 9.2.,11.2.a. and 12.1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Information: 
  The effectiveness of an individual in meeting security responsibilities is proportional to the degree to which the individual understands them. Thus, an integral part of the DOD security program is the indoctrination and continuous training of individuals on their security responsibilities. 

  FIX:
  Ensure that Standards of Conduct and Personal Responsibilities are covered in initial, annual refresher and termination training/briefings.

check_text:
  General Information: The effectiveness of an individual in meeting security responsibilities is proportional to the degree to which the individual understands them. Thus, an integral part of the DOD security program is the indoctrination and continuous training of individuals on their security responsibilities. 

  CHECK to ensure that Standards of Conduct and Personal Responsibilities are covered in initial, annual refresher and termination training/briefings. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-221558
rule_id: SV-221558r960804_rule
severity: CAT II
title: Firewall traversal from remote host must be disabled.
cci: CCI-001414
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Remote connections should never be allowed that bypass the firewall, as there is no way to verify if they can be trusted. Enables usage of STUN and relay servers when remote clients are trying to establish a connection to this machine. If this setting is enabled, then remote clients can discover and connect to this machine even if they are separated by a firewall. If this setting is disabled and outgoing UDP connections are filtered by the firewall, then this machine will only allow connections from client machines within the local network. If this policy is left not set the setting will be enabled.	</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the group policy editor tool with gpedit.msc 
   2. Navigate to Policy Path: Computer Configuration\Administrative\Templates\Google\Google Chrome\Remote Access
   Policy Name: Enable firewall traversal from remote access host
   Policy State: Disabled
   Policy Value: N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If RemoteAccessHostFirewallTraversal is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

  Windows registry:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the RemoteAccessHostFirewallTraversal value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221559
rule_id: SV-221559r961083_rule
severity: CAT II
title: Site tracking users location must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Website tracking is the practice of gathering information as to which websites were accesses by a browser. The common method of doing this is to have a website create a tracking cookie on the browser.   If the information of what sites are being accessed is made available to unauthorized persons, this violates confidentiality requirements, and over time poses a significant OPSEC issue. This policy setting allows you to set whether websites are allowed to track the user’s physical location. Tracking the user’s physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location.	
     1 = Allow sites to track the user’s physical location	
     2 = Do not allow any site to track the user’s physical location	
     3 = Ask whenever a site wants to track the user’s physical location</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:    
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\    
     Policy Name: Default geolocation setting    
     Policy State: Enabled    
     Policy Value: Do not allow any site to track the users' physical location

check_text:
  Universal method:               
     1. In the omnibox (address bar) type chrome://policy             
     2. If DefaultGeolocationSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the DefaultGeolocationSetting value name does not exist or its value data is not set to 2, then this is a finding.


vuln_id: V-221561
rule_id: SV-221561r960963_rule
severity: CAT II
title: Sites ability to show pop-ups must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Chrome allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you disable this policy setting, scripts can continue to create pop-up windows, and pop-ups that hide other windows. Recommend configuring this setting to ‘2’ to help prevent malicious websites from controlling the pop-up windows or fooling users into clicking on the wrong window.  If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.  If this policy is left not set, 'BlockPopups' will be used and the user will be able to change it.    
     1 = Allow all sites to show pop-ups    
     2 = Do not allow any site to show pop-ups</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\
      Policy Name: Default popups setting
      Policy State: Enabled
      Policy Value: Do not allow any site to show popups

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy 
   2. If DefaultPopupsSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the value name DefaultPopupsSetting does not exist or its value data is not set to 2, then this is a finding.

  Note:  If AO Approved exceptions to this rule have been enabled, this is not a finding.


vuln_id: V-221562
rule_id: SV-221562r960879_rule
severity: CAT II
title: Extensions installation must be blocklisted by default.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Extensions are developed by third party sources and are designed to extend Google Chrome's functionality. An extension can be made by anyone, to do and access almost anything on a system; this means they pose a high risk to any system that would allow all extensions to be installed by default. Allows you to specify which extensions the users can NOT install. Extensions already installed will be removed if blocklisted. A blocklist value of '*' means all extensions are blocklisted unless they are explicitly listed in the allowlist. If this policy is left not set the user can install any extension in Google Chrome.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the group policy editor tool with gpedit.msc 
   2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\
   Policy Name: Configure extension installation blocklist
   Policy State: Enabled
   Policy Value: *

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy 
   2. If ExtensionInstallBlocklist is not displayed under the Policy Name column or it is not set to * under the Policy Value column, then this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist
   3. If the a registry value name of 1 does not exist under that key or its value is not set to *, then this is a finding.


vuln_id: V-221563
rule_id: SV-221563r1015468_rule
severity: CAT III
title: Extensions that are approved for use must be allowlisted.
cci: CCI-001170
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>The allowlist should only contain organizationally approved extensions. This is to prevent a user from accidently allowlisitng a malicious extension. This policy allows you to specify which extensions are not subject to the blacklist. A blacklist value of ‘*’ means all extensions are blacklisted and users can only install extensions listed in the allowlist. By default, no extensions are allowlisted. If all extensions have been blacklisted by policy, then the allowlist policy can be used to allow specific extensions to be installed. Administrators should determine which extensions should be allowed to be installed by their users. If no extensions are allowlisted, then no extensions can be installed when combined with blacklisting all extensions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\
  Policy Name: Configure extension installation allowlist
  Policy State: Enabled
  Policy Value: oiigbmnaadbkfbmpbfijlflahbdbdgdf

  Note: oiigbmnaadbkfbmpbfijlflahbdbdgdfis the extension ID for scriptno (a commonly used Chrome extension), other extension IDs may vary.

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If ExtensionInstallAllowlist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding.

  Windows method:
  1. Start regedit
  2. Navigate to the key HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist
  3. If the ExtensionInstallAllowlist key is not set to 1 and oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator-approved extension IDs, then this is a finding.


vuln_id: V-221564
rule_id: SV-221564r960963_rule
severity: CAT II
title: The default search providers name must be set.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Specifies the name of the default search provider that is to be used, if left empty or not set, the host name specified by the search URL will be used. This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled. When doing internet searches it is important to use an encrypted connection via https.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\
      Policy Name: Default search provider name
      Policy State: Enabled
      Policy Value: set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted)

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If DefaultSearchProviderName is displayed under the Policy Name column or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted) under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the DefaultSearchProviderName value name does not exist or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted), then this is a finding.


vuln_id: V-221565
rule_id: SV-221565r960963_rule
severity: CAT II
title: The default search provider URL must be set to perform encrypted searches.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for. This option must be set when the 'DefaultSearchProviderEnabled' policy is enabled and will only be respected if this is the case.  When doing internet searches it is important to use an encrypted connection via https.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is on the SIPRNet, this requirement is NA.

  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\.
  - Policy Name: Default search provider search URL
  - Policy State: Enabled
  - Policy Value: Must be set to an organization-approved encrypted search string 
  (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} )

check_text:
  If the system is on the SIPRNet, this requirement is NA.

  Universal method: 
  1. In the omnibox (address bar) type chrome://policy.
  2. If DefaultSearchProviderSearchURL is not displayed under the Policy Name column or it is not set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit.
  2. Navigate to HKLM\Software\Policies\Google\Chrome\.
  3. If the DefaultSearchProviderSearchURL value name does not exist or its value data is not set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ), this is a finding.


vuln_id: V-221566
rule_id: SV-221566r960963_rule
severity: CAT II
title: Default search provider must be enabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Policy enables the use of a default search provider. If you enable this setting, a default search is performed when the user types text in the omnibox that is not a URL. You can specify the default search provider to be used by setting the rest of the default search policies. If these are left empty, the user can choose the default provider. If you disable this setting, no search is performed when the user enters non-URL text in the omnibox. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, the default search provider is enabled, and the user will be able to set the search provider list.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\
      Policy Name: Enable the default search provider
      Policy State: Enabled
      Policy Value: N/A

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy 
   2. If DefaultSearchProviderEnabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the DefaultSearchProviderEnabled value name does not exist or its value data is not set to 1, then this is a finding.

  Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.


vuln_id: V-221567
rule_id: SV-221567r960963_rule
severity: CAT II
title: The Password Manager must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enables saving passwords and using saved passwords in Google Chrome. Malicious sites may take advantage of this feature by using hidden fields gain access to the stored information. If you enable this setting, users can have Google Chrome memorize passwords and provide them automatically the next time they log in to a site. If you disable this setting, users are not able to save passwords or use already saved passwords. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it. ListPassword manager should not be used as it stores passwords locally.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Password Manager\
  Policy Name: Enable Saving Passwords to the Password Manager
  Policy State: Disabled
  Policy Value: N/A

check_text:
  Universal method:           
     1. In the omnibox (address bar) type chrome://policy           
     2. If PasswordManagerEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the PasswordManagerEnabled value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221570
rule_id: SV-221570r960921_rule
severity: CAT II
title: Background processing must be disabled.
cci: CCI-001695
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Determines whether a Google Chrome process is started on OS login that keeps running when the last browser window is closed, allowing background apps to remain active. The background process displays an icon in the system tray and can always be closed from there. If this policy is set to True, background mode is enabled and cannot be controlled by the user in the browser settings. If this policy is set to False, background mode is disabled and cannot be controlled by the user in the browser settings. If this policy is left unset, background mode is initially disabled and can be controlled by the user in the browser settings.' - Google Chrome Administrators Policy ListThis setting, if enabled, allows Google Chrome to run at all times. There is two reasons that this is not wanted. First, it can tie up system resources that might otherwise be needed. Second, it does not make it obvious to the user that it is running and poorly written extensions could cause instability on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
      Policy Name: Continue running background apps when Google Chrome is closed
      Policy State: Disabled
      Policy Value: N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If BackgroundModeEnabled is not displayed under the Policy Name column and it is not set to false under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the BackgroundModeEnabled value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221571
rule_id: SV-221571r987620_rule
severity: CAT II
title: Google Data Synchronization must be disabled.
cci: CCI-001374
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Disables data synchronization in Google Chrome using Google-hosted synchronization services and prevents users from changing this setting. If you enable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the user will be able to enable Google Sync.  Google Sync is used to sync information between different user devices, this data is then stored on Google owned servers. The synced data may consist of information such as email, calendars, viewing history, etc. This feature must be disabled because the organization does not have control over the servers the data is stored on.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
      Policy Name: Disable synchronization of data with Google
      Policy State: Enabled
      Policy Value: N/A

check_text:
  Universal method:        
    1. In the omnibox (address bar) type chrome://policy        
    2. If SyncDisabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the SyncDisabled value name does not exist or its value data is not set to 1, then this is a finding.


vuln_id: V-221572
rule_id: SV-221572r960963_rule
severity: CAT II
title: The URL protocol schema javascript must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Each access to a URL is handled by the browser according to the URL's "scheme". The "scheme" of a URL is the section before the ":". The term "protocol" is often mistakenly used for a "scheme". The difference is that the scheme is how the browser handles a URL and the protocol is how the browser communicates with a service.  If a scheme or its associated protocol used by a browser is insecure or obsolete, vulnerabilities can be exploited resulting in exposed data or unrestricted access to the browser's system.   The browser must be configured to disable the use of insecure and obsolete schemas (protocols).
  This policy disables the listed protocol schemes in Google Chrome, URLs using a scheme from this list will not load and cannot be navigated to. If this policy is left not set or the list is empty all schemes will be accessible in Google Chrome.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc. 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Block access to a list of URLs.
  - Policy State: Enabled
  - Policy Value 1: javascript://*

check_text:
  Universal method:
  1. In the omnibox (address bar) type chrome://policy.
  2. If URLBlocklist is not displayed under the Policy Name column or it is not set to javascript://* under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit.
  2. Navigate to HKLM\Software\Policies\Google\Chrome\URLBlocklist.
  3. If the URLBlocklist key does not exist, or the does not contain entries 1 set to javascript://*, this is a finding.


vuln_id: V-221573
rule_id: SV-221573r987620_rule
severity: CAT II
title: Cloud print sharing must be disabled.
cci: CCI-001374
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Policy enables Google Chrome to act as a proxy between Google Cloud Print and legacy printers connected to the machine. If this setting is enabled or not configured, users can enable the cloud print proxy by authentication with their Google account. If this setting is disabled, users cannot enable the proxy, and the machine will not be allowed to share it’s printers with Google Cloud Print. If this policy is not set, this will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the group policy editor tool with gpedit.msc 
   2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Printing
   Policy Name: Enable Google Cloud Print proxy
   Policy State: Disabled
   Policy Value: N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If CloudPrintProxyEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the CloudPrintProxyEnabled value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221574
rule_id: SV-221574r961863_rule
severity: CAT II
title: Network prediction must be disabled.
cci: CCI-000366
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enables network prediction in Google Chrome and prevents users from changing this setting. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be disabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Enable network prediction
  Policy State: Enabled
  Policy Value: Do not predict network actions on any network connection

check_text:
  Universal method:
  1. In the omnibox (address bar) type chrome://policy
  2. If "NetworkPredictionOptions" is not displayed under the “Policy Name” column or it is not set to "2" under the “Policy Value” column, this is a finding.
  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the "NetworkPredictionOptions" value name does not exist or its value data is not set to "2," this is a finding.


vuln_id: V-221575
rule_id: SV-221575r960963_rule
severity: CAT II
title: Metrics reporting to Google must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enables anonymous reporting of usage and crash-related data about Google Chrome to Google and prevents users from changing this setting. If you enable this setting, anonymous reporting of usage and crash-related data is sent to Google. A crash report could contain sensitive information from the computer's memory. If you disable this setting, anonymous reporting of usage and crash-related data is never sent to Google. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the setting will be what the user chose upon installation / first run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
      Policy Name: Enable reporting of usage and crash-related data
      Policy State: Disabled
      Policy Value: N/A

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy 
   2. If MetricsReportingEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the MetricsReportingEnabled value name does not exist or its value data is not set to 0, then this is a finding.

  Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.


vuln_id: V-221576
rule_id: SV-221576r960963_rule
severity: CAT II
title: Search suggestions must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Search suggestion should be disabled as it could lead to searches being conducted that were never intended to be made. Enables search suggestions in Google Chrome's omnibox and prevents users from changing this setting. If you enable this setting, search suggestions are used. If you disable this setting, search suggestions are never used. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
      Policy Name: Enable search suggestions
      Policy State: Disabled
      Policy Value: N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If SearchSuggestEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the SearchSuggestEnabled value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221577
rule_id: SV-221577r960963_rule
severity: CAT II
title: Importing of saved passwords must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Importing of saved passwords should be disabled as it could lead to unencrypted account passwords stored on the system from another browser to be viewed. This policy forces the saved passwords to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog. If disabled, the saved passwords are not imported. If it is not set, the user may be asked whether to import, or importing may happen automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
     Policy Name: Import saved passwords from default browser on first run
     Policy State: Disabled
     Policy Value: N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If ImportSavedPasswords is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the ImportSavedPasswords value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221578
rule_id: SV-221578r960864_rule
severity: CAT II
title: Incognito mode must be disabled.
cci: CCI-000166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Incognito mode allows the user to browse the Internet without recording their browsing history/activity.  From a forensics perspective, this is unacceptable.  Best practice requires that browser history is retained.  The "IncognitoModeAvailability" setting controls whether the user may utilize Incognito mode in Google Chrome. If 'Enabled' is selected or the policy is left unset, pages may be opened in Incognito mode. If 'Disabled' is selected, pages may not be opened in Incognito mode. If 'Forced' is selected, pages may be opened ONLY in Incognito mode.   
     0 = Incognito mode available.    
     1 = Incognito mode disabled.    
     2 = Incognito mode forced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
      Policy Name: Incognito mode availability
      Policy State: Enabled
      Policy Value: Incognito mode disabled

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If IncognitoModeAvailability is not displayed under the Policy Name column or it is not set to 1 under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the IncognitoModeAvailability value name does not exist or its value data is not set to 1, then this is a finding.


vuln_id: V-221579
rule_id: SV-221579r961893_rule
severity: CAT II
title: Online revocation checks must be performed.
cci: CCI-000185
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>By setting this policy to true, the previous behavior is restored and online OCSP/CRL checks will be performed. If the policy is not set, or is set to false, then Chrome will not perform online revocation checks. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the group policy editor tool with gpedit.msc 
   2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
   Policy Name: Enable online OCSP/CRL checks
   Policy State: Enabled
   Policy Value: N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If EnableOnlineRevocationChecks is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the EnableOnlineRevocationChecks value name does not exist or its value data is not set to 1, then this is a finding.


vuln_id: V-221580
rule_id: SV-221580r961083_rule
severity: CAT II
title: Safe Browsing must be enabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Allows you to control whether Google Chrome's Safe Browsing feature is enabled and the mode it operates in.

  If this policy is set to 'NoProtection' (value 0), Safe Browsing is never active.

  If this policy is set to 'StandardProtection' (value 1, which is the default), Safe Browsing is always active in the standard mode.

  If this policy is set to 'EnhancedProtection' (value 2), Safe Browsing is always active in the enhanced mode, which provides better security, but requires sharing more browsing information with Google.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the “group policy editor” tool with gpedit.msc
   2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Safe Browsing Settings
   Policy Name: Safe Browsing Protection Level
   Policy State: Enabled
   Policy Value: "(1) Safe Browsing is active in the standard mode", or "(2) Safe Browsing is active in the enhanced mode. This mode provides better security, but requires sharing more browsing information with Google".

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy 
   2. If SafeBrowsingProtectionLevel is not displayed under the Policy Name column or it is not set to 1 or 2 under the Policy Value column, then this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the SafeBrowsingProtectionLevel value name does not exist or its value data is not set to 1 or 2, then this is a finding.


vuln_id: V-221581
rule_id: SV-221581r961128_rule
severity: CAT II
title: Browser history must be saved.
cci: CCI-001199
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>This policy disables saving browser history in Google Chrome and prevents users from changing this setting. If this setting is enabled, browsing history is not saved. If this setting is disabled or not set, browsing history is saved.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
     1. Open the group policy editor tool with gpedit.msc   
     2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
      Policy Name: Disable saving browser history
      Policy State: Disabled
      Policy Value:  N/A

check_text:
  Universal method:        
     1. In the omnibox (address bar) type chrome://policy        
     2. If the policy 'SavingBrowserHistoryDisabled' is not shown or is not set to false, then this is a finding.

  Windows method:
     1. Start regedit
     2. Navigate to HKLM\Software\Policies\Google\Chrome\
     3. If the SavingBrowserHistoryDisabled value name does not exist or its value data is not set to 0, then this is a finding.


vuln_id: V-221584
rule_id: SV-221584r961683_rule
severity: CAT II
title: The version of Google Chrome running on the system must be a supported version.
fix_text: Install a supported version of Google Chrome.
cci: CCI-002605
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Google Chrome is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the browser can introduce security vulnerabilities to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://settings/help
  2. Cross-reference the build information displayed with the Google Chrome site to identify, at minimum, the oldest supported build available.  As of July 2019, this is 74.x.x.
  3. If the installed version of Chrome is not supported by Google, this is a finding.


vuln_id: V-221586
rule_id: SV-221586r960879_rule
severity: CAT II
title: Deletion of browser history must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the group policy editor tool with gpedit.msc 
   2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
   Policy Name: Enable deleting browser and download history
   Policy State: Disabled
   Policy Value: N/A

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy 
   2. If the policy "AllowDeletingBrowserHistory" is not shown or is not set to false, this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the "AllowDeletingBrowserHistory" value name does not exist or its value data is not set to "0",  this is a finding.


vuln_id: V-221587
rule_id: SV-221587r960879_rule
severity: CAT II
title: Prompt for download location must be enabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>If the policy is enabled, the user will be asked where to save each file before downloading. If the policy is disabled, downloads will start immediately, and the user will not be asked where to save the file. If the policy is not configured, the user will be able to change this setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc
  2. Navigate to Policy Path:  Computer Configuration\Administrative Templates\Google\Google Chrome\
   Policy Name: Ask where to save each file before downloading
   Policy State:  Enabled
   Policy Value: N/A

check_text:
  Universal method:
  1. In the omnibox (address bar) type chrome:// policy
  2. If "PromptForDownloadLocation" is not displayed under the "Policy Name" column or it is not set to "true" under the "Policy Value" column, then this is a finding.
  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the "PromptForDownloadLocation" value name does not exist or its value data is not set to "1", this is a finding.


vuln_id: V-221588
rule_id: SV-221588r1106670_rule
severity: CAT II
title: Download restrictions must be configured.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Setting the policy means users cannot bypass download security decisions. There are many types of download warnings within Chrome, which roughly break down into these categories:
  - Malicious, as flagged by the Safe Browsing server.
  - Uncommon or unwanted, as flagged by the Safe Browsing server.
  - A dangerous file type (e.g., all SWF downloads and many EXE downloads).

  Setting the policy blocks different subsets of these, depending on its value:

  0 = No special restrictions. Default.
  1 = Block malicious downloads and dangerous file types.
  2 = Block malicious downloads, uncommon or unwanted downloads, and dangerous file types.
  3 = Block all downloads.
  4 = Block malicious downloads. Recommended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is on the SIPRNet, this requirement is Not Applicable.

  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Allow download restrictions
  Policy State: 1, 2, or 4
  Policy Value: N/A

check_text:
  If the system is on the SIPRNet, this requirement is Not Applicable.

  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "DownloadRestrictions" is not displayed under the "Policy Name" column or it is set to "0", this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "DownloadRestrictions" value name does not exist or its value data is set to "0", this is a finding.


vuln_id: V-221590
rule_id: SV-221590r961083_rule
severity: CAT II
title: Safe Browsing Extended Reporting must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enables Google Chrome's Safe Browsing Extended Reporting and prevents users from changing this setting. Extended Reporting sends some system information and page content to Google servers to help detect dangerous apps and sites.
  If the setting is set to "True", then reports will be created and sent whenever necessary (such as when a security interstitial is shown).
  If the setting is set to "False", reports will never be sent.
  If this policy is set to "True" or "False", the user will not be able to modify the setting.
  If this policy is left unset, the user will be able to change the setting and decide whether to send reports or not.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the “group policy editor” tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Safe Browsing settings\
  Policy Name: Enable Safe Browsing Extended Reporting
  Policy State: Disabled
  Policy Value: N/A

check_text:
  Universal method:
   1. In the omnibox (address bar) type chrome://policy
   2. If "SafeBrowsingExtendedReportingEnabled" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding.
  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the "SafeBrowsingExtendedReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.


vuln_id: V-221591
rule_id: SV-221591r960963_rule
severity: CAT II
title: WebUSB must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices.
  If this policy is left not set, ”3” will be used, and the user will be able to change it.
  2 = Do not allow any site to request access to USB devices via the WebUSB API
  3 = Allow sites to ask the user to grant access to a connected USB device</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
   1. Open the “group policy editor” tool with gpedit.msc
   2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings
   Policy Name: Control use of the WebUSB API
   Policy State: Enabled
   Policy Value: 2

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy
   2. If "DefaultWebUsbGuardSetting" is not displayed under the "Policy Name" column or it is not set to "2", this is a finding.
  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the "DefaultWebUsbGuardSetting" value name does not exist or its value data is not set to "2", this is a finding.


vuln_id: V-221594
rule_id: SV-221594r960963_rule
severity: CAT II
title: Google Cast must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>If this policy is set to ”True” or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the “Cast toolbar” icon.
  If this policy set to ”False”, Google Cast will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the “group policy editor” tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Google Cast
  Policy Name: Enable Google Cast
  Policy State: Disabled
  Policy Value: N/A

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy
   2. If "EnableMediaRouter" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding.
  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the "EnableMediaRouter" value name does not exist or its value data is not set to "0", this is a finding.


vuln_id: V-221595
rule_id: SV-221595r960963_rule
severity: CAT II
title: Autoplay must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>This allows a user to control if videos can play automatically with audio content (without user consent) in Google Chrome.

  If the policy is set to "True", Google Chrome is allowed to autoplay media. If the policy is set to "False", Google Chrome is not allowed to autoplay media. The "AutoplayAllowlist" policy can be used to override this for certain URL patterns. By default, Google Chrome is not allowed to autoplay media. The "AutoplayAllowlist" policy can be used to override this for certain URL patterns.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the “group policy editor” tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Allow media autoplay
  Policy State: Disabled
  Policy Value: N/A

check_text:
  Universal method: 
   1. In the omnibox (address bar) type chrome://policy
   2. If "AutoplayAllowed" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding.
  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the "AutoplayAllowed" value name does not exist or its value data is not set to "0", this is a finding.


vuln_id: V-221596
rule_id: SV-221596r961092_rule
severity: CAT II
title: URLs must be allowlisted for Autoplay use.
cci: CCI-001170
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Controls the allowlist of URL patterns that autoplay will always be enabled on. If the "AutoplayAllowed" policy is set to "True" then this policy will have no effect. If the "AutoplayAllowed" policy is set to "False", then any URL patterns set in this policy will still be allowed to play.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the “group policy editor” tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome
  - Policy Name: Allow media autoplay on a allowlist of URL patterns.
  - Policy State: Enabled
  - Policy Value 1: [*.]mil
  - Policy Value 2: [*.]gov

  Note: Policy values are examples.

check_text:
  Universal method:
  1. In the omnibox (address bar), type chrome://policy.
  2. If “AutoplayAllowlist” under the “Policy Name” column may be set to a list of administrator-approved URLs under the “Policy Value” column. This requirement is optional.

  Windows method:
  1. Start regedit.
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the “AutoplayAllowlist” key may contain a list of administrator-approved URLs. This requirement is optional.


vuln_id: V-221597
rule_id: SV-221597r961083_rule
severity: CAT II
title: Anonymized data collection must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enable URL-keyed anonymized data collection in Google Chrome and prevent users from changing this setting.
  URL-keyed anonymized data collection sends URLs of pages the user visits to Google to make searches and browsing better.
  If you enable this policy, URL-keyed anonymized data collection is always active.
  If you disable this policy, URL-keyed anonymized data collection is never active.
  If this policy is left not set, URL-keyed anonymized data collection will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Enable URL-keyed anonymized data collection
  Policy State: Disabled
  Policy Value: NA

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy
  2. If "UrlKeyedAnonymizedDataCollectionEnabled" is not displayed under the “Policy Name” column or it is not set to "0" under the “Policy Value” column, this is a finding.
  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the “UrlKeyedAnonymizedDataCollectionEnabled" value name does not exist or its value data is not set to "0," this is a finding.


vuln_id: V-221598
rule_id: SV-221598r961083_rule
severity: CAT II
title: Collection of WebRTC event logs must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>If the policy is set to “true”, Google Chrome is allowed to collect WebRTC event logs from Google services (e.g., Google Meet), and upload those logs to Google.
  If the policy is set to “false”, or is unset, Google Chrome may not collect nor upload such logs.
  These logs contain diagnostic information helpful when debugging issues with audio or video calls in Chrome, such as the time and size of sent and received RTP packets, feedback about congestion on the network, and metadata about time and quality of audio and video frames. These logs do not contain audio or video contents from the call.
  This data collection by Chrome can only be triggered by Google's web services, such as Google Hangouts or Google Meet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Allow collection of WebRTC event logs from Google services
  Policy State: Disabled
  Policy Value: NA

check_text:
  Universal method:
  1. In the omnibox (address bar) type chrome://policy
  2. If "WebRtcEventLogCollectionAllowed" is not displayed under the “Policy Name” column or it is not set to "0" under the “Policy Value” column, this is a finding.
  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the "WebRtcEventLogCollectionAllowed" value name does not exist or its value data is not set to "0," this is a finding.


vuln_id: V-221599
rule_id: SV-221599r961167_rule
severity: CAT III
title: Chrome development tools must be disabled.
cci: CCI-001312
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the "group policy editor" tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome
  Policy Name: Control where Developer Tools can be used
  Policy State: Enabled
  Policy Value: Disallow usage of the Developer Tools

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If the policy "DeveloperToolsAvailability" is not shown or is not set to "2", this is a finding.

  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the key "DeveloperToolsAvailability" does not exist or is not set to "2", this is a finding.


vuln_id: V-226401
rule_id: SV-226401r961083_rule
severity: CAT II
title: Guest Mode must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>If this policy is set to true or not configured, Google Chrome will enable guest logins. Guest logins are Google Chrome profiles where all windows are in incognito mode.

  If this policy is set to false, Google Chrome will not allow guest profiles to be started.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the "group policy editor" tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Enable guest mode in browser
  Policy State: Disabled

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If BrowserGuestModeEnabled is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the BrowserGuestModeEnabled value name does not exist or its value data is not set to 0, this is a finding.


vuln_id: V-226402
rule_id: SV-226402r961083_rule
severity: CAT II
title: AutoFill for credit cards must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enabling Google Chrome's AutoFill feature allows users to auto complete credit card information in web forms using previously stored information.
  If this setting is disabled, Autofill will never suggest or fill credit card information, nor will it save additional credit card information that the user might submit while browsing the web.

  If this setting is enabled or has no value, the user will be able to control Autofill for credit cards in the UI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the "group policy editor" tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Enable AutoFill for credit cards
  Policy State: Disabled

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If AutofillCreditCardEnabled is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the AutofillCreditCardEnabled value name does not exist or its value data is not set to 0, this is a finding.


vuln_id: V-226403
rule_id: SV-226403r961083_rule
severity: CAT II
title: AutoFill for addresses must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Enabling Google Chrome's AutoFill feature allows users to auto complete address information in web forms using previously stored information.
  If this setting is disabled, Autofill will never suggest or fill address information, nor will it save additional address information that the user might submit while browsing the web.

  If this setting is enabled or has no value, the user will be able to control Autofill for addresses in the UI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the "group policy editor" tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Enable AutoFill for addresses
  Policy State: Disabled

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If AutofillAddressEnabled is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the AutofillAddressEnabled value name does not exist or its value data is not set to 0, this is a finding.


vuln_id: V-226404
rule_id: SV-226404r961083_rule
severity: CAT II
title: Import AutoFill form data must be disabled.
cci: CCI-001166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>This policy forces the autofill form data to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog.
  If disabled, the autofill form data is not imported.

  If it is not set, the user may be asked whether to import, or importing may happen automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the "group policy editor" tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
  Policy Name: Import autofill form data from default browser on first run
  Policy State: Disabled

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If ImportAutofillFormData is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit
  2. Navigate to HKLM\Software\Policies\Google\Chrome\
  3. If the ImportAutofillFormData value name does not exist or its value data is not set to 0, this is a finding.


vuln_id: V-241787
rule_id: SV-241787r960963_rule
severity: CAT II
title: Web Bluetooth API must be disabled.
cci: CCI-000381
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices.

  Leaving the policy unset lets sites ask for access, but users can change this setting.

  2 = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API
  3 = Allow sites to ask the user to grant access to a nearby Bluetooth device</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the “group policy editor” tool with gpedit.msc
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings
   Policy Name: Control use of the Web Bluetooth API
   Policy State: Enabled
   Policy Value: Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API

check_text:
  Universal method: 
  1. In the omnibox (address bar) type chrome://policy 
  2. If DefaultWebBluetoothGuardSetting is not displayed under the Policy Name column or it is not set to 2 under the Policy Value column, then this is a finding.

  Windows method:
   1. Start regedit
   2. Navigate to HKLM\Software\Policies\Google\Chrome\
   3. If the DefaultWebBluetoothGuardSetting value name does not exist or its value data is not set to 2, then this is a finding.


vuln_id: V-245538
rule_id: SV-245538r961470_rule
severity: CAT II
title: Use of the QUIC protocol must be disabled.
cci: CCI-001762
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>QUIC is used by more than half of all connections from the Chrome web browser to Google's servers, and this activity is undesirable in the DoD.

  Setting the policy to Enabled or leaving it unset allows the use of QUIC protocol in Google Chrome.

  Setting the policy to Disabled disallows the use of QUIC protocol.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the “group policy editor” tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google Chrome.
  - Policy Name: Allow QUIC protocol
  - Policy State: Disabled
  - Policy Value: N/A

check_text:
  Universal method: 
  1. In the omnibox (address bar), type chrome://policy.
  2. If QuicAllowed is not displayed under the Policy Name column or it is not set to False under the Policy Value column, this is a finding.

  Windows method:
  1. Start regedit.
  2. Navigate to HKLM\Software\Policies\Google\Chrome\.
  3. If the QuicAllowed value name does not exist or its value data is not set to 0, this is a finding.


vuln_id: V-245539
rule_id: SV-245539r960864_rule
severity: CAT II
title: Session only based cookies must be enabled.
cci: CCI-000166
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Cookies must only be allowed per session and only for approved URLs as permanently stored cookies can be used for malicious intent. 

  Approved URLs may be allowlisted via the CookiesAllowedForUrls policy setting, but is not a requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc 
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings.
  - Policy Name: Default cookies setting
  - Policy State: Enabled
  - Policy Value: Keep cookies for the duration of the session

check_text:
  Universal method: 
  1. In the omnibox (address bar), type chrome://policy
  2. If the policy "DefaultCookiesSetting" is not shown or is not set to "4", this is a finding.

  Windows method:
  1. Start regedit.
  2. Navigate to HKLM\Software\Policies\Google\Chrome\DefaultCookiesSetting.
  3. If this key does not exist, or is not set to "4", this is a finding.


vuln_id: V-275780
rule_id: SV-275780r1106603_rule
severity: CAT II
title: Create Themes with AI must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Create Themes with AI lets users create custom themes/wallpapers by preselecting from a list of options.

  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.

  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.

  2 = Do not allow the feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI
  Policy Name: Settings for Create Themes with AI
  Policy State: Enabled
  Policy Value: Do not allow Create Themes

check_text:
  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "CreateThemesSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "CreateThemesSettings" value name does not exist or its value data is not set to "2", this is a finding.


vuln_id: V-275781
rule_id: SV-275781r1106671_rule
severity: CAT II
title: DevTools Generative AI features must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>These features in Google Chrome's DevTools employ generative AI models to provide additional debugging information. To use these features, Google Chrome collects data such as error messages, stack traces, code snippets, and network requests and sends them to a server owned by Google, which runs a generative AI model. Response body or authentication and cookie headers in network requests are not included in the data sent to the server.

  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.

  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.

  2 = Do not allow the feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI
  Policy Name: Settings for DevTools Generative AI Features
  Policy State: Enabled
  Policy Value: Do not allow DevTools Generative AI Features

check_text:
  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "DevToolsGenAiSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "DevToolsGenAiSettings" value name does not exist or its value data is not set to "2", this is a finding.


vuln_id: V-275782
rule_id: SV-275782r1106672_rule
severity: CAT II
title: GenAI local foundational model must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Configure how Google Chrome downloads the foundational GenAI model and uses it for inference locally.

  When the policy is set to Allowed (0) or not set, the model is downloaded automatically, and used for inference.

  When the policy is set to Disabled (1), the model will not be downloaded.

  Model downloading can also be disabled by ComponentUpdatesEnabled.

  0 = Downloads model automatically
  1 = Do not download model</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI
  Policy Name: Settings for GenAI local foundational model
  Policy State: Enabled
  Policy Value: Do not download model

check_text:
  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "GenAILocalFoundationalModelSettings" is not displayed under the "Policy Name" column or it is not set to "1" under the "Policy Value" column, this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "GenAILocalFoundationalModelSettings" value name does not exist or its value data is not set to "1", this is a finding.


vuln_id: V-275783
rule_id: SV-275783r1106612_rule
severity: CAT II
title: Help Me Write must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Help Me Write is an AI-based writing assistant for short-form content on the web. Suggested content is based on prompts entered by the user and the content of the web page.

  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.

  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.

  2 = Do not allow the feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI
  Policy Name: Settings forSettings for Help Me Write
  Policy State: Enabled
  Policy Value: Do not allow Help Me Write

check_text:
  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "HelpMeWriteSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "HelpMeWriteSettings" value name does not exist or its value data is not set to "2", this is a finding.


vuln_id: V-275784
rule_id: SV-275784r1106615_rule
severity: CAT II
title: AI-powered History Search must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>AI History Search is a feature that allows users to search their browsing history and receive generated answers based on page contents and not just the page title and URL.

  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.

  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.

  2 = Do not allow the feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI
  Policy Name: Settings for AI-powered History Search
  Policy State: Enabled
  Policy Value: Do not allow AI History Search

check_text:
  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "HistorySearchSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "HistorySearchSettings" value name does not exist or its value data is not set to "2", this is a finding.


vuln_id: V-275785
rule_id: SV-275785r1106673_rule
severity: CAT II
title: Tab Compare Settings must be disabled.
cci: CCI-000169
created_at: 2026-02-12 15:24:35
updated_at: 2026-02-12 15:24:35
description:
  <VulnDiscussion>Tab Compare is an AI-powered tool for comparing information across a user's tabs. For example, the feature can be offered to the user when multiple tabs with products in a similar category are open.

  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.

  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace.

  2 = Do not allow the feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows group policy:
  1. Open the group policy editor tool with gpedit.msc.
  2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI
  Policy Name: Tab Compare settings
  Policy State: Enabled
  Policy Value: Do not allow Tab Compare

check_text:
  Universal method:
  1. In the omnibox (address bar) type "chrome:// policy".
  2. If "TabCompareSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding.

  Windows method:
  1. Start "regedit".
  2. Navigate to "HKLM\Software\Policies\Google\Chrome\".
  3. If the "TabCompareSettings" value name does not exist or its value data is not set to "2", this is a finding.


vuln_id: V-213900
rule_id: SV-213900r1043176_rule
severity: CAT I
cci: CCI-000015
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server databases must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

description:
  <VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization.

  A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. 

  Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in noncentralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage.

  SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. 

  Automation may be comprised of differing technologies that when placed together, contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If mixed mode is required, document the need and justification; describe the measures taken to ensure the use of SQL Server authentication is kept to a minimum; describe the measures taken to safeguard passwords; list or describe the SQL Logins used; and obtain official approval.

  If mixed mode is not required, disable it as follows: 

  In the SSMS Object Explorer, right-click on the server instance, select Properties >> Security page. Click the radio button for "Windows Authentication Mode", and then click "OK".

  Restart the SQL Server instance. 

  OR

  Run the statement: 

  USE [master]
  EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2
  GO

  Restart the SQL Server instance. 

  For each account being managed by SQL Server but not requiring it, drop or disable the SQL Database user. Replace it with an appropriately configured account, as needed.

  To drop a User in the SSMS Object Explorer: 

  Navigate to Databases >> Security Users. Right-click on the User name, and then click "Delete".

  To drop a User via a query: 
  USE database_name;
  DROP USER <user_name>;

check_text:
  Determine if SQL Server is configured to allow the use of contained databases, if it is, take the appropriate precautions to limit their risk.

  1) In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance, select "Properties", and then select the "Advanced" page.
  If "Enabled Contained Databases" is "False", this is not a finding.

  2) If "Enabled Contained Databases" is "True", then in a query interface such as the SSMS Transact-SQL editor, run the statement:
  EXEC sp_configure 'contained database authentication'
  If the returned value in the "config_value" and/or "run_value" column is "0", this is not a finding.

  3) Determine whether SQL Server is configured to use only Windows authentication.
  In a query interface such as the SSMS Transact-SQL editor, run the statement:
  SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly')  
   WHEN 1 THEN 'Windows Authentication'  
   WHEN 0 THEN 'Windows and SQL Server Authentication'  
  END as [Authentication Mode]
  If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding.

  If mixed mode (both SQL Server authentication and Windows authentication) is in use, then it must be documented and approved.

  From the documentation, obtain the list of accounts authorized to be managed by SQL Server.
  Determine the accounts (SQL Logins) actually managed by SQL Server.

  Run the statement:

  SELECT name
  FROM sys.database_principals
  WHERE type_desc = 'SQL_USER'
  AND authentication_type_desc = 'DATABASE';

  If any accounts listed by the query are not listed in the documentation, this is a finding.
  Documentation must be approved by the information system security officer (ISSO)/ information system security manager (ISSM).


vuln_id: V-213901
rule_id: SV-213901r1112497_rule
severity: CAT I
cci: CCI-000213
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must enforce approved authorizations for logical access to database information and system resources in accordance with applicable access control policies.

description:
  <VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies. 

  Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. 

  Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. 

  This requirement is applicable to access control enforcement applications, a category that includes database management systems.  If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Use GRANT, REVOKE, DENY, ALTER ROLE … ADD MEMBER … and/or ALTER ROLE …. DROP MEMBER statements to add and remove permissions on database-level securables, bringing them into line with the documented requirements.

check_text:
  Review the system documentation to determine the required levels of protection for securables in the database by type of login. 

  If the database is tempdb, this is not applicable.

  Review the permissions actually in place in the database. 

  If the actual permissions do not match the documented requirements, this is a finding.

  Use the supplemental file "Database permission assignments to users and roles.sql".


vuln_id: V-213902
rule_id: SV-213902r960864_rule
severity: CAT II
cci: CCI-000166
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the database.

description:
  <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. 

  Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database.

  In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account.

  If the computer account of a remote computer is granted access to a SQL Server database, any service or scheduled task running as NT AUTHORITY\SYSTEM or NT AUTHORITY\NETWORK SERVICE can log into the instance and perform actions. These actions cannot be traced back to a specific user or process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove all users that were returned in the check SQL Statement:

  SELECT name
  FROM sys.database_principals
  WHERE type in ('U','G')
  AND name LIKE '%$'

  To remove users:

  Run the following command for each user:

  DROP USER [ IF EXISTS ] <user_name>;

check_text:
  Execute the following query:

  SELECT name
  FROM sys.database_principals
  WHERE type in ('U','G')
  AND name LIKE '%$'

  If no users are returned, this is not a finding.

  If users are returned, determine whether each user is a computer account.

  Launch PowerShell.

  Execute the following code:

  Note: <name> represents the username portion of the user. For example; if the user is "CONTOSO\user1$", the username is "user1".

  ([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll()

  If no account information is returned, this is not a finding.

  If account information is returned, this is a finding.


vuln_id: V-213903
rule_id: SV-213903r960864_rule
severity: CAT III
cci: CCI-000166
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect against a user falsely repudiating by use of system-versioned tables (Temporal Tables).

description:
  <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.

  Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. 

  In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account. 

  Applications should use temporal tables to track the changes and history of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Alter sensitive tables to utilize system versioning.

  Alter non-temporal table to define periods for system versioning .

  ALTER TABLE InsurancePolicy 
  ADD PERIOD FOR SYSTEM_TIME (SysStartTime, SysEndTime),   
  SysStartTime datetime2 GENERATED ALWAYS AS ROW START HIDDEN NOT NULL DEFAULT GETUTCDATE(),  
  SysEndTime datetime2 GENERATED ALWAYS AS ROW END HIDDEN NOT NULL DEFAULT CONVERT(DATETIME2, '9999-12-31 23:59:59.99999999');  
   
  ALTER TABLE InsurancePolicy SET (SYSTEM_VERSIONING = ON (HISTORY_TABLE=dbo.InsurancePolicyHistory));

  https://docs.microsoft.com/sql/t-sql/statements/alter-table-transact-sql?view=sql-server-2016#system_versionin

check_text:
  Check the server documentation to determine if collecting and keeping historical versions of a table is required.

  If collecting and keeping historical versions of a table is NOT required, this is not a finding.

  Find all of the temporal tables in the database using the following query:

  SELECT SCHEMA_NAME(T.schema_id) AS schema_name, T.name AS table_name, T.temporal_type_desc, SCHEMA_NAME(H.schema_id) + '.' + H.name AS history_table
  FROM sys.tables T
  JOIN sys.tables H ON T.history_table_id = H.object_id
  WHERE T.temporal_type != 0
  ORDER BY schema_name, table_name

  Using the system documentation, determine which tables are required to be temporal tables.

  If any tables listed in the documentation are not in the list created by running the above statement, this is a finding.

  Ensure a field exists documenting the login and/or user who last modified the record. 

  If this does not exist, this is a finding.


vuln_id: V-213904
rule_id: SV-213904r960864_rule
severity: CAT II
fix_text:
  Disable trustworthy on the database.

  ALTER DATABASE [<database name>] SET TRUSTWORTHY OFF

cci: CCI-000166
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect against a user falsely repudiating by ensuring databases are not in a trust relationship.

description:
  <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. 

  Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database.

  SQL Server provides the ability for high privileged accounts to impersonate users in a database using the TRUSTWORTHY feature. This will allow members of the fixed database role to impersonate any user within the database. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  If the database being reviewed is MSDB, trustworthy is required to be enabled, and therefore this is not a finding.

  Execute the following query:

  SELECT SUSER_SNAME(d.owner_sid) AS DatabaseOwner,
  CASE
  WHEN d.is_trustworthy_on = 0 THEN 'No'
  WHEN d.is_trustworthy_on = 1 THEN 'Yes'
  END AS IsTrustworthy,
  CASE
  WHEN role.name IN ('sysadmin','securityadmin')
  OR permission.permission_name = 'CONTROL SERVER'
  THEN 'YES'
  ELSE 'No'
  END AS 'IsOwnerPrivileged'
  FROM sys.databases d
  LEFT JOIN sys.server_principals login ON d.owner_sid = login.sid
  LEFT JOIN sys.server_role_members rm ON login.principal_id = rm.member_principal_id
  LEFT JOIN sys.server_principals role ON rm.role_principal_id = role.principal_id
  LEFT JOIN sys.server_permissions permission ON login.principal_id = permission.grantee_principal_id
  WHERE d.name = DB_NAME()

  If trustworthy is not enabled, this is not a finding.

  If trustworthy is enabled and the database owner is not a privileged account, this is not a finding.

  If trustworthy is enabled and the database owner is a privileged account, review the system documentation to determine if the trustworthy property is required and authorized. If this is not documented, this is a finding.


vuln_id: V-213905
rule_id: SV-213905r960882_rule
severity: CAT II
cci: CCI-000171
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

description:
  <VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events.

  Suppression of auditing could permit an adversary to evade detection.

  Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Create a database role specifically for audit maintainers, and give it permission to maintain audits, without granting it unnecessary permissions (The role name used here is an example; other names may be used.):

  CREATE ROLE DATABASE_AUDIT_MAINTAINERS;
  GO

  GRANT ALTER ANY DATABASE AUDIT TO DATABASE_AUDIT_MAINTAINERS;
  GO

  Use REVOKE and/or DENY and/or ALTER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY DATABASE AUDIT permission from all users.  Then, for each authorized database user, run the statement:  

  ALTER ROLE DATABASE_AUDIT_MAINTAINERS ADD MEMBER;
  GO

  Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL DATABASE permission from logins that do not need it.

check_text:
  Obtain the list of approved audit maintainers from the system documentation.

  Use the following query to review database roles and their membership, all of which enable the ability to create and maintain audit specifications.

  SELECT
      R.name AS role_name,
      RM.name AS role_member_name,
      RM.type_desc
  FROM sys.database_principals R
  JOIN sys.database_role_members DRM ON 
      R.principal_id = DRM.role_principal_id
  JOIN sys.database_principals RM ON 
      DRM.member_principal_id = RM.principal_id
  WHERE R.type = 'R'
      AND R.name = 'db_owner'
  ORDER BY 
      role_member_name

  If any role memberships are not documented and authorized, this is a finding.	


  Review the database roles and individual users that have the following permissions, all of which enable the ability to create and maintain audit definitions.

  ALTER ANY DATABASE AUDIT
  CONTROL

  Use the following query to determine the roles and users that have the listed permissions:

  SELECT
  	PERM.permission_name,
  	DP.name AS principal_name,
  	DP.type_desc AS principal_type,
  	DBRM.role_member_name
  FROM sys.database_permissions PERM
  JOIN sys.database_principals DP ON PERM.grantee_principal_id = DP.principal_id
  LEFT OUTER JOIN (
  	SELECT
  		R.principal_id AS role_principal_id,
  		R.name AS role_name,
  		RM.name AS role_member_name
  	FROM sys.database_principals R
  	JOIN sys.database_role_members DRM ON R.principal_id = DRM.role_principal_id
  	JOIN sys.database_principals RM ON DRM.member_principal_id = RM.principal_id
  	WHERE R.type = 'R'
  ) DBRM ON DP.principal_id = DBRM.role_principal_id
  WHERE PERM.permission_name IN ('CONTROL','ALTER ANY DATABASE AUDIT')
  ORDER BY
  	permission_name, 
  	principal_name, 
  	role_member_name


  If any of the roles or users returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.


vuln_id: V-213906
rule_id: SV-213906r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must limit privileges to change software modules, to include stored procedures, functions, and triggers.

description:
  <VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.

  Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

  Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Revoke the ALTER permission from unauthorized users and roles.

  REVOKE ALTER ON [<Object Name>] TO [<Principal Name>]

check_text:
  Obtain a listing of users and roles who are authorized to change stored procedures, functions, and triggers from the server documentation.

  In each user database, execute the following query:

  SELECT P.type_desc AS principal_type, P.name AS principal_name, O.type_desc,
    CASE class
     WHEN 0 THEN DB_NAME()
     WHEN 1 THEN OBJECT_SCHEMA_NAME(major_id) + '.' + OBJECT_NAME(major_id)
     WHEN 3 THEN SCHEMA_NAME(major_id)
      ELSE class_desc + '(' + CAST(major_id AS nvarchar) + ')'
     END AS securable_name, DP.state_desc, DP.permission_name
  FROM sys.database_permissions DP
  JOIN sys.database_principals P ON DP.grantee_principal_id = P.principal_id
  LEFT OUTER JOIN sys.all_objects O ON O.object_id = DP.major_id AND O.type IN ('TR','TA','P','X','RF','PC','IF','FN','TF','U')
  WHERE DP.type IN ('AL','ALTG') AND DP.class IN (0, 1, 53)

  SELECT R.name AS role_name, M.type_desc AS principal_type, M.name AS principal_name
  FROM sys.database_principals R
  JOIN sys.database_role_members DRM ON R.principal_id = DRM.role_principal_id
  JOIN sys.database_principals M ON DRM.member_principal_id = M.principal_id
  WHERE R.name IN ('db_ddladmin','db_owner')
     AND M.name != 'dbo'

  If any users or role permissions returned are not authorized to modify the specified object or type, this is a finding.

  If any user or role membership is not authorized, this is a finding.


vuln_id: V-213907
rule_id: SV-213907r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must limit privileges to change software modules, to include stored procedures, functions, and triggers, and links to software external to SQL Server.

description:
  <VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.

  Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

  Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Transfer ownership of database schemas to authorized database principals.

  ALTER AUTHORIZATION ON SCHEMA::[<Schema Name>] TO [<Principal Name>]

check_text:
  Obtain a listing of schema ownership from the server documentation.

  Execute the following query to obtain a current listing of schema ownership.

  SELECT S.name AS schema_name, P.name AS owning_principal
  FROM sys.schemas S
  JOIN sys.database_principals P ON S.principal_id = P.principal_id
  ORDER BY schema_name

  If any schema is owned by an unauthorized database principal, this is a finding.


vuln_id: V-213908
rule_id: SV-213908r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.

description:
  <VulnDiscussion>Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Database functions and procedures can be coded using definer's rights. This allows anyone who utilizes the object to perform the actions if they were the owner. If not properly managed, this can lead to privileged actions being taken by unauthorized individuals.

  Conversely, if critical tables or other objects in SQL Server rely on unauthorized owner accounts, these objects may be lost when an account is removed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Add and/or update system documentation to include any accounts authorized for object ownership and remove any account not authorized. 

  To change the schema owning a database object in SQL Server, use this code as an example: 

  USE AdventureWorks2012;  
  GO  
  ALTER SCHEMA HumanResources TRANSFER Person.Address;  
  GO  

  Caution: This can break code. This Fix should be implemented in conjunction with corrections to such code. Test before deploying in production. Deploy during a scheduled maintenance window.

check_text:
  Review system documentation to identify SQL Server accounts authorized to own database objects. 

  If the SQL Server database ownership list does not exist or needs to be updated, this is a finding. 

  The following query can be of use in making this determination: 

  ;with objects_cte as
  (SELECT o.name, o.type_desc,
     CASE
      WHEN o.principal_id is null then s.principal_id
       ELSE o.principal_id
      END as principal_id
   FROM sys.objects o
   INNER JOIN sys.schemas s
   ON o.schema_id = s.schema_id
   WHERE o.is_ms_shipped = 0
  )
  SELECT cte.name, cte.type_desc, dp.name as ObjectOwner 
  FROM objects_cte cte
  INNER JOIN sys.database_principals dp
  ON cte.principal_id = dp.principal_id
  ORDER BY dp.name, cte.name

  If any of the listed owners is not authorized, this is a finding.


vuln_id: V-213909
rule_id: SV-213909r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.

description:
  <VulnDiscussion>If SQL Server were to allow any user to make changes to database structure or logic, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.

  Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

  Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document and obtain approval for any non-administrative users who require the ability to modify database structure and logic modules.

  REVOKE ALTER ON [<Object Name>] TO [<Principal Name>]

check_text:
  Obtain a listing of users and roles who are authorized to modify database structure and logic modules from the server documentation.

  Execute the following query:
  SELECT P.type_desc AS principal_type, P.name AS principal_name, O.type_desc,
     CASE class
      WHEN 0 THEN DB_NAME()
      WHEN 1 THEN OBJECT_SCHEMA_NAME(major_id) + '.' + OBJECT_NAME(major_id)
      WHEN 3 THEN SCHEMA_NAME(major_id)
        ELSE class_desc + '(' + CAST(major_id AS nvarchar) + ')'
     END AS securable_name, DP.state_desc, DP.permission_name
  FROM sys.database_permissions DP
  JOIN sys.database_principals P ON DP.grantee_principal_id = P.principal_id
  LEFT OUTER JOIN sys.all_objects O ON O.object_id = DP.major_id AND O.type IN ('TR','TA','P','X','RF','PC','IF','FN','TF','U')
  WHERE DP.type IN ('AL','ALTG') AND DP.class IN (0, 1, 53)

  SELECT R.name AS role_name, M.type_desc AS principal_type, M.name AS principal_name
  FROM sys.database_principals R
  JOIN sys.database_role_members DRM ON R.principal_id = DRM.role_principal_id
  JOIN sys.database_principals M ON DRM.member_principal_id = M.principal_id
  WHERE R.name IN ('db_ddladmin','db_owner')
  AND M.name != 'dbo'

  If any users or role permissions returned are not authorized to modify the specified object or type, this is a finding.

  If any user or role membership is not authorized, this is a finding.


vuln_id: V-213910
rule_id: SV-213910r961125_rule
severity: CAT II
cci: CCI-001665
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  In the event of a system failure, hardware loss or disk failure, SQL Server must be able to restore necessary databases with least disruption to mission processes.

description:
  <VulnDiscussion>Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. In the event of a system failure, SQL Server must be able to bring the database back to a consistent state.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Modify the system security plan, to include whether the database is static, the correct recovery model to be used, the backup schedule, and the plan for testing database restoration. 

  In SQL Server Management Studio, Object Explorer, right-click on the name of the database; select Properties. Select the Options page. Set the Recovery Model field, near the top of the page, to the correct value. 

  In Object Explorer, expand >> SQL Server Agent >> Jobs. Create, modify, and delete jobs to implement the backup schedule. (Alternatively, this may done using T-SQL code or Third-party Backup software.) 

  Correct any issues that have been causing backups to fail. 

  Test the restoration of the database at least once a year; correct any issues that cause it to fail. Maintain a record of these tests.

check_text:
  Review the system security plan (SSP) to determine whether the database is static, the recovery model to be used, the backup schedule, and the plan for testing database restoration.

  If the SSP does not state that the database is static, assume that it is not static. If any of the other information is absent, this is a finding. 

  If the database is not static, and the documented recovery model is Bulk Logged, but the justification and authorization for this are not documented, this is a finding. 

  Run the following to determine Recovery Model:

  USE [master]
  GO

  SELECT name, recovery_model_desc
  FROM sys.databases
  ORDER BY name

  If the recovery model description does not match the documented recovery model, this is a finding. 

  Review the jobs set up to implement the backup plan. If they are absent, this is a finding. 

  Check the history of the backups by running the following query.  It checks the last 30 days of backups by database.
  USE [msdb]
  GO

  SELECT database_name, 
     CASE type
      WHEN 'D' THEN 'Full'
      WHEN 'I' THEN 'Differential'
      WHEN 'L' THEN 'Log'
     ELSE type
     END AS backup_type,
   is_copy_only,
   backup_start_date, backup_finish_date
  FROM dbo.backupset
  WHERE backup_start_date >= dateadd(day, - 30, getdate()) 
  ORDER BY database_name, backup_start_date DESC

  If the history indicates a pattern of job failures by missing or gaps in backups, this is a finding. 

  Review evidence that database recovery is tested annually or more often, and that the most recent test was successful. If not, this is a finding.


vuln_id: V-213911
rule_id: SV-213911r961128_rule
severity: CAT II
title: The Database Master Key encryption password must meet DOD password complexity requirements.
cci: CCI-001199
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Weak passwords may be easily guessed. When passwords are used to encrypt keys used for encryption of sensitive data, then the confidentiality of all data encrypted using that key is at risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Assign an encryption password to the Database Master Key that is a minimum of 15 characters with at least 1 upper-case character, 1 lower-case character, 1 special character, and 1 numeric character, and at least 8 characters changed from the previous password. 

  To change the Database Master Key encryption password: 

  USE [database name]; 
  ALTER MASTER KEY REGENERATE WITH ENCRYPTION BY PASSWORD = '[new password]'; 

  Note: The Database Master Key encryption method should not be changed until the effects are thoroughly reviewed. Changing the master key encryption causes all encryption using the Database Master Key to be decrypted and re-encrypted. This action should not be taken during a high-demand time. Please see the MS SQL Server documentation prior to re-encrypting the Database Master Key for detailed information.

check_text:
  From the query prompt: 

  SELECT name 
  FROM [master].sys.databases 
  WHERE state = 0 

  Repeat for each database: 
  From the query prompt: 
  USE [database name] 
  SELECT COUNT(name) 
  FROM sys.symmetric_keys s, sys.key_encryptions k 
  WHERE s.name = '##MS_DatabaseMasterKey##' 
  AND s.symmetric_key_id = k.key_id 
  AND k.crypt_type in ('ESKP', 'ESP2', 'ESP3')

  If the value returned is zero, this is not applicable.

  If the value returned is greater than zero, a Database Master Key exists and is encrypted with a password. 

  Review procedures and evidence of password requirements used to encrypt Database Master Keys. 

  If the passwords are not required to meet DoD password standards, currently a minimum of 15 characters with at least 1 upper-case character, 1 lower-case character, 1 special character, and 1 numeric character, and at least 8 characters changed from the previous password, this is a finding.


vuln_id: V-213912
rule_id: SV-213912r961128_rule
severity: CAT II
cci: CCI-001199
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.

description:
  <VulnDiscussion>When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Database Master Key to view sensitive data that they are not authorized to view. Where alternate encryption means are not feasible, encryption by the Service Master Key may be necessary. To help protect sensitive data from unauthorized access by DBAs, mitigations may be in order. Mitigations may include automatic alerts or other audit events when the Database Master Key is accessed outside of the application or by a DBA account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Where possible, encrypt the Database Master Key with a password known only to the application administrator.

  Where not possible, configure additional audit events or alerts to detect unauthorized access to the Database Master Key by users not authorized to view sensitive data.

check_text:
  If no databases require encryption, this is not a finding. 

  From the query prompt: 

  SELECT name 
  FROM [master].sys.databases 
  WHERE is_master_key_encrypted_by_server = 1 
  AND owner_sid <> 1 
  AND state = 0; 
  (Note that this query assumes that the [sa] account is not used as the owner of application databases, in keeping with other STIG guidance. If this is not the case, modify the query accordingly.) 

  If no databases are returned by the query, this is not a finding. 

  For any databases returned, verify in the System Security Plan that encryption of the Database Master Key using the Service Master Key is acceptable and approved by the Information Owner, and the encrypted data does not require additional protections to deter or detect DBA access. If not approved, this is a finding. 

  If approved and additional protections are required, then verify the additional requirements are in place in accordance with the System Security Plan. These may include additional auditing on access of the Database Master Key with alerts or other automated monitoring. 

  If the additional requirements are not in place, this is a finding.


vuln_id: V-213913
rule_id: SV-213913r961128_rule
severity: CAT II
cci: CCI-001199
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  The Certificate used for encryption must be backed up and stored in a secure location that is not on the SQL Server.

description:
  <VulnDiscussion>Backup and recovery of the Certificate used for encryption is critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document and implement procedures to safely back up and store the Certificate used for encryption in a secure location that is not on the SQL Server. Include in the procedures to establish evidence of backup and storage as well as careful, restricted access and restoration of the Certificate.

  BACKUP CERTIFICATE 'CertificateName' TO FILE = 'path_to_file' 
  WITH PRIVATE KEY (FILE = 'path_to_pvk', ENCRYPTION BY PASSWORD = 'password'); 

  As this requires a password, ensure it is not exposed to unauthorized persons or stored as plain text.

check_text:
  If the application owner and authorizing official have determined that encryption of data at rest is not required, this is not a finding.

  Review procedures for and evidence of backup of the Certificate used for encryption in the System Security Plan. 

  If the procedures or evidence does not exist, this is a finding. 

  If the procedures do not indicate that a backup of the Certificate used for encryption is stored in a secure location that is not on the SQL Server, this is a finding. 

  If procedures do not indicate access restrictions to the Certificate backup, this is a finding.


vuln_id: V-213914
rule_id: SV-213914r961131_rule
severity: CAT III
title: SQL Server must isolate security functions from non-security functions.
cci: CCI-001084
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions. 

  Security functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based.

  Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. 

  Database Management Systems typically separate security functionality from non-security functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and non-security functionality are commingled, users who have access to non-security functionality may be able to access security functionality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Check the server documentation, locate security-related database objects and code in a separate database, schema, table, or other separate security domain from database objects and code implementing application logic.  

  Microsoft SQL Server 2005 introduced the concept of database object schemas. Schemas are analogous to separate namespaces or containers used to store database objects. Security permissions apply to schemas, making them an important tool for separating and protecting database objects based on access rights. Schemas reduce the work required, and improve the flexibility, for security-related administration of a database.

  User-schema separation allows for more flexibility in managing database object permissions. A schema is a named container for database objects, which allows the user to group objects into separate namespaces.

  Where possible, locate security-related database objects and code in a separate database, schema, or other separate security domain from database objects and code implementing application logic. In all cases, use GRANT, REVOKE, DENY, ALTER ROLE … ADD MEMBER … and/or ALTER ROLE …. DROP MEMBER statements to add and remove permissions on server-level and database-level security-related objects to provide effective isolation.

check_text:
  Determine elements of security functionality (lists of permissions, additional authentication information, stored procedures, application specific auditing, etc.) that are being housed inside SQL server.

  For any elements found, check SQL Server to determine if these objects or code implementing security functionality are located in a separate security domain, such as a separate database, schema, or table created specifically for security functionality.

  If the database is a SQL Server default database (master, msdb, model, tempdb), this is NA.

  Run the following query to list all the user-defined databases:

  SELECT Name 
  FROM sys.databases 
  WHERE database_id > 4 
  ORDER BY 1;

  Review the database structure to determine where security related functionality is stored. If security-related database objects or code are not kept separate, this is a finding.


vuln_id: V-213915
rule_id: SV-213915r961149_rule
severity: CAT II
cci: CCI-001090
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

description:
  <VulnDiscussion>Applications, including DBMSs, must prevent unauthorized and unintended information transfer via shared system resources. 

  Data used for the development and testing of applications often involves copying data from production. It is important that specific procedures exist for this process, to include the conditions under which such transfer may take place, where the copies may reside, and the rules for ensuring sensitive data are not exposed.

  Copies of sensitive data must not be misplaced or left in a temporary location without the proper controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Modify any code used for moving data from production to development/test systems to comply with the organization-defined data transfer policy, and to ensure copies of production data are not left in unsecured locations.

check_text:
  Review the procedures for the refreshing of development/test data from production. Review any scripts or code that exists for the movement of production data to development/test systems, or to any other location or for any other purpose. Verify that copies of production data are not left in unprotected locations. If the code that exists for data movement does not comply with the organization-defined data transfer policy and/or fails to remove any copies of production data from unprotected locations, this is a finding.


vuln_id: V-213916
rule_id: SV-213916r961158_rule
severity: CAT II
cci: CCI-001310
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must check the validity of all data inputs except those specifically identified by the organization.

description:
  <VulnDiscussion>Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application.

  With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various programming languages, including dialects of SQL. Potentially, the attacker can gain unauthorized access to data, including security settings, and severely corrupt or destroy the database.

  Even when no such hijacking takes place, invalid input that gets recorded in the database, whether accidental or malicious, reduces the reliability and usability of the system. Available protections include data types, referential constraints, uniqueness constraints, range checking, and application-specific logic. Application-specific logic can be implemented within the database in stored procedures and triggers, where appropriate.

  This calls for inspection of application source code, which will require collaboration with the application developers. It is recognized that in many cases, the database administrator (DBA) is organizationally separate from the application developers, and may have limited, if any, access to source code. Nevertheless, protections of this type are so important to the secure operation of databases that they must not be ignored. At a minimum, the DBA must attempt to obtain assurances from the development organization that this issue has been addressed, and must document what has been discovered.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Use parameterized queries, constraints, foreign keys, etc. to validate data input. 

  Modify SQL Server to properly use the correct column data types as required in the database.

check_text:
  Review DBMS code (stored procedures, functions, triggers), application code, settings, column and field definitions, and constraints to determine whether the database is protected against invalid input. 

  If code exists that allows invalid data to be acted upon or input into the database, this is a finding. 

  If column/field definitions are not reflective of the data, this is a finding. 

  If columns/fields do not contain constraints and validity checking where required, this is a finding. 

  Where a column/field is noted in the system documentation as necessarily free-form, even though its name and context suggest that it should be strongly typed and constrained, the absence of these protections is not a finding. 

  Where a column/field is clearly identified by name, caption or context as Notes, Comments, Description, Text, etc., the absence of these protections is not a finding.


vuln_id: V-213917
rule_id: SV-213917r961167_rule
severity: CAT II
cci: CCI-001312
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

description:
  <VulnDiscussion>Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of error messages need to be carefully considered by the organization and development team.

  Databases can inadvertently provide a wealth of information to an attacker through improperly handled error messages. In addition to sensitive business or personal information, database errors can provide host names, IP addresses, user names, and other system information not required for troubleshooting but very useful to someone targeting the system.

  Carefully consider the structure/content of error messages. The extent to which information systems are able to identify and handle error conditions is guided by organizational policy and operational requirements. Information that could be exploited by adversaries includes, for example, logon attempts with passwords entered by mistake as the username, mission/business information that can be derived from (if not stated explicitly by) information recorded, and personal information, such as account numbers, social security numbers, and credit card numbers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Adjust database code to remove any information not required for explaining the error to an end user.

  Consider enabling trace flag 3625 to mask certain system-level error information returned to non-administrative users.

  Launch SQL Server Configuration Manager >> Click SQL Services >> Open the instance properties >> Click the Service Parameters tab >> Enter "-T3625" >> Click Add >> Click OK >> Restart SQL instance.

check_text:
  Review application behavior and custom database code (stored procedures, triggers), to determine whether error messages contain information beyond what is needed for explaining the issue to general users.

  If database error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.


vuln_id: V-213918
rule_id: SV-213918r961269_rule
severity: CAT II
cci: CCI-002262
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.

description:
  <VulnDiscussion>Without the association of security labels to information, there is no basis for SQL Server to make security-related access-control decisions.

  Security labels are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.

  These labels are typically associated with internal data structures (e.g., tables, rows) within the database and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions; or support other aspects of the information security policy.

  One example includes marking data as classified or FOUO. These security labels may be assigned manually or during data processing, but, either way, it is imperative these assignments are maintained while the data is in storage. If the security labels are lost when the data is stored, there is the risk of a data compromise.

  The mechanism used to support security labeling may be a feature of SQL Server, a third-party product, or custom application code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy SQL Server Row-Level Security (see link below) or a third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in storage.

  https://msdn.microsoft.com/en-us/library/dn765131.aspx

check_text:
  If security labeling is not required, this is not a finding.

  If security labeling requirements have been specified, but neither a third-party solution nor a SQL Server Row-Level security solution is implemented that reliably maintains labels on information in storage, this is a finding.


vuln_id: V-213919
rule_id: SV-213919r961272_rule
severity: CAT II
cci: CCI-002263
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.

description:
  <VulnDiscussion>Without the association of security labels to information, there is no basis for SQL Server to make security-related access-control decisions.

  Security labels are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.

  These labels are typically associated with internal data structures (e.g., tables, rows) within the database and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions; or support other aspects of the information security policy.

  One example includes marking data as classified or FOUO. These security labels may be assigned manually or during data processing, but, either way, it is imperative these assignments are maintained while the data is in storage. If the security labels are lost when the data is stored, there is the risk of a data compromise.

  The mechanism used to support security labeling may be a feature of SQL Server, a third-party product, or custom application code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy SQL Server Row-Level Security (see link below) or a third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in process.

  https://msdn.microsoft.com/en-us/library/dn765131.aspx

check_text:
  If security labeling is not required, this is not a finding.

  If security labeling requirements have been specified, but neither a third-party solution nor a SQL Server Row-Level security solution is implemented that reliably maintains labels on information in process, this is a finding.


vuln_id: V-213920
rule_id: SV-213920r961275_rule
severity: CAT II
cci: CCI-002264
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.

description:
  <VulnDiscussion>Without the association of security labels to information, there is no basis for SQL Server to make security-related access-control decisions.

  Security labels are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information. These labels are typically associated with internal data structures (e.g., tables, rows) within the database and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions; or support other aspects of the information security policy. One example includes marking data as classified or FOUO. These security labels may be assigned manually or during data processing, but, either way, it is imperative these assignments are maintained while the data is in storage. If the security labels are lost when the data is stored, there is the risk of a data compromise.

  The mechanism used to support security labeling may be a feature of SQL Server, a third-party product, or custom application code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy SQL Server Row-Level Security (see link below) or a third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in transmission.

  https://msdn.microsoft.com/en-us/library/dn765131.aspx

check_text:
  If security labeling is not required, this is not a finding.

  If security labeling requirements have been specified, but neither a third-party solution nor a SQL Server Row-Level security solution is implemented that reliably maintains labels on information in transmission, this is a finding.


vuln_id: V-213921
rule_id: SV-213921r961317_rule
severity: CAT III
cci: CCI-002165
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

description:
  <VulnDiscussion>Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user-controlled table permissions.

  When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. 

  A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. 

  The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  To correct object ownership:

  ALTER AUTHORIZATION ON <Securable> TO <Principal>

  To revoke any unauthorized permissions:

  REVOKE [Permission] ON <Securable> TO <Principal>

check_text:
  Review system documentation to determine requirements for object ownership and authorization delegation.

  Use the following query to discover database object ownership:

  Schemas not owned by the schema or dbo:

  SELECT name AS schema_name, USER_NAME(principal_id) AS schema_owner
  FROM sys.schemas
  WHERE schema_id != principal_id
   AND principal_id != 1

  Objects owned by an individual principal:

  SELECT object_id, name AS securable, 
    USER_NAME(principal_id) AS object_owner,
    type_desc
  FROM sys.objects
  WHERE is_ms_shipped = 0 AND principal_id IS NOT NULL
  ORDER BY type_desc, securable, object_owner

  Use the following query to discover database users who have been delegated the right to assign additional permissions:

  SELECT U.type_desc, U.name AS grantee,
   DP.class_desc AS securable_type,
     CASE DP.class
      WHEN 0 THEN DB_NAME()
      WHEN 1 THEN OBJECT_NAME(DP.major_id) 
      WHEN 3 THEN SCHEMA_NAME(DP.major_id)
     ELSE CAST(DP.major_id AS nvarchar)
     END AS securable,
         permission_name, state_desc
  FROM sys.database_permissions DP
  JOIN sys.database_principals U ON DP.grantee_principal_id = U.principal_id
  WHERE DP.state = 'W'
  ORDER BY grantee, securable_type, securable

  If any of these rights are not documented and authorized, this is a finding.


vuln_id: V-213922
rule_id: SV-213922r961359_rule
severity: CAT II
fix_text: Alter stored procedures and functions to remove the "EXECUTE AS" statement.
cci: CCI-002233
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Execution of stored procedures and functions that utilize execute as must be restricted to necessary cases only.

description:
  <VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations.

  Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the system documentation to obtain a listing of stored procedures and functions that utilize impersonation. Execute the following query:


  SELECT S.name AS schema_name, O.name AS module_name,
  USER_NAME(
  CASE M.execute_as_principal_id
  WHEN -2 THEN COALESCE(O.principal_id, S.principal_id)
  ELSE M.execute_as_principal_id
  END
  ) AS execute_as
  FROM sys.sql_modules M
  JOIN sys.objects O ON M.object_id = O.object_id
  JOIN sys.schemas S ON O.schema_id = S.schema_id
  WHERE execute_as_principal_id IS NOT NULL
  and       o.name not in 
  (             
  'fn_sysdac_get_username',
                               'fn_sysutility_ucp_get_instance_is_mi',
                               'sp_send_dbmail',
                               'sp_SendMailMessage',
                               'sp_syscollector_create_collection_set',
                               'sp_syscollector_delete_collection_set',
                               'sp_syscollector_disable_collector',
                               'sp_syscollector_enable_collector',
                               'sp_syscollector_get_collection_set_execution_status',
                               'sp_syscollector_run_collection_set',
                               'sp_syscollector_start_collection_set',
                               'sp_syscollector_update_collection_set',
                               'sp_syscollector_upload_collection_set',
                               'sp_syscollector_verify_collector_state',
                               'sp_syspolicy_add_policy',
                               'sp_syspolicy_add_policy_category_subscription',
                               'sp_syspolicy_delete_policy',
                               'sp_syspolicy_delete_policy_category_subscription',
                               'sp_syspolicy_update_policy',
                               'sp_sysutility_mi_add_ucp_registration',
                               'sp_sysutility_mi_disable_collection',
                               'sp_sysutility_mi_enroll',
                               'sp_sysutility_mi_initialize_collection',
                               'sp_sysutility_mi_remove',
                               'sp_sysutility_mi_remove_ucp_registration',
                               'sp_sysutility_mi_upload',
                               'sp_sysutility_mi_validate_enrollment_preconditions',
                               'sp_sysutility_ucp_add_mi',
                               'sp_sysutility_ucp_add_policy',
                               'sp_sysutility_ucp_calculate_aggregated_dac_health',
                               'sp_sysutility_ucp_calculate_aggregated_mi_health',
                               'sp_sysutility_ucp_calculate_computer_health',
                               'sp_sysutility_ucp_calculate_dac_file_space_health',
                               'sp_sysutility_ucp_calculate_dac_health',
                              'sp_sysutility_ucp_calculate_filegroups_with_policy_violations',
                               'sp_sysutility_ucp_calculate_health',
                               'sp_sysutility_ucp_calculate_mi_file_space_health',
                               'sp_sysutility_ucp_calculate_mi_health',
                               'sp_sysutility_ucp_configure_policies',
                               'sp_sysutility_ucp_create',
                               'sp_sysutility_ucp_delete_policy',
                               'sp_sysutility_ucp_delete_policy_history',
                               'sp_sysutility_ucp_get_policy_violations',
                               'sp_sysutility_ucp_initialize',
                               'sp_sysutility_ucp_initialize_mdw',
                               'sp_sysutility_ucp_remove_mi',
                               'sp_sysutility_ucp_update_policy',
                               'sp_sysutility_ucp_update_utility_configuration',
                               'sp_sysutility_ucp_validate_prerequisites',
                               'sp_validate_user',
                               'syscollector_collection_set_is_running_update_trigger',
                               'sysmail_help_status_sp'
  )

  ORDER BY schema_name, module_name

  If any procedures or functions are returned that are not documented, this is a finding.


vuln_id: V-213923
rule_id: SV-213923r1018608_rule
severity: CAT II
cci: CCI-003980
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

description:
  <VulnDiscussion>Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceed the rights of a regular user.

  DBMS functionality and the nature and requirements of databases will vary; so while users are not permitted to install unapproved software, there may be instances where the organization allows the user to install approved software packages such as from an approved software repository. The requirements for production servers will be more restrictive than those used for development and research.

  SQL Server must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. 

  In the case of a database management system, this requirement covers stored procedures, functions, triggers, views, etc.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document and obtain approval for any nonadministrative users who require the ability to create, alter, or replace logic modules.

  Revoke the ALTER permission from unauthorized users and roles:
  REVOKE ALTER ON [<Object Name>] TO [<Principal Name>]

check_text:
  If the SQL Server instance supports only software development, experimentation, and/or developer-level testing (i.e., excluding production systems, integration testing, stress testing, and user acceptance testing), this is not a finding. 

  Obtain a listing of users and roles who are authorized to create, alter, or replace logic modules from the server documentation.

  In each user database, execute the following query:

  SELECT P.type_desc AS principal_type, P.name AS principal_name,
  O.type_desc,
  CASE class
  WHEN 0 THEN DB_NAME()
  WHEN 1 THEN OBJECT_SCHEMA_NAME(major_id) + '.' + OBJECT_NAME(major_id)
  WHEN 3 THEN SCHEMA_NAME(major_id)
  ELSE class_desc + '(' + CAST(major_id AS nvarchar) + ')'
  END AS securable_name, DP.state_desc, DP.permission_name
  FROM sys.database_permissions DP
  JOIN sys.database_principals P ON DP.grantee_principal_id = P.principal_id
  LEFT OUTER JOIN sys.all_objects O ON O.object_id = DP.major_id AND O.type IN ('TR','TA','P','X','RF','PC','IF','FN','TF','U')
  WHERE DP.type IN ('AL','ALTG') AND DP.class IN (0, 1, 53)

  SELECT R.name AS role_name, M.type_desc AS principal_type, M.name AS principal_name
  FROM sys.database_principals R
  JOIN sys.database_role_members DRM ON R.principal_id = DRM.role_principal_id
  JOIN sys.database_principals M ON DRM.member_principal_id = M.principal_id
  WHERE R.name IN ('db_ddladmin','db_owner')
  AND M.name != 'dbo'

  If any users or role permissions returned are not authorized to modify the specified object or type, this is a finding. 

  If any user or role membership is not authorized, this is a finding.


vuln_id: V-213924
rule_id: SV-213924r961461_rule
severity: CAT II
cci: CCI-001813
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must enforce access restrictions associated with changes to the configuration of the database(s).

description:
  <VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. 

  When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. 

  Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove unauthorized users from roles:

  ALTER ROLE DROP MEMBER user;

  https://msdn.microsoft.com/en-us/library/ms189775.aspx

  Set the owner of the database to an authorized login:

  ALTER AUTHORIZATION ON database::DatabaseName TO login;

  https://msdn.microsoft.com/en-us/library/ms187359.aspx

check_text:
  Execute the following query to obtain a listing of user databases whose owner is a member of a fixed server role:

   SELECT 
                D.name AS database_name, SUSER_SNAME(D.owner_sid) AS owner_name,
                FRM.is_fixed_role_member
  FROM sys.databases D
  OUTER APPLY (
                SELECT MAX(fixed_role_member) AS is_fixed_role_member
                FROM (
                              SELECT IS_SRVROLEMEMBER(R.name, SUSER_SNAME(D.owner_sid)) AS fixed_role_member
                              FROM sys.server_principals R
                              WHERE is_fixed_role = 1
                ) A
  ) FRM
  WHERE D.database_id > 4
                AND (FRM.is_fixed_role_member = 1 
                              OR FRM.is_fixed_role_member IS NULL)
  ORDER BY database_name 

  If no databases are returned, this is not a finding. 

  For each database/login returned, review the Server Role memberships 

  1.	In SQL Server Management Studio, Expand “Logins”
  2.	Double-click the name of the Login
  3.	Click the “Server Roles” tab 

  If any server roles are selected, but not documented and authorized, this is a finding.


vuln_id: V-213926
rule_id: SV-213926r1018576_rule
severity: CAT I
cci: CCI-002475
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

description:
  <VulnDiscussion>DBMSs handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic mechanisms may be native to SQL Server or implemented via additional software or operating system/file system settings, as appropriate to the situation.

  Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). 

  The decision whether and what to encrypt rests with the data owner and is also influenced by the physical measures taken to secure the equipment and media on which the information resides.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Where full-disk encryption is required, configure Windows and/or the storage system to provide this. 

  Where transparent data encryption (TDE) is required, create a master key, obtain a certificate protected by the master key, create a database encryption key and protect it by the certificate, and then set the database to use encryption. For guidance from MSDN on how to do this: https://msdn.microsoft.com/en-us/library/bb934049.aspx. 

  Where table/column encryption is required, enable encryption on the tables/columns in question. For guidance from the Microsoft Developer Network on how to do this with Always Encrypted: https://msdn.microsoft.com/en-us/library/mt163865.aspx.

check_text:
  Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from modification, which must include, at a minimum, PII and classified information. 

  If no information is identified as requiring such protection, this is not a finding. 

  Review the configuration of SQL Server, Windows, and additional software as relevant. 

  If full-disk encryption is required, and Windows or the storage system is not configured for this, this is a finding. 

  If database transparent data encryption (TDE) is called for, check whether it is enabled: 

  SELECT
  DB_NAME(database_id) AS [Database Name], CASE encryption_state WHEN 0 THEN 'No database encryption key present, no encryption' 
  WHEN 1 THEN 'Unencrypted' 
  WHEN 2 THEN 'Encryption in progress' 
  WHEN 3 THEN 'Encrypted' 
  WHEN 4 THEN 'Key change in progress' 
  WHEN 5 THEN 'Decryption in progress' 
  WHEN 6 THEN 'Protection change in progress' 
  END AS [Encryption State]
  FROM sys.dm_database_encryption_keys

  For each user database for which encryption is called for and it is marked Unencrypted, this is a finding. 

  If table/column encryption and/or a separation between those who own the data (and can view it) and those who manage the data (but should have no access) is required for PII or similar types of data, use Always Encrypted.  The details for configuring Always Encrypted are located here: https://msdn.microsoft.com/en-us/library/mt163865.aspx.

  Review the definitions and contents of the relevant tables/columns for the Always Encryption settings, if any of the information defined as requiring cryptographic protection is not encrypted this is a finding.


vuln_id: V-213927
rule_id: SV-213927r1018577_rule
severity: CAT I
cci: CCI-002476
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.

description:
  <VulnDiscussion>SQL Server’s handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic mechanisms may be native to SQL Server or implemented via additional software or operating system/file system settings, as appropriate to the situation.

  Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). 

  The decision whether and what to encrypt rests with the data owner and is also influenced by the physical measures taken to secure the equipment and media on which the information resides.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Where full-disk encryption is required, configure Windows and/or the storage system to provide this. 

  Where transparent data encryption (TDE) is required, create a master key, obtain a certificate protected by the master key, create a database encryption key and protect it by the certificate, and then set the database to use encryption. For guidance from MSDN on how to do this: https://msdn.microsoft.com/en-us/library/bb934049.aspx. 

  Where table/column encryption is required, enable encryption on the table/columns in question. For guidance from the Microsoft Developer Network on how to do this with Always Encrypted: https://msdn.microsoft.com/en-us/library/mt163865.aspx.

check_text:
  Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from disclosure, which must include, at a minimum, PII and classified information. 

  If no information is identified as requiring such protection, this is not a finding. 

  If full-disk encryption is required, and Windows or the storage system is not configured for this, this is a finding. 

  If database transparent data encryption (TDE) is called for, check whether it is enabled: 

  SELECT
  DB_NAME(database_id) AS [Database Name], CASE encryption_state WHEN 0 THEN 'No database encryption key present, no encryption' 
  WHEN 1 THEN 'Unencrypted' 
  WHEN 2 THEN 'Encryption in progress' 
  WHEN 3 THEN 'Encrypted' 
  WHEN 4 THEN 'Key change in progress' 
  WHEN 5 THEN 'Decryption in progress' 
  WHEN 6 THEN 'Protection change in progress' 
  END AS [Encryption State]
  FROM sys.dm_database_encryption_keys

  For each user database for which encryption is called for and it is marked Unencrypted, this is a finding. 

  If table/column encryption and/or a separation between those who own the data (and can view it) and those who manage the data (but should have no access) is required for PII or similar types of data, use Always Encrypted.  The details for configuring Always Encrypted are located here: https://msdn.microsoft.com/en-us/library/mt163865.aspx.

  Review the definitions and contents of the relevant tables/columns for the Always Encryption settings, if any of the information defined as requiring cryptographic protection is not encrypted this is a finding.


vuln_id: V-251040
rule_id: SV-251040r962034_rule
severity: CAT I
cci: CCI-002450
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements.

description:
  <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

  It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

  NSA-approved cryptography for classified networks is hardware based. This requirement addresses the compatibility of a DBMS with the encryption devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure cryptographic functions to use NSA-approved cryptography compliant algorithms.

  Use DoD code-signing certificates to create asymmetric keys stored in the database used to encrypt sensitive data stored in the database.

  Run the following SQL script to create a certificate:
  USE 
  CREATE CERTIFICATE 
   ENCRYPTION BY PASSWORD = <'password'>
   FROM FILE = <'path/file_name'>
   WITH SUBJECT = 'name of person creating key',
   EXPIRY_DATE = '<'expiration date: yyyymmdd'>'

  Run the following SQL script to create a symmetric key and assign an existing certificate:
  USE 
  CREATE SYMMETRIC KEY <'key name'>
   WITH ALGORITHM = AES_256 
   ENCRYPTION BY CERTIFICATE

  For Transparent Data Encryption (TDE):
  USE master;
  CREATE MASTER KEY ENCRYPTION BY PASSWORD = '';
  CREATE CERTIFICATE  . . .;
  USE ;
  CREATE DATABASE ENCRYPTION KEY
  WITH ALGORITHM = AES_256
  ENCRYPTION BY SERVER CERTIFICATE ;
  ALTER DATABASE 
  SET ENCRYPTION ON;

check_text:
  Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website: http://csrc.nist.gov/groups/STM/cmvp/index.html.

  Review system documentation to determine whether cryptography for classified or sensitive information is required by the information owner.

  If the system documentation does not specify the type of information hosted on SQL Server as classified, sensitive, and/or unclassified, this is a finding.

  If neither classified nor sensitive information exists within SQL Server databases or configuration, this is not a finding.

  Verify that Windows is configured to require the use of FIPS-compliant algorithms.

  Click "Start",  enter "Local Security Policy", and then press "Enter". Expand "Local Policies", select "Security Options", and then locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".

  If the Security Setting for this option is "Disabled", this is a finding.

  Note: The list of acceptable algorithms is "AES 256" and "Triple DES".

  If cryptography is being used by SQL Server, verify that the cryptography is NIST FIPS 140-2 or 140-3 certified by running the following SQL query:

  SELECT DISTINCT name, algorithm_desc
  FROM sys.symmetric_keys
  WHERE key_algorithm NOT IN ('D3','A3')
  ORDER BY name

  If any items listed show an uncertified NIST FIPS 140-2 algorithm type, this is a finding.


vuln_id: V-213929
rule_id: SV-213929r1018580_rule
severity: CAT II
cci: CCI-000054
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

description:
  <VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful denial-of-service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions is helpful in reducing these risks.
    
  This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts.
    
  The capability to limit the number of concurrent sessions per user must be configured in or added to SQL Server (for example, by use of a logon trigger), when this is technically feasible. Note that it is not sufficient to limit sessions via a web server or application server alone, because legitimate users and adversaries can potentially connect to SQL Server by other means. 
    
  The organization will need to define the maximum number of concurrent sessions by account type, by account, or a combination thereof. In deciding on the appropriate number, it is important to consider the work requirements of the various types of users. For example, 2 might be an acceptable limit for general users accessing the database via an application; but 10 might be too few for a database administrator using a database management GUI tool, where each query tab and navigation pane may count as a separate session.
    
  (Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If a trigger consumes too much CPU, an example alternative method for limiting the concurrent users is setting the max connection limit on SQL Server.

  In SQL Server Management Studio's Object Explorer tree, right-click on the Server Name >> Select Properties >> Select Connections Tab >> Set the Maximum Number of Concurrent Connections to a value other than 0 (0 = unlimited), and document it.

  OR

  Run the query:

  EXEC sys.sp_configure N'user connections','5000' /* this is an example max limit */
  GO
  RECONFIGURE WITH OVERRIDE
  GO

  Restart SQL Server for the setting to take effect.

  Reference: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-connections-server-configuration-option?

  Otherwise, establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users.  

  Example script below:
   
  CREATE TRIGGER SQL_STIG_Connection_Limit 
  ON ALL SERVER WITH EXECUTE AS 'renamed_sa' /*Make sure to use the renamed SA account here*/ 
  FOR LOGON 
  AS 
  BEGIN 
  If (Select COUNT(1) from sys.dm_exec_sessions WHERE is_user_process = 1 AND original_login_name = ORIGINAL_LOGIN() ) > 
    (CASE ORIGINAL_LOGIN()
                WHEN 'domain/ima.dba' THEN 150    /*this is a busy DBA’s domain account */
                WHEN 'application1_login' THEN 6  /* this is a SQL login for an application */
                WHEN 'application2_login' THEN 20 /* this is a SQL login for another application */
                …
                ELSE 1 /* All unspecified users are restricted to a single login */
    END)
                BEGIN 
                               PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded its concurrent session limit.' 
                               ROLLBACK; 
                END
  END; 
    
  Reference:  https://msdn.microsoft.com/en-us/library/ms189799.aspx

check_text:
  Review the system documentation to determine whether any concurrent session limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. 
   
  If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding.

  Due to excessive CPU consumption when utilizing a logon trigger, an alternative method of limiting concurrent sessions is setting the max connection limit within SQL Server to an appropriate value. This serves to block a distributed denial-of-service (DDOS) attack by limiting the attacker's connections while allowing a database administrator to still force a SQL connection.

  In SQL Server Management Studio's Object Explorer tree:
  Right-click on the Server Name >> Select Properties >> Select Connections Tab

  OR

  Run the query:
  EXEC sys.sp_configure N'user connections'

  If the max connection limit is set to 0 (unlimited) or does not match the documented value, this is a finding.
   
  Otherwise, determine if a logon trigger exists:  
   
  In SQL Server Management Studio's Object Explorer tree:  
  Expand [SQL Server Instance] >> Server Objects >> Triggers  
   
  OR 
   
  Run the query:  
  SELECT name FROM master.sys.server_triggers;  
   
  If no triggers are listed, this is a finding.  
   
  If triggers are listed, identify the trigger(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding.  
   
  Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding.
   
  Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.


vuln_id: V-213930
rule_id: SV-213930r1043176_rule
severity: CAT I
cci: CCI-000015
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

description:
  <VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. 
   
  A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed.  
   
  Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example, using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. 
   
  SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy.  
   
  Automation may be composed of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If mixed mode is required, document the need and justification; describe the measures taken to ensure the use of SQL Server authentication is kept to a minimum; describe the measures taken to safeguard passwords; and list or describe the SQL Logins used.

  Documentation must be approved by the ISSO/ISSM.
   
  If mixed mode is not required, disable it as follows:  
   
  In the SSMS Object Explorer, right-click on the server instance. 
  Select "Properties".  
  Select the Security page.  
  Click on the radio button for "Windows Authentication Mode".  
  Click on "OK".  
  Restart the SQL Server instance.  
   
  OR  
   
  Run the statement:  
  USE [master] 
  EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2 
  GO 
   
  Restart the SQL Server instance.  
   
  For each account being managed by SQL Server but not requiring it, drop or disable the SQL Login. Replace it with an appropriately configured account, as needed.  
   
  To drop or disable a login in the SSMS Object Explorer:  
  Navigate to "Security Logins".  
  Right-click on the login name and click "Delete" or "Disable".  
   
  To drop or disable a login by using a query:  
  USE master;  
  DROP LOGIN login_name; 
  ALTER LOGIN login_name DISABLE; 
   
  Dropping a login does not delete the equivalent database user(s). There may be more than one database containing a user mapped to the login. Drop the user(s) unless still needed. 
   
  To drop a user in the SSMS Object Explorer:  
  Navigate to Databases >> Security Users.  
  Right-click on the user name. 
  Click "Delete".  
   
  To drop a user via a query:  
  USE database_name; 
  DROP USER <user_name>;

check_text:
  Determine whether SQL Server is configured to use only Windows authentication.  
   
  In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. 
  Select "Properties".  
  Select the Security page.  
   
  If Windows Authentication Mode is selected, this is not a finding.  
   
  OR 
   
  In a query interface such as the SSMS Transact-SQL editor, run the statement:  
  SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly')    
  WHEN 1 THEN 'Windows Authentication'    
  WHEN 0 THEN 'Windows and SQL Server Authentication'    
  END as [Authentication Mode]  
   
  If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding.  
   
  Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved by the information system security officer (ISSO)/information system security manager (ISSM), this is a finding.  
   
  From the documentation, obtain the list of accounts authorized to be managed by SQL Server.  
   
  Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement:  
   
  SELECT name 
  FROM sys.sql_logins 
  WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0;  
   
  If any accounts listed by the query are not listed in the documentation, this is a finding.


vuln_id: V-213931
rule_id: SV-213931r1043176_rule
severity: CAT II
title: SQL Server must be configured to utilize the most-secure authentication method available.
cci: CCI-000015
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. 
   
  A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed.  
   
  Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. 
   
  SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy.  
   
  Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements. 
   
  SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure Service Principal Names (SPNs) are properly registered for the SQL Server instance. 

  Utilize the Microsoft Kerberos Configuration Manager to review Kerberos configuration issues for a given SQL Server instance. 

  https://www.microsoft.com/en-us/download/details.aspx?id=39046 

  Alternatively, SPNs for SQL Server can be manually registered. 

  For other connections that support Kerberos the SPN is registered in the format MSSQLSvc/<FQDN>/<instancename> for a named instance. The format for registering the default instance is MSSQLSvc/<FQDN>.

  Using an account with permissions to register SPNs, issue the following commands from a command-prompt: 

  setspn -S MSSQLSvc/<Fully Qualified Domain Name> <Service Account> 
  setspn -S MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> <Service Account> 
  For a named instance, use:
  setspn -S MSSQLSvc/<FQDN>:<instancename> <Service Account> 
  setspn -S MSSQLSvc/<FQDN>:<TCP Port> <Service Account>

  Restart the SQL Server instance. 

  More information regarding this process is available at:  
  https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections#Manual

check_text:
  If the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. 

  Obtain the fully qualified domain name of the SQL Server instance: 

  Launch Windows Explorer. 

  Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". 

  Note the value shown for "Full computer name". 

  *** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** 

  Obtain the TCP port that is supporting the SQL Server instance: 

  Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". 

  From the tree on the left, expand "SQL Server Network Configuration". 

  Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). 

  In the right pane, right-click on "TCP/IP" and choose "Properties". 

  In the window that opens, click the "IP Addresses" tab. 

  Note the TCP port configured for the instance. 

  Obtain the service account that is running the SQL Server service: 

  Click "Start".  
  Type "SQL Server 2016 Configuration Manager".  
  From the search results, click "SQL Server 2016 Configuration Manager". 

  From the tree on the left, select "SQL Server Services". 

  Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. 

  Launch a command-line or PowerShell window. 

  Enter the following command where <Service Account> is the identity of the service account. 

  setspn -L <Service Account> 

  Example: setspn -L CONTOSO\sql2016svc 

  Review the Registered Service Principal Names returned.  

  If the listing does not contain the following supported service principal names (SPN) formats, this is a finding. 

  Named instance
     MSSQLSvc/<FQDN>:[<port> | <instancename>], where:
     MSSQLSvc is the service that is being registered.
     <FQDN> is the fully qualified domain name of the server.
     <port> is the TCP port number.
     <instancename> is the name of the SQL Server instance.

  Default instance
     MSSQLSvc/<FQDN>:<port> | MSSQLSvc/<FQDN>, where:
     MSSQLSvc is the service that is being registered.
     <FQDN> is the fully qualified domain name of the server.
     <port> is the TCP port number.

  If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding.


vuln_id: V-213932
rule_id: SV-213932r960792_rule
severity: CAT I
cci: CCI-000213
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

description:
  <VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server.  To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies.  
   
  Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.  
   
  Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.  
   
  This requirement is applicable to access control enforcement applications, a category that includes database management systems.  If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them into line with the documented requirements.

check_text:
  Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login.  
   
  Review the permissions actually in place on the server.  
   
  If the actual permissions do not match the documented requirements, this is a finding. 
   
  Use the supplemental file "Instance permissions assignments to logins and roles.sql."


vuln_id: V-213933
rule_id: SV-213933r960864_rule
severity: CAT II
cci: CCI-000166
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect against a user falsely repudiating by ensuring all accounts are individual, unique, and not shared.

description:
  <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.  
   
  Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. 
   
  In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove user-accessible shared accounts and use individual user IDs.  
   
  Build/configure applications to ensure successful individual authentication prior to shared account access.  
   
  Ensure each user's identity is received and used in audit data in all relevant circumstances.  
   
  Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.

check_text:
  Obtain the list of authorized SQL Server accounts in the system documentation.  
   
  Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. 
   
  If accounts are determined to be shared, determine if individuals are first individually authenticated.  
   
  If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.  
   
  The key is individual accountability. If this can be traced, this is not a finding.  
   
  If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.  
   
  Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured.  
   
  If shared identifiers are found, and not accompanied by individual identifiers, this is a finding.  
   
  Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.


vuln_id: V-213934
rule_id: SV-213934r960864_rule
severity: CAT II
cci: CCI-000166
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.

description:
  <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.  
   
  Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. 
   
  In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. 
   
  Any user with enough access to the server can execute a task that will be run as NT AUTHORITY\SYSTEM either using task scheduler or other tools. At this point, NT AUTHORITY\SYSTEM essentially becomes a shared account because the operating system and SQL Server are unable to determine who created the process. 
   
  Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role by default. This allowed jobs/tasks to be executed in SQL Server without the approval or knowledge of the DBA because it looked like operating system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove permissions that were identified as not allowed in the check content.

  USE Master;

  REVOKE <Permission> TO [NT AUTHORITY\SYSTEM]

  GO


  To grant permissions to services or applications, utilize the Service SID of the service or a domain service account.

check_text:
  Execute the following queries. The first query checks for Clustering and Availability Groups being provisioned in the Database Engine. The second query lists permissions granted to the Local System account.

  SELECT
      SERVERPROPERTY('IsClustered') AS [IsClustered],
      SERVERPROPERTY('IsHadrEnabled') AS [IsHadrEnabled]

  EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM'

  SELECT * FROM fn_my_permissions(NULL, 'server')

  REVERT

  GO

   
  If IsClustered returns 1, IsHadrEnabled returns 0, and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding.
   
  If IsHadrEnabled returns 1 and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding.
   
  If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.


vuln_id: V-213935
rule_id: SV-213935r960864_rule
severity: CAT II
fix_text: Remove all logins that were returned in the check content.
cci: CCI-000166
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.

description:
  <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.  
   
  Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. 
   
  In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. 
   
  If the computer account of a remote computer is granted access to SQL Server, any service or scheduled task running as NT AUTHORITY\SYSTEM or NT AUTHORITY\NETWORK SERVICE can log into the instance and perform actions. These actions cannot be traced back to a specific user or process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Execute the following query:

  SELECT name
  FROM sys.server_principals
  WHERE type in ('U','G')
  AND name LIKE '%$'

  If no logins are returned, this is not a finding.

  If logins are returned, determine whether each login is a computer account.

  Launch PowerShell.

  Execute the following code:

  Note: <name> represents the username portion of the login. For example, if the login is "CONTOSO\user1$", the username is "user1".

  ([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll()

  If no account information is returned, this is not a finding.

  If account information is returned, this is a finding.


vuln_id: V-213936
rule_id: SV-213936r960879_rule
severity: CAT II
fix_text: Add all required audit events to the STIG Compliant audit specification server documentation.
cci: CCI-000169
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.

description:
  <VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.  
   
  Audit records can be generated from various components within SQL Server (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. 
   
  DoD has defined the list of events for which SQL Server will provide an audit record generation capability as the following:  
   
  (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); 
   
  (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and 
   
  (iii) All account creation, modification, disabling, and termination actions. 
   
  Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. 
   
  Execute the following query to get all of the installed audits: 
   
  SELECT name AS 'Audit Name', 
  status_desc AS 'Audit Status', 
  audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status 
   
  All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.  
   
  To view the actions being audited by the audits, execute the following query: 
   
  SELECT a.name AS 'AuditName', 
  s.name AS 'SpecName', 
  d.audit_action_name AS 'ActionName', 
  d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1 
   
  Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding.


vuln_id: V-213937
rule_id: SV-213937r960882_rule
severity: CAT II
cci: CCI-000171
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

description:
  <VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. 
   
  Suppression of auditing could permit an adversary to evade detection. 
   
  Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Create a server role specifically for audit maintainers and give it permission to maintain audits without granting it unnecessary permissions (the role name used here is an example; other names may be used):   
   
  CREATE SERVER ROLE SERVER_AUDIT_MAINTAINERS; 
  GO 
   
  GRANT ALTER ANY SERVER AUDIT TO SERVER_AUDIT_MAINTAINERS; 
  GO     
   
  Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY SERVER AUDIT permission from all logins.  Then, for each authorized login, run the statement:   
   
  ALTER SERVER ROLE SERVER_AUDIT_MAINTAINERS ADD MEMBER; 
  GO 
   
  Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL SERVER, ALTER ANY DATABASE and CREATE ANY DATABASE permissions from logins that do not need them.

check_text:
  Obtain the list of approved audit maintainers from the system documentation. 
   
  Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. 
   
  sysadmin 
  dbcreator 
   
  Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. 
   
  ALTER ANY SERVER AUDIT  
  CONTROL SERVER  
  ALTER ANY DATABASE  
  CREATE ANY DATABASE 
   
  Use the following query to determine the roles and logins that have the listed permissions: 
   
  SELECT-- DISTINCT 
      CASE 
          WHEN SP.class_desc IS NOT NULL THEN  
              CASE 
                  WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' 
                  WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' 
                  ELSE SP.class_desc 
              END 
          WHEN E.name IS NOT NULL THEN 'ENDPOINT' 
          WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' 
          WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' 
          WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' 
          ELSE '???'  
      END                    AS [Securable Class], 
      CASE 
          WHEN E.name IS NOT NULL THEN E.name 
          WHEN S.name IS NOT NULL THEN S.name  
          WHEN P.name IS NOT NULL THEN P.name 
          ELSE '???'  
      END                    AS [Securable], 
      P1.name                AS [Grantee], 
      P1.type_desc           AS [Grantee Type], 
      sp.permission_name     AS [Permission], 
      sp.state_desc          AS [State], 
      P2.name                AS [Grantor], 
      P2.type_desc           AS [Grantor Type], 
  R.name    AS [Role Name] 
  FROM 
      sys.server_permissions SP 
      INNER JOIN sys.server_principals P1 
          ON P1.principal_id = SP.grantee_principal_id 
      INNER JOIN sys.server_principals P2 
          ON P2.principal_id = SP.grantor_principal_id 
   
      FULL OUTER JOIN sys.servers S 
          ON  SP.class_desc = 'SERVER' 
          AND S.server_id = SP.major_id 
   
      FULL OUTER JOIN sys.endpoints E 
          ON  SP.class_desc = 'ENDPOINT' 
          AND E.endpoint_id = SP.major_id 
   
      FULL OUTER JOIN sys.server_principals P 
          ON  SP.class_desc = 'SERVER_PRINCIPAL'         
          AND P.principal_id = SP.major_id 
   
  FULL OUTER JOIN sys.server_role_members SRM 
  ON P.principal_id = SRM.member_principal_id 
   
  LEFT OUTER JOIN sys.server_principals R 
  ON SRM.role_principal_id = R.principal_id 
  WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') 
  OR R.name IN ('sysadmin','dbcreator') 
   
  If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.


vuln_id: V-213939
rule_id: SV-213939r960885_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must generate audit records when successful/unsuccessful attempts to retrieve privileges/permissions occur.

description:
  <VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, monitoring must be possible. DBMSs typically make such information available through views or functions.
   
  This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted. 
   
  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

  Satisfies: SRG-APP-000091-DB-000066</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".

check_text:
  Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. 
   
  If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. 
   
  If the documentation does not exist, this is a finding. 
   
  Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. 
   
  SELECT name AS 'Audit Name', 
  status_desc AS 'Audit Status', 
  audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status 
   
  If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. 
   
  SELECT a.name AS 'AuditName', 
  s.name AS 'SpecName', 
  d.audit_action_name AS 'ActionName', 
  d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' 
   
  If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.


vuln_id: V-213940
rule_id: SV-213940r960888_rule
severity: CAT II
title: SQL Server must initiate session auditing upon startup.
cci: CCI-001464
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the SQL Audit(s) to automatically start during system start-up.  
   
  ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON 
   
  Execute the following query: 
   
  SELECT name AS 'Audit Name', 
    status_desc AS 'Audit Status', 
    audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status 
  WHERE status_desc = 'STARTED' 
   
  Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.

check_text:
  When Audits are enabled, they start up when the instance starts. 
  https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 
   
  Check if an audit is configured and enabled. 
   
  Execute the following query: 
   
  SELECT name AS 'Audit Name', 
  status_desc AS 'Audit Status', 
  audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status 
  WHERE status_desc = 'STARTED' 
   
  All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.


vuln_id: V-213941
rule_id: SV-213941r960909_rule
severity: CAT II
cci: CCI-000135
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

description:
  <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events. 
   
  The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of users of shared accounts, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.  
   
  Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Design and deploy an Audit that captures all auditable events and data items. In the event a third-party tool is used for auditing it must contain all the required information including but not limited to events, type, location, subject, date and time and by whom the change occurred. 
   
  Implement additional custom audits to capture the additional organizational required information.

check_text:
  If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. 
   
  Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit.  
   
  If there are none specified, this is not a finding.  
   
  If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements.  
   
  If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.


vuln_id: V-213942
rule_id: SV-213942r1043188_rule
severity: CAT II
cci: CCI-000140
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

description:
  <VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.  
   
  When the need for system availability does not outweigh the need for a complete audit trail, SQL Server should shut down immediately, rolling back all in-flight transactions. 
   
  Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs.  
   
  Run this T-SQL script for each identified audit:  
   
  ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF);  
  GO  
  ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN);  
  GO  
  ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON);  
  GO

check_text:
  If the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA).  
   
  If SQL Server Audit is in use, review the defined server audits by running the statement:  
   
  SELECT * FROM sys.server_audits;  
   
  By observing the [name] and [is_state_enabled] columns, identify the row or rows in use.  
   
  If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.


vuln_id: V-213943
rule_id: SV-213943r1043188_rule
severity: CAT II
cci: CCI-000140
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

description:
  <VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.  
   
  When availability is an overriding concern, approved actions in response to an audit failure are as follows:  
   
  (i) If the failure was caused by the lack of audit record storage capacity, SQL Server must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner.  
   
  (ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, SQL Server must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server.  
   
  Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. 
   
  Run this T-SQL script for each identified audit:  
   
  ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF);  
  GO  
  ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue);  
  GO  
  ALTER SERVER AUDIT [AuditName] WITH (STATE = ON);  
  GO

check_text:
  If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). 

  Execute the following query:

  SELECT a.name 'audit_name',
      a.type_desc 'storage_type',
      f.max_rollover_files
  FROM sys.server_audits a
  LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id
  WHERE a.is_state_enabled = 1

  If no records are returned, this is a finding.

  If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG", this is not a finding.

  If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding.


vuln_id: V-213944
rule_id: SV-213944r960930_rule
severity: CAT II
cci: CCI-000162
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.

description:
  <VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage.  

  To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc.  

  This requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections and limiting log data location. 

  Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. SQL Server is an application that is able to view and manipulate audit file data. 

  Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

  Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Modify audit file permissions to meet the requirement to protect against unauthorized access.  

  Application event log and security log permissions are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use.

  Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file and click "Properties".  

  On the Security tab, modify the security permissions to:  
  Administrator (read)  
  Users (none)  
  Audit Administrator(Full Control)  
  Auditors group (Read)  
  SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2]  
  SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2]  

  -----  
  Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.130).aspx.  

  Note 2: Tips for adding a service SID/virtual account to a folder's permission list.  

  1) In Windows Explorer, right-click the folder and select "Properties".  
  2) Select the "Security" tab.  
  3) Click "Edit".  
  4) Click "Add".  
  5) Click "Locations".  
  6) Select the computer name.  
  7) Search for the name.  
  7.a) SQL Server Service  
  7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.)  
  7.a.ii) Select the "MSSQL$" user and click "OK".
  7.b) SQL Agent Service  
  7.b.i) Type "NT SERVICE\SQL" and click "Check Names".  
  7.b.ii) Select the "SQLAgent$" user and click "OK". 
  8) Click "OK".  
  9) Permission like a normal user from here.

check_text:
  If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A.

  Obtain the SQL Server audit file location(s) by running the following SQL script:  

  SELECT log_file_path AS "Audit Path"  
  FROM sys.server_file_audits  

  For each audit, the path column will give the location of the file.  

  Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer.  

  Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied:  

  Administrator (read)  
  Users (none)  
  Audit Administrator (Full Control)  
  Auditors group (Read)  
  SQL Server Service SID OR Service Account (Full Control)  
  SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) 

  If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.


vuln_id: V-213948
rule_id: SV-213948r960942_rule
severity: CAT II
cci: CCI-001494
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must protect its audit configuration from authorized and unauthorized access and modification.

description:
  <VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. 
   
  Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. SQL Server is an application that does provide access to audit data. 
   
  Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

  If an attacker were to gain access to audit tools, they could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.

  Satisfies: SRG-APP-000121-DB-000202, SRG-APP-000123-DB-000204</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove audit-related permissions from individuals and roles not authorized to have them. 
   
  USE master;   
  DENY [ALTER ANY SERVER AUDIT] TO [User];   
  GO

check_text:
  Check the server documentation for a list of approved users with access to SQL Server Audits.
   
  To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission.
   
  Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: 
   
  SELECT login.name, perm.permission_name, perm.state_desc 
  FROM sys.server_permissions perm 
  JOIN sys.server_principals login 
  ON perm.grantee_principal_id = login.principal_id 
  WHERE permission_name in ('ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT', 'CONTROL SERVER') 
  and login.name not like '##MS_%'; 
   
  If unauthorized accounts have these privileges, this is a finding.


vuln_id: V-213950
rule_id: SV-213950r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must limit privileges to change software modules and links to software external to SQL Server.

description:
  <VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. 
   
  Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. 
   
  Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.

check_text:
  Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk.  
   
  If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. 
   
  To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. 
   
  Navigate to the folder above, and review the "Binn" subdirectory.


vuln_id: V-213951
rule_id: SV-213951r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.

description:
  <VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. 
   
  Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. 
   
  Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Implement and document a process by which changes made to software libraries are monitored and alerted.

  A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files.

  Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file.

  Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.

check_text:
  Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum.

  If alerts do not at least hash their value, this is a finding.

  To determine the location for these instance-specific binaries:

  Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property

  TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.


vuln_id: V-213952
rule_id: SV-213952r960960_rule
severity: CAT I
title: SQL Server software installation account must be restricted to authorized users.
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects on the overall security of the system. 

  If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed access to information system components for purposes of initiating changes, including upgrades and modifications. 

  DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  From a command prompt, open lusrmgr.msc. Navigate to Users and right-click Individual User. Select Properties >> Member Of. 
   
  Configure SQL Server and OS settings and access controls to restrict user access to objects and data that the user is authorized to view/use.

check_text:
  From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. 
   
  sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" 
  Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " 
   
  If any accounts are shown that are not authorized in the system documentation, this is a finding.


vuln_id: V-213953
rule_id: SV-213953r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

description:
  <VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. 
   
  Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Re-install SQL Server application components using dedicated directories that are separate from the operating system.  
   
  Relocate or reinstall other application software that currently shares directories with SQL Server components. 
   
  Separate from the operating system and/or temporary storage.

check_text:
  Determine the directory in which SQL Server has been installed:

  Using SQL Server Management Studio's Object Explorer:
  - Right-click [SQL Server Instance]
  - Select "Facets"
  - Record the value of RootDirectory

  Determine the Operating System directory:
  - Click "Start"
  - Type "Run"
  - Press "Enter"
  - Type "%windir%"
  - Click "Ok"
  - Record the value in the address bar

  Verify the SQL Server RootDirectory is not in the Operating System directory.

  Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding.

  Verify the SQL Server RootDirectory is not in another application's directory.

  Navigate to the SQL RootDirectory using Windows Explorer.

  Examine each directory for evidence another application is stored in it.

  If evidence exists the SQL RootDirectory is in another application's directory, this is a finding.

  If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding.

  Examples:
  1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding.

  2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding.

  3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.


vuln_id: V-213954
rule_id: SV-213954r960963_rule
severity: CAT II
title: Default demonstration and sample databases, database objects, and applications must be removed.
fix_text: Remove all demonstration or sample databases from production instances.
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 
   
  It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality, not required for every mission, that cannot be disabled. 
   
  DBMSs must adhere to the principles of least functionality by providing only essential capabilities. 
   
  Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. 
   
  If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: 
   
  pubs 
  Northwind
  AdventureWorks 
  WorldwideImporters 
   
  If any of these databases exist, this is a finding.


vuln_id: V-213955
rule_id: SV-213955r960963_rule
severity: CAT II
title: Unused database components, DBMS software, and database objects must be removed.
fix_text: Remove all features that are not required.
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 
   
  It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives.  
   
  DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  From the server documentation, obtain a listing of required components.  
   
  Generate a listing of components installed on the server. 
   
  Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" 
   
  Compare the feature listing against the required components listing.  
   
  If any features are installed, but are not required, this is a finding.


vuln_id: V-213956
rule_id: SV-213956r960963_rule
severity: CAT II
fix_text: Disable any unused components or features that cannot be uninstalled.
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.

description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
   
  It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives.  
   
  DBMSs must adhere to the principles of least functionality by providing only essential capabilities. 
   
  Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  From the server documentation, obtain a listing of required components. 

  Generate a listing of components installed on the server.

  Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report"

  Compare the feature listing against the required components listing. Note any components that are installed, but not required.

  Launch SQL Server Configuration Manager. 

  If any components that are installed but are not required are not disabled, this is a finding. 

  If any required components are not installed, this is a finding.


vuln_id: V-213957
rule_id: SV-213957r960963_rule
severity: CAT II
title: Access to xp_cmdshell must be disabled, unless specifically required and approved.
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
   
  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives.  
   
  Applications must adhere to the principles of least functionality by providing only essential capabilities. 
   
  SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. 
   
  The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable use of or remove any external application executable object definitions that are not authorized.

  To disable the use of xp_cmdshell, from the query prompt: 

  EXEC sp_configure 'show advanced options', 1; 
  GO 
  RECONFIGURE; 
  GO 
  EXEC sp_configure 'xp_cmdshell', 0; 
  GO 
  RECONFIGURE; 
  GO??

check_text:
  The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. 
   
  To determine if xp_cmdshell is enabled, execute the following commands:  
   
  EXEC SP_CONFIGURE 'show advanced options', '1';  
  RECONFIGURE WITH OVERRIDE;  
  EXEC SP_CONFIGURE 'xp_cmdshell';  
   
  If the value of "config_value" is "0", this is not a finding.  
   
  Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.


vuln_id: V-213958
rule_id: SV-213958r960963_rule
severity: CAT II
title: Access to CLR code must be disabled or restricted, unless specifically required and approved.
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
   
  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives.  
   
  Applications must adhere to the principles of least functionality by providing only essential capabilities. 
   
  SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. 
   
  The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#.  CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code.  Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable use of or remove any CLR code that is not authorized. 
   
  To disable the use of CLR, from the query prompt:  
   
  sp_configure 'show advanced options', 1; 
  GO 
  RECONFIGURE; 
  GO 
  sp_configure 'clr enabled', 0; 
  GO 
  RECONFIGURE; 
  GO 
   
  For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.

check_text:
  The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.  

  To determine if CLR is enabled, execute the following commands:  

  EXEC SP_CONFIGURE 'show advanced options', '1';  
  RECONFIGURE WITH OVERRIDE;  
  EXEC SP_CONFIGURE 'clr enabled';  

  If the value of "config_value" is "0", this is not a finding.  

  If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. 

  If CLR code is approved, check the database for UNSAFE assembly permission using the following script: 

  USE [master]
  SELECT *  
  FROM sys.assemblies 
  WHERE permission_set_desc != 'SAFE' 
  AND is_user_defined = 1;

  If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.


vuln_id: V-213959
rule_id: SV-213959r960963_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.

description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
   
  It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives.  
   
  Applications must adhere to the principles of least functionality by providing only essential capabilities. 
   
  SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. 
   
  Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API.  Non-Standard extended stored procedures can compromise the integrity of the SQL Server process.  This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove any Non-Standard extended stored procedures that are not documented and approved. 
   
  sp_dropextendedproc 'proc name'

check_text:
  Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API.   
   
  Non-Standard extended stored procedures can compromise the integrity of the SQL Server process.  This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.  
   
  To determine if non-standard extended stored procedures exist, run the following:

  ------------------------------------------------------------------------
  USE [master]
  GO
  DECLARE @xplist AS TABLE
  (
         xp_name sysname,
         source_dll nvarchar(255)
  )
  INSERT INTO @xplist
  EXEC sp_helpextendedproc

  SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name
  ------------------------------------------------------------------------
   
  If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved.

  If it is not approved, this is a finding.


vuln_id: V-213960
rule_id: SV-213960r1018585_rule
severity: CAT II
title: Access to linked servers must be disabled or restricted, unless specifically required and approved.
cci: CCI-000381
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.  This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable use of or remove any linked servers that are not authorized.  
   
  To remove a linked server and all associated logins run the following: 
   
  sp_dropserver 'LinkedServerName', 'droplogins'; 
   
  To remove a login from a linked server run the following: 
   
  EXEC sp_droplinkedsrvlogin 'LoginName', NULL;

check_text:
  A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.
   
  To obtain a list of linked servers, execute the following command:
   
  SELECT name
  FROM sys.servers s 
  WHERE s.is_linked = 1 
   
  Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. 
   
  Run the following to get a linked server login mapping: 
   
  SELECT s.name, p.principal_id, l.remote_name 
  FROM sys.servers s 
  JOIN sys.linked_logins l ON s.server_id = l.server_id 
  LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id 
  WHERE s.is_linked = 1 
   
  Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.


vuln_id: V-213961
rule_id: SV-213961r1043177_rule
severity: CAT II
cci: CCI-000382
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the PPSM CAL and vulnerability assessments.

description:
  <VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary protocols on information systems. 
   
  Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component.  
   
  To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of protocols to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. 
   
  SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In SQL Server Configuration Manager >> SQL Server Network Configuration >> Protocols, right-click on each listed protocol that is enabled but not authorized and Select "Disable".

check_text:
  To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance.  
   
  If Named Pipes is enabled and not specifically required and authorized, this is a finding. 
   
  If any listed protocol is enabled but not authorized, this is a finding.


vuln_id: V-213962
rule_id: SV-213962r1043177_rule
severity: CAT II
cci: CCI-000382
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the PPSM CAL and vulnerability assessments.

description:
  <VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports on information systems. 
   
  Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component.  
   
  To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. 
   
  SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Use SQL Server Configuration to change the ports used by SQL Server to comply with PPSM guidance, or document the need for other ports, and obtain written approval. Close ports no longer needed.

check_text:
  Review SQL Server Configuration for the ports used by SQL Server.  
   
  To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.)  
   
  If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding.


vuln_id: V-213963
rule_id: SV-213963r1051115_rule
severity: CAT II
cci: CCI-000764
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

description:
  <VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.  
   
  Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: 
   
  (i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and  
  (ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove user-accessible shared accounts and use individual userIDs.  
   
  Configure applications to ensure successful individual authentication prior to shared account access.  
   
  Ensure each user's identity is received and used in audit data in all relevant circumstances.

check_text:
  Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.)    
   
  If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. 
   
  If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.  
   
  If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.


vuln_id: V-213964
rule_id: SV-213964r1112499_rule
severity: CAT I
cci: CCI-004066
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  If DBMS authentication using passwords is employed, SQL Server must enforce the DOD standards for password complexity and lifetime.

description:
  <VulnDiscussion>Windows Authentication is the default authentication mode and is much more secure than SQL Server Authentication. Windows Authentication uses Kerberos security protocol, provides password policy enforcement with regard to complexity validation for strong passwords, provides support for account lockout, and supports password expiration. A connection made using Windows Authentication is sometimes called a trusted connection, because SQL Server trusts the credentials provided by Windows.

  By using Windows Authentication, Windows groups can be created at the domain level, and a login can be created on SQL Server for the entire group. Managing access at the domain level can simplify account administration.

  OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native SQL Server authentication may be used only when circumstances make it unavoidable and must be documented and Authorizing Official (AO)-approved. 
   
  The DOD standard for authentication is DOD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate and requires AO approval. 
   
  In such cases, the DOD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the SQL Server operating system and SQL Server logins for compliance. 

  Review the Operating System settings relating to password complexity.

  Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created. 

  CREATE LOGIN <login_name> WITH PASSWORD= <enterStrongPasswordHere>, CHECK_EXPIRATION = ON, CHECK_POLICY = ON;

check_text:
  Check for use of SQL Server Authentication:

  SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode]

  If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding.

  If the returned value in the "Authentication Mode" column is "SQL Server Authentication", SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system.

  Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement:

  SELECT [name], is_expiration_checked, is_policy_checked
  FROM sys.sql_logins

  Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, ##MS_PolicyEventProcessingLogin##, ##MS_SSISServerCleanupJobLogin##, and other internal accounts that start with ##MS.

  If any account does not have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding.

  Review the operating system settings relating to password complexity.

  To check the server operating system for password complexity:

  Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy, and to review the local policies on the machine, go to Account Policy >> Password Policy.

  Ensure the DISA Windows Password Policy is set on the SQL Server member server. If any are not, this is a finding.


vuln_id: V-213965
rule_id: SV-213965r1018610_rule
severity: CAT II
title: Contained databases must use Windows principals.
cci: CCI-004066
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable, and must be documented and Authorizing Official (AO)-approved.
   
  The DOD standard for authentication is DOD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval.
   
  In such cases, the DOD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the SQL Server contained databases to have users originating from Windows principals. Remove any users not created from Windows principals.

check_text:
  Execute the following query to determine if contained databases are used: 
   
  SELECT * FROM sys.databases WHERE containment = 1 
   
  If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. 
   
  EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' 
   
  If any records are returned, this is a finding.


vuln_id: V-213966
rule_id: SV-213966r1051304_rule
severity: CAT I
cci: CCI-000197
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

description:
  <VulnDiscussion>The DOD standard for authentication is DOD-approved PKI certificates. 
   
  Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate and requires AO approval. 
   
  In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. 
   
  SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure SQL Server to encrypt authentication data for remote connections using DOD-approved cryptography.

  Deploy encryption to the SQL Server Network Connections.

  From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc" and pressing "ENTER".

  Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties".

  In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop-down for the Certificate box and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes" and then click "OK" to close the dialog box. Restart the SQL Server service.

  For clustered instances, install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manager.

  1. Navigate to the certificate store where the FQDN certificate is stored by typing "certlm.msc" and pressing "ENTER".

  2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window.

  3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad.

  4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate

  5. If the SQL virtual server is currently on this node, failover to another node in the cluster and then reboot the node where the registry change occurred.

  6. Repeat this procedure on all the nodes.

check_text:
  1. Launch SSMS and connect to the SQL Server to be reviewed.

  2. Right-click the instance and select "Properties".

  3. Navigate to the "Security" tab.

  If the value for "Server authentication" is "Windows Authentication mode", this requirement is Not Applicable.

  From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc" and pressing "Enter".

  Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on "Protocols", where there is a placeholder for the SQL Server instance name, and click on "Properties". 

  On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding.

  On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab.

  If it is not a DOD approved certificate, or if no certificate is listed, this is a finding.

  For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager.

  1. From a command prompt, navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored by typing "certlm.msc" and pressing "Enter".

  2. In the left side of the window, expand the "Personal" folder, and click "Certificates".

  3. Verify that the Certificate with the FQDN name is issued by the DOD. Double-click the certificate, click the "Details" tab, and note the value for the Thumbprint.

  4. Verify the value for the "Thumbprint" field matches the value in the registry by running regedit and looking at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate".

  5. Run this on each node of the cluster.

  If any nodes have a certificate in use by SQL that is not issued or approved by DOD, this is a finding.


vuln_id: V-213967
rule_id: SV-213967r961029_rule
severity: CAT I
cci: CCI-000197
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Confidentiality of information during transmission is controlled through the use of an approved TLS version.

description:
  <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a FIPS-approved minimum TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems.

  References:
  TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 
  TLS Registry Settings:  https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure you have a recent backup of the system and registry settings.

  Access the SQL Server.
  Access an administrator command prompt. 
  Type "regedit" to launch the Registry Editor.
   
  Enable TLS 1.2:
    
  1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
     a.If the "TLS 1.2" key does not exist, right-click "Protocols".
     b.Click "New".
     c.Click "Key".
     d.Type the name "TLS 1.2".

  2.Navigate to the "TLS 1.2" subkey.
     a.If the subkey "Client" does not exist, right-click "TLS 1.2"
     b.Click "New".
     c.Click "Key".
     d.Type the name "Client".
     e.Repeat steps A – D for the "Server" subkey.

  3.Navigate to the "Client" subkey.
     a.If the value "Enabled" does not exist, right-click on "Client".
     b.Click "New".
     c.Click "DWORD".
     d.Enter "Enabled" as the name.
     e.Repeat steps A-D for the value "DisabledByDefault".

  4.Double-click "Enabled".

  5.In Value Data, enter "1".

  6.Click "OK".

  7.Double-click "DisabledByDefault".

  8.In Value Data, enter "0".

  9.Click "OK".

  10.Repeat steps 3 – 9 for the "Server" subkey.
   

  Disable unwanted SSL/TLS protocol versions:

  1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
     a.If the "TLS 1.0" key does not exist, right-click "Protocols".
     b.Click "New".
     c.Click "Key".
     d.Type the name "TLS 1.0".

  2.Navigate to the "TLS 1.0" subkey.
     a.If the subkey "Client" does not exist, right-click "TLS 1.0".
     b.Click "New".
     c.Click "Key".
     d.Type the name "Client".
     e.Repeat steps A – D for the "Server" subkey.

  3.Navigate to the "Client" subkey.
     a.If the value "Enabled" does not exist, right-click on "Client".
     b.Click "New".
     c.Click "DWORD".
     d.Enter "Enabled" as the name.
     e.Repeat steps A-D for the value "DisabledByDefault".

  4.Double-click "Enabled".

  5.In Value Data, enter "0".

  6.Click "OK".

  7.Double-click "DisabledByDefault".

  8.In Value Data, enter "1".

  9.Click "OK".

  10.Repeat steps 3 – 9 for the "Server" subkey.

  11.Repeat steps 1 – 10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0".

check_text:
  Access the SQL Server.
  Access an administrator command prompt.
  Type "regedit" to launch the Registry Editor.
   
  Navigate to:
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2

  If this key does not exist, this is a finding.

  Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server.
   
  Navigate to:
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0
  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0

  Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys.
   
  If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3.


vuln_id: V-213968
rule_id: SV-213968r961041_rule
severity: CAT I
title: SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.
cci: CCI-000186
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. 
   
  If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where SQL Server-stored private keys are used to authenticate SQL Server to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against SQL Server system and its clients. 
   
  Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 or FIPS 140-3 validated cryptographic modules. 
   
  All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Enable use of FIPS-compliant algorithms. 
   
  Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options 
   
  Double-click "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing." 
   
  Click Enabled >> Apply.

check_text:
  Review system configuration to determine whether FIPS compliant support has been enabled. 
   
  Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options
   
  Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. 

  If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. 
   
  For more information, see https://support.microsoft.com/en-us/kb/3141890.


vuln_id: V-213969
rule_id: SV-213969r961050_rule
severity: CAT I
cci: CCI-000803
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

description:
  <VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken, and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to, and modify data stored in, the database as well as the administration settings of SQL Server. 
   
  Applications, including DBMSs, utilizing cryptography are required to use approved NIST FIPS 140-2 or 140-3 validated cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.   
   
  NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

  The standard for validating cryptographic modules will transition to the NIST FIPS 140-3 publication.

  FIPS 140-2 modules can remain active for up to five years after validation or until September 21, 2026, when the FIPS 140-2 validations will be moved to the historical list. Even on the historical list, CMVP supports the purchase and use of these modules for existing systems. While Federal Agencies decide when they move to FIPS 140-3 only modules, purchasers are reminded that for several years there may be a limited selection of FIPS 140-3 modules from which to choose. CMVP recommends purchasers consider all modules that appear on the Validated Modules Search Page:
  https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

  More information on the FIPS 140-3 transition can be found here: 
  https://csrc.nist.gov/Projects/fips-140-3-transition-effort/</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".
   
  In the dialog box that appears, if the radio buttons are active, click "Enabled", and then click "Apply". If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.

check_text:
  In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".  
   
  If, in the "Security Setting" column, the value is "Disabled," this is a finding. 
   
  https://support.microsoft.com/en-us/kb/955720


vuln_id: V-213970
rule_id: SV-213970r961053_rule
severity: CAT II
cci: CCI-000804
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

description:
  <VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). 
   
  Non-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. 
   
  Accordingly, a risk assessment is used in determining the authentication needs of the organization. 
   
  Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.

check_text:
  Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system.  
   
  Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: 
   
  SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') 
   
  If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. 
   
  If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding.  
   
  If non-organizational users are not uniquely identified and authenticated, this is a finding.


vuln_id: V-213971
rule_id: SV-213971r1043181_rule
severity: CAT II
cci: CCI-001188
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

description:
  <VulnDiscussion>One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. 
   
  The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 or FIPS 140-3 approved random number generator. 
   
  However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure Windows to require the use of FIPS compliant algorithms. 
   
  Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography:  Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart Windows

check_text:
  Verify that Windows is configured to require the use of FIPS compliant algorithms. 
   
  Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography:  Use FIPS compliant algorithms for encryption, hashing, and signing." 
   
  If the Security Setting for this option is "Disabled", this is a finding.


vuln_id: V-213972
rule_id: SV-213972r961128_rule
severity: CAT I
title: SQL Server must protect the confidentiality and integrity of all information at rest.
cci: CCI-001199
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use.  
   
  User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.  
   
  If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption. 

  To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on.

  Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).

check_text:
  Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II.  
   
  If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted.  
   
  If full-disk encryption is being used, this is not a finding.  
   
  If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing:  
   
  SELECT  
  d.name AS [Database Name],  
  CASE e.encryption_state  
  WHEN 0 THEN 'No database encryption key present, no encryption'  
  WHEN 1 THEN 'Unencrypted'  
  WHEN 2 THEN 'Encryption in progress'  
  WHEN 3 THEN 'Encrypted'  
  WHEN 4 THEN 'Key change in progress'  
  WHEN 5 THEN 'Decryption in progress'  
  WHEN 6 THEN 'Protection change in progress'  
  END AS [Encryption State]  
  FROM sys.dm_database_encryption_keys e  
  RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name  
  WHERE d.name NOT IN ('master','model','msdb')  
  ORDER BY [Database Name] ;  
   
  For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. 
   
  Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.


vuln_id: V-213973
rule_id: SV-213973r961128_rule
severity: CAT II
cci: CCI-001199
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  The Service Master Key must be backed up and stored in a secure location that is not on the SQL Server.

description:
  <VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document and implement procedures to safely back up and store the Service Master Key in a secure location that is not on the SQL Server. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key.
   
  BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file'  
  ENCRYPTION BY PASSWORD = 'password';  
   
  As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.

check_text:
  Review procedures for and evidence of backup of the Server Service Master Key in the System Security Plan.  
   
  If the procedures or evidence does not exist, this is a finding.
   
  If the procedures do not indicate that a backup of the Service Master Key is stored in a secure location that is not on the SQL Server, this is a finding. 

  If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.


vuln_id: V-213974
rule_id: SV-213974r961128_rule
severity: CAT II
title: The Master Key must be backed up and stored in a secure location that is not on the SQL Server.
cci: CCI-001199
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document and implement procedures to safely back up and store the Master Key in a secure location that is not on the SQL Server. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Master Key.

  BACKUP MASTER KEY TO FILE = 'path_to_file'  
  ENCRYPTION BY PASSWORD = 'password';  
   
  As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.

check_text:
  If the application owner and authorizing official have determined that encryption of data at rest is not required, this is not a finding. 
   
  Review procedures for and evidence of backup of the Master Key in the System Security Plan.  
   
  If the procedures or evidence does not exist, this is a finding.  
   
  If the procedures do not indicate that a backup of the Master Key is stored in a secure location that is not on the SQL Server, this is a finding.

  If procedures do not indicate access restrictions to the Master Key backup, this is a finding.


vuln_id: V-213975
rule_id: SV-213975r961149_rule
severity: CAT II
cci: CCI-001090
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must prevent unauthorized and unintended information transfer via shared system resources.

description:
  <VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. 
   
  sp_configure 'show advanced options', 1;   
  GO   
  RECONFIGURE;   
  GO   
  sp_configure 'common criteria compliance enabled', 1;   
  GO   
  RECONFIGURE   
  GO

check_text:
  Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. 

  SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. 

  Review the Instance configuration: 


  SELECT value_in_use
  FROM sys.configurations
  WHERE name = 'common criteria compliance enabled'

  If "value_in_use" is set to "1" this is not a finding.
  If "value_in_use" is set to "0" this is a finding. 

  NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding.


vuln_id: V-213976
rule_id: SV-213976r961149_rule
severity: CAT II
cci: CCI-001090
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must prevent unauthorized and unintended information transfer via Instant File Initialization (IFI).

description:
  <VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.

  When Instant File Initialization (IFI) is in use, the deleted disk content is overwritten only as new data is written to the files. For this reason, the deleted content might be accessed by an unauthorized principal until some other data writes on that specific area of the data file.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.

check_text:
  Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016).

  Start >> Control Panel >> System and Security >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment >> Perform volume maintenance tasks

  The default SQL service account for a default instance is NT SERVICE\MSSQLSERVER or for a named instance is NT SERVICE\MSSQL$InstanceName.

  If the SQL service account or SQL service SID has been granted "Perform volume maintenance tasks" Local Rights Assignment, this means that Instant File Initialization (IFI) is enabled.

  Review the system documentation to determine if Instant File Initialization (IFI) is required.

  If IFI is enabled but not documented as required, this is a finding.

  If IFI is not enabled, this is not a finding.


vuln_id: V-213977
rule_id: SV-213977r961149_rule
severity: CAT II
cci: CCI-001090
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Access to database files must be limited to relevant processes and to authorized, administrative users.

description:
  <VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove any unauthorized permission grants from SQL Server data, log, and backup directories.

  1) On the "Security" tab, highlight the user entry.
  2) Click "Remove".

check_text:
  Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. 

  To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql".

  For each of the directories returned by the above script, verify whether the correct permissions have been applied.

  1) Launch Windows Explorer.
  2) Navigate to the folder.
  3) Right-click the folder and click "Properties".
  4) Navigate to the "Security" tab.
  5) Review the listing of principals and permissions.

  Account Type			Directory Type		Permission
  -----------------------------------------------------------------------------------------------
  Database Administrators      	ALL                   		Full Control
  SQL Server Service SID       	Data; Log; Backup;    	Full Control
  SQL Server Agent Service SID 	Backup                	Full Control
  SYSTEM                       		ALL                   		Full Control
  CREATOR OWNER                	ALL                   		Full Control

  For information on how to determine a "Service SID", go to:
  https://aka.ms/sql-service-sids

  Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at:
  https://aka.ms/sqlservicepermissions

  If any additional permissions are granted but not documented as authorized, this is a finding.


vuln_id: V-213978
rule_id: SV-213978r1067807_rule
severity: CAT II
cci: CCI-001314
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must reveal detailed error messages only to documented and approved individuals or roles.

description:
  <VulnDiscussion>If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. 
   
  Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. 
   
  It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. 
   
  If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.   
   
  If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. 
   
  Consider enabling trace flag 3625 to mask certain system-level error information returned to nonadministrative users. 

  Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. 
   
  If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.   
   
  If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. 
   
  Enable trace flag 3625 to mask certain system-level error information returned to nonadministrative users. 
   
  To launch SQL Server Configuration Manager, select "SQL Server Services", select the "SQL Server", then right-click and select "Properties". Select "Startup Parameters" tab,  enter "-T3625", and then click "Add". Click "OK", then restart SQL instance.

  To launch SQL Server Configuration Manager, click "SQL Services", open the instance properties, click the "Service Parameters" tab, enter "-T3625". Click "Add", click "OK", then restart SQL instance.

check_text:
  Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices.  

  SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: 

  USE master 
  GO
  SELECT Name 
  FROM syslogins 
  WHERE (sysadmin = 1 or securityadmin = 1) 
  and hasaccess = 1; 

  If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. 

  In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed.  

  If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio or if documentation does not exist stating that full error messages must be returned, this is a finding.

  Otherwise, verify if trace flag 3625 is enabled to mask certain system-level error information returned to nonadministrative users. 
   
  Launch SQL Server Configuration Manager: 
  Select SQL Server Services >> SQL Server. Select the SQL Server, then right-click and select "Properties". Select "Startup Parameters" tab and verify -T3625 exists in the dialogue window.

  OR

  Run the query:
  DBCC TRACESTATUS;

  If TraceFlag 3625 does not return with Status = 1 and if documentation does not exist stating that full error messages must be returned, this is a finding.


vuln_id: V-213979
rule_id: SV-213979r961353_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

description:
  <VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.  
   
  System documentation should include a definition of the functionality considered privileged. 
   
  Depending on circumstances, privileged functions can include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. 
   
  A privileged function in SQL Server/database context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to:  
  CREATE 
  ALTER 
  DROP 
  GRANT 
  REVOKE 
  DENY 
   
  There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples include: 
   
  TRUNCATE TABLE; 
  DELETE, or 
  DELETE affecting more than n rows, for some n, or 
  DELETE without a WHERE clause; 
   
  UPDATE or 
  UPDATE affecting more than n rows, for some n, or 
  UPDATE without a WHERE clause; 
   
  Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. 
   
  Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Restrict the granting of permissions to server-level securables to only those authorized. Most notably, members of sysadmin and securityadmin built-in instance-level roles, CONTROL SERVER permission, and use of the GRANT with GRANT permission.

check_text:
  Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. 
   
  Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. 
   
  Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. 
   
  Get all permission assignments to logins and roles: 
   
  SELECT DISTINCT 
      CASE 
          WHEN SP.class_desc IS NOT NULL THEN 
              CASE 
                  WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' 
                  WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' 
                  ELSE SP.class_desc 
              END 
          WHEN E.name IS NOT NULL THEN 'ENDPOINT' 
          WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' 
          WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' 
          WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' 
          ELSE '???' 
      END                    AS [Securable Class], 
      CASE 
          WHEN E.name IS NOT NULL THEN E.name 
          WHEN S.name IS NOT NULL THEN S.name 
          WHEN P.name IS NOT NULL THEN P.name 
          ELSE '???' 
      END                    AS [Securable], 
      P1.name                AS [Grantee], 
      P1.type_desc           AS [Grantee Type], 
      sp.permission_name     AS [Permission], 
      sp.state_desc          AS [State], 
      P2.name                AS [Grantor], 
      P2.type_desc           AS [Grantor Type] 
  FROM 
      sys.server_permissions SP 
      INNER JOIN sys.server_principals P1 
          ON P1.principal_id = SP.grantee_principal_id 
      INNER JOIN sys.server_principals P2 
          ON P2.principal_id = SP.grantor_principal_id 
   
      FULL OUTER JOIN sys.servers S 
          ON  SP.class_desc = 'SERVER' 
          AND S.server_id = SP.major_id 
   
      FULL OUTER JOIN sys.endpoints E 
          ON  SP.class_desc = 'ENDPOINT' 
          AND E.endpoint_id = SP.major_id 
   
      FULL OUTER JOIN sys.server_principals P 
          ON  SP.class_desc = 'SERVER_PRINCIPAL'        
          AND P.principal_id = SP.major_id 
   
  Get all server role memberships: 
   
  SELECT 
      R.name    AS [Role], 
      M.name    AS [Member] 
  FROM 
      sys.server_role_members X 
      INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id 
      INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id 
   
  The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) 
   
  Ensure only the documented and approved logins have privileged functions in SQL Server.  
   
  If the current configuration does not match the documented baseline, this is a finding.


vuln_id: V-213980
rule_id: SV-213980r961359_rule
severity: CAT II
title: Use of credentials and proxies must be restricted to necessary cases only.
cci: CCI-002233
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. 
   
  Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove any SQL Agent Proxy accounts and credentials that are not authorized. 
   
  DROP CREDENTIAL <Credential Name> 
  GO 
   
  USE [msdb] 
  EXEC sp_delete_proxy @proxy_name = '<Proxy Name>' 
  GO

check_text:
  Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. 
   
  SELECT C.name AS credential_name, C.credential_identity 
  FROM sys.credentials C 
  GO 
   
  SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity 
  FROM sys.credentials C  
  JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id 
  WHERE P.enabled = 1 
  GO 
   
  If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding.


vuln_id: V-213983
rule_id: SV-213983r1018595_rule
severity: CAT II
cci: CCI-001849
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

description:
  <VulnDiscussion>In order to ensure sufficient storage capacity for the audit logs, SQL Server must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. 
   
  The task of allocating audit record storage capacity is usually performed during initial installation of SQL Server and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. 
   
  In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Review the SQL Audit file location; ensure the destination has enough space available to accommodate the maximum total size of all files that could be written. 
   
  Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. 
   
  Update the "max_files" or "max_rollover_files" parameter of the audits to ensure the correct number of files is defined.

  If writing to application event logs or security logs, space considerations are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use.

check_text:
  If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is Not Applicable.

  Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. 
   
  SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path"  
  FROM sys.server_file_audits 
   
  Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. 
   
  If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location, this is a finding; 

  OR if "max_file_size" is set to "0" (Unlimited), this is a finding;

  OR if "max_rollover_files" are set to "0" (None) or "2147483647" (Unlimited), this is a finding.


vuln_id: V-213984
rule_id: SV-213984r961398_rule
severity: CAT II
cci: CCI-001855
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

description:
  <VulnDiscussion>Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to SQL Server on its own server will not be an issue. However, space will still be required on the server for SQL Server audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. 
   
  If support personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion.  
   
  The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. 
   
  Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.

check_text:
  The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration.  
   
  If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.


vuln_id: V-213985
rule_id: SV-213985r961401_rule
severity: CAT II
cci: CCI-001858
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.

description:
  <VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.  

  The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. 

  A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions

  Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.

check_text:
  Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason.

  If real-time alerts are not sent upon auditing failure, this is a finding.


vuln_id: V-213986
rule_id: SV-213986r961443_rule
severity: CAT II
cci: CCI-001890
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).

description:
  <VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. 
   
  Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Where possible, configure the operating system to automatic synchronize with an official time server, using NTP. 
   
  Where there is reason not to implement automatic synchronization with an official time server, using NTP, document the reason, and the procedure for maintaining the correct time, and obtain AO approval. Enforce the procedure.

check_text:
  SQL Server audits store the timestamp in UTC time.  
   
  Determine if the computer is joined to a domain. 
   
  SELECT DEFAULT_DOMAIN()[DomainName]  
   
  If this is not NULL, this is not a finding. 
   
  If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) 
   
       w32tm /query /source 
   
  If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding.  
   
  If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system.  
   
  If such a procedure does not exist, this is a finding.  
   
  If the procedure exists, review evidence that the correct time is actually maintained.  
   
  If the evidence indicates otherwise, this is a finding.


vuln_id: V-213987
rule_id: SV-213987r961461_rule
severity: CAT II
cci: CCI-001813
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must enforce access restrictions associated with changes to the configuration of the instance.

description:
  <VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system.  
   
  When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system.  
   
  Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Revoke unauthorized permissions from principals. 
   
  https://msdn.microsoft.com/en-us/library/ms186308.aspx 
   
  Remove unauthorized logins from roles. 
   
  ALTER SERVER ROLE DROP MEMBER login; 
   
  https://technet.microsoft.com/en-us/library/ee677634.aspx

check_text:
  Obtain a list of logins who have privileged permissions and role memberships in SQL. 
   
  Execute the following query to obtain a list of logins and roles and their respective permissions assignment: 
   
  SELECT p.name AS Principal, 
  p.type_desc AS Type, 
  sp.permission_name AS Permission,  
  sp.state_desc AS State 
  FROM sys.server_principals p 
  INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id 
  WHERE sp.permission_name = 'CONTROL SERVER' 
  OR sp.state = 'W' 
   
  Execute the following query to obtain a list of logins and their role memberships. 
   
  SELECT m.name AS Member, 
  m.type_desc AS Type, 
  r.name AS Role 
  FROM sys.server_principals m 
  INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id 
  INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id 
  WHERE r.name IN ('sysadmin','securityadmin','serveradmin') 
   
  Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding.


vuln_id: V-213988
rule_id: SV-213988r961461_rule
severity: CAT II
fix_text: Remove users from the local Administrators group who are not authorized.
cci: CCI-001813
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.

description:
  <VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system.  
   
  When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system.  
   
  Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Obtain a list of users who have privileged access to the server via the local Administrators group. 
   
  Launch lusrmgr.msc 
  Select Groups 
  Double-click Administrators 
   
  Alternatively, execute the following command in PowerShell: 

  net localgroup administrators 
   
  Check the server documentation to verify the users returned are authorized.  
   
  If the users are not documented and authorized, this is a finding.


vuln_id: V-213989
rule_id: SV-213989r1018611_rule
severity: CAT II
cci: CCI-003938
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).

description:
  <VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions.
   
  Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Add the required events to the server audit specification to audit denied actions.

  USE [master]; 
  GO  

  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF);  
  GO  

  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_ACCESS_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD 
  (DBCC_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP ); 
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP ); 
  GO 

  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON);  
  GO

check_text:
  Determine if an audit is configured to capture denied actions and started by executing the following query:

  SELECT name AS 'Audit Name',
  status_desc AS 'Audit Status',
  audit_file_path AS 'Current Audit File'
  FROM sys.dm_server_audit_status

  If no records are returned, this is a finding.

  Execute the following query to verify the following events are included in the server audit specification:

  APPLICATION_ROLE_CHANGE_PASSWORD_GROUP,
  AUDIT_CHANGE_GROUP,
  BACKUP_RESTORE_GROUP,
  DATABASE_CHANGE_GROUP,
  DATABASE_OBJECT_ACCESS_GROUP,
  DATABASE_OBJECT_CHANGE_GROUP,
  DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP,
  DATABASE_OBJECT_PERMISSION_CHANGE_GROUP,
  DATABASE_OWNERSHIP_CHANGE_GROUP,
  DATABASE_OPERATION_GROUP,
  DATABASE_PERMISSION_CHANGE_GROUP,
  DATABASE_PRINCIPAL_CHANGE_GROUP,
  DATABASE_PRINCIPAL_IMPERSONATION_GROUP,
  DATABASE_ROLE_MEMBER_CHANGE_GROUP,
  DBCC_GROUP,
  LOGIN_CHANGE_PASSWORD_GROUP,
  SCHEMA_OBJECT_CHANGE_GROUP,
  SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP,
  SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP,
  SERVER_OBJECT_CHANGE_GROUP,
  SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP,
  SERVER_OBJECT_PERMISSION_CHANGE_GROUP,
  SERVER_OPERATION_GROUP,
  SERVER_PERMISSION_CHANGE_GROUP,
  SERVER_PRINCIPAL_IMPERSONATION_GROUP,
  SERVER_ROLE_MEMBER_CHANGE_GROUP,
  SERVER_STATE_CHANGE_GROUP,
  TRACE_CHANGE_GROUP

  SELECT a.name AS 'AuditName',
  s.name AS 'SpecName',
  d.audit_action_name AS 'ActionName',
  d.audited_result AS 'Result'
  FROM sys.server_audit_specifications s
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
  WHERE a.is_state_enabled = 1
  AND d.audit_action_name IN (
  'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP',
  'AUDIT_CHANGE_GROUP',
  'BACKUP_RESTORE_GROUP',
  'DATABASE_CHANGE_GROUP',
  'DATABASE_OBJECT_ACCESS_GROUP',
  'DATABASE_OBJECT_CHANGE_GROUP',
  'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP',
  'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP',
  'DATABASE_OWNERSHIP_CHANGE_GROUP',
  'DATABASE_OPERATION_GROUP',
  'DATABASE_PERMISSION_CHANGE_GROUP',
  'DATABASE_PRINCIPAL_CHANGE_GROUP',
  'DATABASE_PRINCIPAL_IMPERSONATION_GROUP',
  'DATABASE_ROLE_MEMBER_CHANGE_GROUP', 
  'DBCC_GROUP',
  'LOGIN_CHANGE_PASSWORD_GROUP',
  'SCHEMA_OBJECT_CHANGE_GROUP',
  'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP',
  'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP',
  'SERVER_OBJECT_CHANGE_GROUP',
  'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP',
  'SERVER_OBJECT_PERMISSION_CHANGE_GROUP',
  'SERVER_OPERATION_GROUP',
  'SERVER_PERMISSION_CHANGE_GROUP',
  'SERVER_PRINCIPAL_IMPERSONATION_GROUP',
  'SERVER_ROLE_MEMBER_CHANGE_GROUP',
  'SERVER_STATE_CHANGE_GROUP',
  'TRACE_CHANGE_GROUP'
  )
  Order by d.audit_action_name

  If the identified groups are not returned, this is a finding.


vuln_id: V-213990
rule_id: SV-213990r961470_rule
severity: CAT II
cci: CCI-001762
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

description:
  <VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Assign the approved TCP/IP port number to the SQL Server Database Engine. 
  1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for <instance name>, and then double-click "TCP/IP". 
  2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. 
  3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". 
  4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". 
  5. In the console pane, click "SQL Server Services". 
  6. In the details pane, right-click "SQL Server (<instance name>)" and then click "Restart", to stop and restart SQL Server. 
   
  To disable a server network protocol for an instance: 
  1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. 
  2. In the console pane, click "Protocols" for <instance name>. 
  3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". 
  4. In the console pane, click "SQL Server Services". 
  5. In the details pane, right-click "SQL Server (<instance name>)", and then click "Restart", to stop and restart the SQL Server service.

check_text:
  SQL Server must only use approved network communication libraries, ports, and protocols. 
   
  Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. 
   
  Verify that the protocols are enabled for the instance. 
   
  If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.


vuln_id: V-213991
rule_id: SV-213991r961608_rule
severity: CAT II
title: SQL Server must maintain a separate execution domain for each executing process.
cci: CCI-002530
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space.  
   
  Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process.  
   
  Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable CLR support in SQL Server by executing the following query: 
   
  EXEC sp_configure 'clr enabled', 0 
  GO 
   
  RECONFIGURE 
  GO

check_text:
  Review the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: 
   
  SELECT name, value, value_in_use 
  FROM sys.configurations 
  WHERE name = 'clr enabled' 
   
  If "value_in_use" is a "1" and CLR is not required, this is a finding.


vuln_id: V-213992
rule_id: SV-213992r961608_rule
severity: CAT II
title: SQL Server services must be configured to run under unique dedicated user accounts.
cci: CCI-002530
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
description:
  <VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure SQL Server services to have a documented, dedicated account.  
   
  For non-domain servers, consider using virtual service accounts (VSA). See https://msdn.microsoft.com/en-us/library/ms143504.aspx#VA_Desc for more information. 
   
  For standalone, domain-joined servers, consider using managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#MSA for more information. 
   
  For clustered instances, consider using group managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#GMSA or https://blogs.msdn.microsoft.com/markweberblog/2016/05/25/group-managed-service-accounts-gmsa-and-sql-server-2016/ for more information.

check_text:
  Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. 
   
  Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. 
   
  If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding.


vuln_id: V-213993
rule_id: SV-213993r961677_rule
severity: CAT II
fix_text: Remove all features that are not required.
cci: CCI-002617
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  When updates are applied to SQL Server software, any software components that have been replaced or made unnecessary must be removed.

description:
  <VulnDiscussion>Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries.  
   
  Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. 
   
  A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  From the server documentation, obtain a listing of required components.  
   
  Generate a listing of components installed on the server. 
   
  Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" 
   
  Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.


vuln_id: V-213994
rule_id: SV-213994r1001008_rule
severity: CAT II
cci: CCI-002605
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).

description:
  <VulnDiscussion>Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. 
   
  Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). 
   
  This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. 
   
  SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Upgrade SQL Server to the Microsoft-supported version.  Institute and adhere to policies and procedures to ensure that patches are consistently applied to SQL Server within the time allowed.

check_text:
  Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
   
  Check the SQL Server version by running the following script: Print @@version 
   
  If the SQL Server version is not shown as supported, this is a finding. 
   
  If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding.


vuln_id: V-213995
rule_id: SV-213995r961791_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must be able to generate audit records when successful and unsuccessful attempts to access security objects occur.

description:
  <VulnDiscussion>Changes to the security configuration must be tracked. 

  This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. 

  In an SQL environment, types of access include, but are not necessarily limited to: 
  SELECT 
  INSERT 
  UPDATE 
  DELETE 
  EXECUTE

  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

  Satisfies: SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy an audit to audit the retrieval of privilege/permission/role membership information when successful and unsuccessful attempts to access security objects occur.
   
  See the supplemental file "SQL 2016 Audit.sql".

check_text:
  Review the system documentation to determine if SQL Server is required to audit the retrieval of when security objects are accessed.

  If this is not required, this is not a finding. 

  If the documentation does not exist, this is a finding.

  Determine if an audit is configured and started by executing the following query.  

  SELECT name AS 'Audit Name', 
  status_desc AS 'Audit Status', 
  audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status

  If no records are returned, this is a finding. 

  Execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. 

  SELECT a.name AS 'AuditName', 
  s.name AS 'SpecName', 
  d.audit_action_name AS 'ActionName', 
  d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' 

  If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.


vuln_id: V-213998
rule_id: SV-213998r961797_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must generate audit records when successful and unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.

description:
  <VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. 
   
  For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.

  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. 

  Satisfies: SRG-APP-000494-DB-000344</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy an audit to audit when data classifications are both successfully and unsuccessfully retrieved. See the supplemental file "SQL 2016 Audit.sql".

check_text:
  Review the system documentation to determine if SQL Server is required to audit when data classifications are both successfully and unsuccessfully retrieved. 
   
  If this is not required, this is not a finding. 
   
  If the documentation does not exist, this is a finding. 
   
  Determine if an audit is configured and started by executing the following query.  
   
  SELECT name AS 'Audit Name', 
    status_desc AS 'Audit Status', 
    audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status 
   
  If no records are returned, this is a finding. 
   
  If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. 
   
  SELECT a.name AS 'AuditName', 
    s.name AS 'SpecName', 
    d.audit_action_name AS 'ActionName', 
    d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' 
   
  If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.


vuln_id: V-214000
rule_id: SV-214000r961800_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must generate audit records when successful and unsuccessful attempts to add privileges/permissions occur.

description:
  <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. 
   
  In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.  
   
  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

  Satisfies: SRG-APP-000495-DB-000326</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. 
   
  DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP 
  DATABASE_OBJECT_PERMISSION_CHANGE_GROUP 
  DATABASE_OWNERSHIP_CHANGE_GROUP 
  DATABASE_PERMISSION_CHANGE_GROUP 
  DATABASE_ROLE_MEMBER_CHANGE_GROUP 
  SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SERVER_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_PERMISSION_CHANGE_GROUP 
  SERVER_ROLE_MEMBER_CHANGE_GROUP 
   
  See the supplemental file "SQL 2016 Audit.sql". 

  Reference: 
  https://msdn.microsoft.com/en-us/library/cc280663.aspx

check_text:
  Check that SQL Server Audit is being used for the STIG compliant audit.

  Determine if an audit is configured and started by executing the following query:

  SELECT name AS 'Audit Name', 
  status_desc AS 'Audit Status', 
  audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status

  Execute the following query to verify the required audit actions are included in the server audit specification: 

  SELECT a.name AS 'AuditName', 
  s.name AS 'SpecName', 
  d.audit_action_name AS 'ActionName', 
  d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1
  AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'
  ,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'
  ,'DATABASE_OWNERSHIP_CHANGE_GROUP'
  ,'DATABASE_PERMISSION_CHANGE_GROUP'
  ,'DATABASE_ROLE_MEMBER_CHANGE_GROUP'
  ,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'
  ,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'
  ,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'
  ,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP'
  ,'SERVER_PERMISSION_CHANGE_GROUP'
  ,'SERVER_ROLE_MEMBER_CHANGE_GROUP')

  If the any of the following audit actions are not returned in an active audit, this is a finding.

  DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP 
  DATABASE_OBJECT_PERMISSION_CHANGE_GROUP 
  DATABASE_OWNERSHIP_CHANGE_GROUP 
  DATABASE_PERMISSION_CHANGE_GROUP 
  DATABASE_ROLE_MEMBER_CHANGE_GROUP 
  SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SERVER_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_PERMISSION_CHANGE_GROUP 
  SERVER_ROLE_MEMBER_CHANGE_GROUP 

  If no records are returned, this is a finding.


vuln_id: V-214002
rule_id: SV-214002r961800_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must generate audit records when successful and unsuccessful attempts to modify privileges/permissions occur.

description:
  <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. 
   
  In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.  
   
  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

  Satisfies: SRG-APP-000495-DB-000328</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. 
   
  DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP 
  DATABASE_OBJECT_PERMISSION_CHANGE_GROUP 
  DATABASE_OWNERSHIP_CHANGE_GROUP 
  DATABASE_PERMISSION_CHANGE_GROUP 
  DATABASE_ROLE_MEMBER_CHANGE_GROUP 
  SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SERVER_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_PERMISSION_CHANGE_GROUP 
  SERVER_ROLE_MEMBER_CHANGE_GROUP 
   
  See the supplemental file "SQL 2016 Audit.sql". 

  Reference: 
  https://msdn.microsoft.com/en-us/library/cc280663.aspx

check_text:
  Check that SQL Server Audit is being used for the STIG compliant audit.

  Determine if an audit is configured and started by executing the following query:

  SELECT name AS 'Audit Name', 
  status_desc AS 'Audit Status', 
  audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status

  Execute the following query to verify the required audit actions are included in the server audit specification:

  SELECT a.name AS 'AuditName', 
  s.name AS 'SpecName', 
  d.audit_action_name AS 'ActionName', 
  d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1
  AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'
  ,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'
  ,'DATABASE_OWNERSHIP_CHANGE_GROUP'
  ,'DATABASE_PERMISSION_CHANGE_GROUP'
  ,'DATABASE_ROLE_MEMBER_CHANGE_GROUP'
  ,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'
  ,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'
  ,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'
  ,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP'
  ,'SERVER_PERMISSION_CHANGE_GROUP'
  ,'SERVER_ROLE_MEMBER_CHANGE_GROUP')

  If the any of the following audit actions are not returned in an active audit, this is a finding.

  DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP 
  DATABASE_OBJECT_PERMISSION_CHANGE_GROUP 
  DATABASE_OWNERSHIP_CHANGE_GROUP 
  DATABASE_PERMISSION_CHANGE_GROUP 
  DATABASE_ROLE_MEMBER_CHANGE_GROUP 
  SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP 
  SERVER_OBJECT_PERMISSION_CHANGE_GROUP 
  SERVER_PERMISSION_CHANGE_GROUP 
  SERVER_ROLE_MEMBER_CHANGE_GROUP 

  If no records are returned, this is a finding.


vuln_id: V-214004
rule_id: SV-214004r961803_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must generate audit records when successful and unsuccessful attempts to modify security objects occur.

description:
  <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. 
   
  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

  Satisfies: SRG-APP-000496-DB-000334</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification 
  USE [master]; 
  GO  
   
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF);  
  GO  
   
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP);  
  GO  
   
  ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON);  
  GO 
   
  See supplemental script "SQL 2016 Audit.sql".

check_text:
  Determine if an audit is configured and started by executing the following query: 
   
  SELECT name AS 'Audit Name', 
    status_desc AS 'Audit Status', 
    audit_file_path AS 'Current Audit File' 
  FROM sys.dm_server_audit_status 
   
  If no records are returned, this is a finding. 
   
  Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. 
   
  SELECT a.name AS 'AuditName', 
    s.name AS 'SpecName', 
    d.audit_action_name AS 'ActionName', 
    d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' 
   
  If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.


vuln_id: V-214006
rule_id: SV-214006r961809_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-02-12 15:25:32
updated_at: 2026-02-12 15:25:32
title:
  SQL Server must generate audit records when successful and unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.

description:
  <VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. 
   
  To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. 
   
  For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.

  Satisfies: SRG-APP-000498-DB-000346</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Deploy an audit to audit when data classifications are unsuccessfully modified. See the supplemental file "SQL 2016 Audit.sql".

check_text:
  Review the system documentation to determine if SQL Server is required to audit when data classifications are successfully and unsuccessfully modified. 
   
  If this is not required, this is not a finding.
   
  If the documentation does not exist, this is a finding.
   
  Determine if an audit is configured and started by executing the following query:
   
  SELECT name AS 'Audit Name', 
    status_desc AS 'Audit Status', 
    audit_file_path AS 'Current Audit File' 
  FROM  sys.dm_server_audit_status 
   
  If no records are returned, this is a finding. 
   
  If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. 
   
  SELECT a.name AS 'AuditName', 
    s.name AS 'SpecName', 
    d.audit_action_name AS 'ActionName', 
    d.audited_result AS 'Result' 
  FROM sys.server_audit_specifications s 
  JOIN sys.server_audits a ON s.audit_guid = a.audit_guid 
  JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id 
  WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' 
   
  If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.


