TickYouOff
Sign in
Back
🔒

Microsoft SQL Server 2022 Instance STIG Checklist

Hard 12 items · 2 hours
testuser's avatar
testuser Published 1 month ago
Security

A concise checklist to verify Microsoft SQL Server 2022 instance-level hardening against DISA STIG requirements. Ideal for DBAs, security engineers, and auditors preparing an instance for DoD or high-security environments.

Source: https://ncp.nist.gov/checklist/1292

Progress
0 / 12
  1. Document SQL Server instance and version — Record edition, build, instance name, and patch level.
  2. Apply latest SQL Server and host OS security patches
  3. Ensure host OS is FIPS-compliant and cryptography enabled — Use FIPS 140-2/140-3 validated modules where required.
  4. Disable or secure the 'sa' account — Rename, disable, or enforce a strong password and limit usage.
  5. Restrict sysadmin role and enforce least privilege — Assign minimal privileges to service and user accounts.
  6. Enable and configure server-level auditing — Log logins, failed logins, privilege changes, and retain logs.
  7. Enforce encrypted connections (TLS) for client-server traffic — Require TLS and disable insecure protocols.
  8. Restrict SQL Server network access and firewall rules — Close unused ports and allow only trusted hosts.
  9. Disable or remove unused features and extended procedures — Disable CLR, xp_cmdshell, and other unnecessary features.
  10. Configure automated, encrypted backups for system and user DBs — Schedule full and transaction log backups and encrypt files.
  11. Include system and user databases in backup schedule
  12. Run STIG/XCCDF scans and remediate findings — Use DISA STIG content or SCAP scanner and document fixes.
Sign in to save
📝 My Notes