Crunchy Data Postgres 16 STIG Compliance Checklist

21 items · Security · Medium difficulty · 4 hours

Quick Postgres 16 STIG steps to secure your database and meet DISA compliance.

• Download the official Crunchy Data Postgres 16 STIG

  Get the XCCDF/STIG from DISA or Public Cyber.mil.

• Apply latest Postgres 16 patches and updates

  Install vendor security updates for all Postgres 16 hosts.

• Implement host OS STIG controls on the database server

  Apply RHEL/OS STIGs and network STIGs relevant to the host.

• Configure strong authentication and password policies

  Enforce complexity, expiration, and lockout for DB accounts.

• Set password complexity and expiration

  Require length, complexity, and periodic rotation.

• Enforce account lockout and password reuse controls

  Configure lockout thresholds and prevent reuse of recent passwords.

• Restrict superuser and administrative access

  Limit postgres/superuser roles to approved administrators.

• Audit and limit superuser login activity

  Enable logging for superuser sessions and review privileges.

• Enable TLS for client-server connections

  Require encrypted connections to protect data in transit.

• Install and manage valid server certificates; require SSL

  Use CA-signed certs and enforce sslmode=require where applicable.

• Configure and enable database auditing and logging

  Enable sufficient logging (connections, DDL, privileged actions).

• Set log retention, rotation, and secure log storage

  Rotate logs and protect them from tampering or unauthorized access.

• Review audit logs regularly

  Schedule periodic reviews for suspicious or privileged activity.

• Secure database data directory and config file permissions

  Restrict filesystem ACLs to the DB service account only.

• Remove sample/demo databases and unused extensions

  Drop example DBs and disable unneeded modules to reduce attack surface.

• Restrict network access to authorized hosts and ports

  Use firewalls and ACLs to limit DB access to known clients.

• Implement role-based access control and least privilege

  Define roles for app, admin, and read-only users; avoid shared accounts.

• Schedule regular backups and test restore procedures

  Automate backups and perform restore drills to validate recoverability.

• Schedule regular vulnerability scans and remediate findings

  Scan Postgres hosts and extensions; track and fix CVEs promptly.

• Integrate monitoring and alerting for suspicious activity

  Alert on failed logins, priv escalation, schema changes, and high-risk events.

• Document exceptions and submit change requests to DISA

  Record deviations and email DISA per STIG instructions when required.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.