Microsoft SQL Server 2022 Database STIG Checklist

12 items · Security · Medium difficulty · 2 hours

Database-level STIG controls to secure SQL Server 2022 data and access.

• Inventory all databases and document owners

  List names, sizes, owners, and intended purpose.

• Remove sample and demo databases from production

  Delete AdventureWorks and test DBs from production hosts.

• Enable Transparent Data Encryption (TDE) or equivalent

  Protect data at rest using TDE or approved encryption.

• Encrypt database backups and verify key management

  Ensure backup encryption and secure key/certificate storage.

• Implement role-based access control and minimize db_owner use

  Use roles for common permissions instead of broad rights.

• Review and remove unused logins, users, and orphaned accounts
• Restrict and audit elevated database permissions

  Limit EXECUTE and ALTER on critical objects to needed roles.

• Disable or review CLR, xp_cmdshell, and unsafe assemblies
• Enable database-level auditing for privileged actions

  Capture schema changes, permission grants, and role changes.

• Schedule and run DBCC CHECKDB integrity checks regularly

  Detect corruption early and document remediation steps.

• Secure database files and folders with NTFS permissions

  Limit OS-level access to SQL Server service accounts only.

• Test database restores and verify data integrity and access

  Perform restore drills and verify decryption and permissions.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.