Microsoft SQL Server 2022 Instance STIG Checklist

12 items · Security · Hard difficulty · 2 hours

Instance-level STIG steps to harden SQL Server 2022 for secure deployments.

• Document SQL Server instance and version

  Record edition, build, instance name, and patch level.

• Apply latest SQL Server and host OS security patches
• Ensure host OS is FIPS-compliant and cryptography enabled

  Use FIPS 140-2/140-3 validated modules where required.

• Disable or secure the 'sa' account

  Rename, disable, or enforce a strong password and limit usage.

• Restrict sysadmin role and enforce least privilege

  Assign minimal privileges to service and user accounts.

• Enable and configure server-level auditing

  Log logins, failed logins, privilege changes, and retain logs.

• Enforce encrypted connections (TLS) for client-server traffic

  Require TLS and disable insecure protocols.

• Restrict SQL Server network access and firewall rules

  Close unused ports and allow only trusted hosts.

• Disable or remove unused features and extended procedures

  Disable CLR, xp_cmdshell, and other unnecessary features.

• Configure automated, encrypted backups for system and user DBs

  Schedule full and transaction log backups and encrypt files.

• Include system and user databases in backup schedule
• Run STIG/XCCDF scans and remediate findings

  Use DISA STIG content or SCAP scanner and document fixes.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.