SQL Server 2016 STIG Checklist

14 items · Security · Hard difficulty · 4 hours

Essential STIG steps to secure SQL Server 2016 instances.

• Backup system and user databases

  Take full backups of system and user DBs before making configuration changes.

• Configure secure backup storage and encrypt backups

  Store backups off-server and enable encryption to protect backups at rest.

• Apply latest Windows and SQL Server updates

  Install relevant security patches and cumulative updates for OS and SQL Server.

• Verify SQL Server service accounts use least-privilege

  Replace local admin accounts with dedicated low-privilege domain or managed service accounts.

• Harden SQL Server logins and accounts
• Disable or rename the SA account

  Disable or rename the built-in SA account and ensure no apps rely on it.

• Enforce password complexity and expiration for SQL logins

  Enable policy enforcement and set appropriate rotation periods.

• Disable xp_cmdshell and other dangerous extended procedures

  Turn off xp_cmdshell and unused extended stored procedures to reduce attack surface.

• Restrict network protocols and enforce encryption

  Disable unused protocols and require TLS for client connections.

• Enable and configure Transparent Data Encryption (TDE) for sensitive DBs

  Protect data at rest; manage and back up keys securely.

• Configure server and database auditing

  Enable audit of logins, privilege changes, and schema changes; retain logs securely.

• Configure and review SQL Server permissions and roles

  Apply least-privilege for logins, remove unnecessary dbo/sysadmin assignments.

• Review DISA STIG resources and apply automated XCCDF/SCC content

  Download and reference the STIG XCCDF and SCC content from DISA for automated checks.

• Document changes and schedule regular STIG compliance scans

  Record configuration changes, baseline, and plan periodic scans and remediation.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.