V1R7 changes
MS SQL Server 2014 Database STIG V1R7 (2024-07-24) replaced V1R6 (2018-01-26): 43 checks added, 42 removed. It has 43 checks, against 42 in V1R6.
V1R7 checklistV1R6 checklist Compare V1R6 and V1R7 in STIG Compare
- 43 added
- 42 removed
- 0 updated
Added in V1R7 (43)
- V-213764CAT IISQL Server must enforce approved authorizations for logical access to information and database-level system resources in accordance with applicable access control policies.
- V-213765CAT IISQL Server must generate Trace or Audit records for organization-defined auditable events.
- V-213766CAT IIWhere SQL Server Audit is in use at the database level, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the database level.
- V-213767CAT IISQL Server must be monitored to discover unauthorized changes to functions.
- V-213768CAT IISQL Server must be monitored to discover unauthorized changes to triggers.
- V-213769CAT IISQL Server must be monitored to discover unauthorized changes to stored procedures.
- V-213770CAT IIDatabase objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.
- V-213771CAT IIIn a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF.
- V-213772CAT IIIn a database owned by a login not having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF unless required and authorized.
- V-213773CAT IIIn the event of a system failure, SQL Server must preserve any information necessary to return to operations with least disruption to mission processes.
- V-213774CAT IISQL Server must protect data at rest and ensure confidentiality and integrity of data.
- V-213775CAT IIDatabase contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
- V-213776CAT IISQL Server must check the validity of all data inputs except those specifically identified by the organization.
- V-213777CAT IIThe DBMS and associated applications must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
- V-213778CAT IISQL Server must reveal detailed error messages only to the ISSO, ISSM (or their designees), SA and DBA.
- V-213779CAT IIThe Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
- V-213780CAT IIDatabase Master Key passwords must not be stored in credentials within the database.
- V-213781CAT IISymmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.
- V-213782CAT IIThe DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.
- V-213783CAT IIThe DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
- V-213784CAT IIWhen supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.
- V-213785CAT IIWhen supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.
- V-213786CAT IIWhen supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.
- V-213787CAT IITime stamps in database tables, intended for auditing or activity-tracking purposes, must include both date and time of day, with a minimum granularity of one second.
- V-213788CAT IISQL Server must implement and/or support cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
- V-213789CAT IIWhen invalid inputs are received, SQL Server must behave in a predictable and documented manner that reflects organizational and system objectives.
- V-213790CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is accessed.
- V-213791CAT IITrace or Audit records must be generated when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.
- V-213792CAT IISQL Server must generate Trace or Audit records when privileges/permissions are modified via locally-defined security objects.
- V-213793CAT IISQL Server must generate Trace or Audit records when unsuccessful attempts to modify privileges/permissions via locally-defined security objects occur.
- V-213794CAT IISQL Server must generate Trace or Audit records when locally-defined security objects are modified.
- V-213795CAT IISQL Server must generate Trace or Audit records when unsuccessful attempts to modify locally-defined security objects occur.
- V-213796CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is created.
- V-213797CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is modified.
- V-213798CAT IITrace or Audit records must be generated when unsuccessful attempts to create categorized information (e.g., classification levels/security levels) occur.
- V-213799CAT IITrace or Audit records must be generated when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.
- V-213800CAT IISQL Server must generate Trace or Audit records when locally-defined security objects are dropped.
- V-213801CAT IISQL Server must generate Trace or Audit records when unsuccessful attempts to drop locally-defined security objects occur.
- V-213802CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is deleted.
- V-213803CAT IITrace or Audit records must be generated when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur.
- V-213804CAT IISQL Server must generate Trace or Audit records when successful accesses to designated objects occur.
- V-213805CAT IISQL Server must generate Trace or Audit records when unsuccessful accesses to designated objects occur.
- V-265637CAT IMicrosoft SQL Server products must be a version supported by the vendor.
Removed since V1R6 (42)
- V-67357CAT IISQL Server must enforce approved authorizations for logical access to information and database-level system resources in accordance with applicable access control policies.
- V-67359CAT IISQL Server must generate Trace or Audit records for organization-defined auditable events.
- V-67361CAT IIWhere SQL Server Audit is in use at the database level, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the database level.
- V-67365CAT IISQL Server must be monitored to discover unauthorized changes to functions.
- V-67367CAT IISQL Server must be monitored to discover unauthorized changes to triggers.
- V-67369CAT IISQL Server must be monitored to discover unauthorized changes to stored procedures.
- V-67371CAT IIDatabase objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.
- V-67373CAT IIIn a database owned by a login not having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF unless required and authorized.
- V-67375CAT IIIn a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF.
- V-67377CAT IIIn the event of a system failure, SQL Server must preserve any information necessary to return to operations with least disruption to mission processes.
- V-67381CAT IIThe Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
- V-67383CAT IIDatabase Master Key passwords must not be stored in credentials within the database.
- V-67385CAT IISymmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.
- V-67389CAT IIDatabase contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
- V-67391CAT IISQL Server must check the validity of all data inputs except those specifically identified by the organization.
- V-67393CAT IIThe DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.
- V-67395CAT IIThe DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
- V-67397CAT IIThe DBMS and associated applications must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
- V-67399CAT IISQL Server must reveal detailed error messages only to the ISSO, ISSM (or their designees), SA and DBA.
- V-67401CAT IIWhen supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.
- V-67403CAT IIWhen supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.
- V-67405CAT IIWhen supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.
- V-67407CAT IITime stamps in database tables, intended for auditing or activity-tracking purposes, must include both date and time of day, with a minimum granularity of one second.
- V-67409CAT IISQL Server must implement and/or support cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
- V-67411CAT IIWhen invalid inputs are received, SQL Server must behave in a predictable and documented manner that reflects organizational and system objectives.
- V-67413CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is accessed.
- V-67415CAT IITrace or Audit records must be generated when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.
- V-67417CAT IISQL Server must generate Trace or Audit records when privileges/permissions are modified via locally-defined security objects.
- V-67419CAT IISQL Server must generate Trace or Audit records when unsuccessful attempts to modify privileges/permissions via locally-defined security objects occur.
- V-67421CAT IISQL Server must generate Trace or Audit records when locally-defined security objects are modified.
- V-67423CAT IISQL Server must generate Trace or Audit records when unsuccessful accesses to designated objects occur.
- V-67425CAT IISQL Server must generate Trace or Audit records when successful accesses to designated objects occur.
- V-67427CAT IITrace or Audit records must be generated when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur.
- V-67429CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is deleted.
- V-67431CAT IISQL Server must generate Trace or Audit records when unsuccessful attempts to drop locally-defined security objects occur.
- V-67433CAT IISQL Server must generate Trace or Audit records when locally-defined security objects are dropped.
- V-67435CAT IISQL Server must generate Trace or Audit records when unsuccessful attempts to modify locally-defined security objects occur.
- V-67437CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is created.
- V-67439CAT IITrace or Audit records must be generated when unsuccessful attempts to create categorized information (e.g., classification levels/security levels) occur.
- V-67441CAT IITrace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is modified.
- V-67443CAT IITrace or Audit records must be generated when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.
- V-67877CAT IISQL Server must protect data at rest and ensure confidentiality and integrity of data.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R7 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.