V1R3 changes
Microsoft SQL Server 2022 Database STIG V1R3 (2026-04-01) replaced V1R2 (2026-01-05): 1 check added, 1 updated. It has 23 checks, against 22 in V1R2.
V1R3 checklistV1R2 checklist Compare V1R2 and V1R3 in STIG Compare
- 1 added
- 0 removed
- 1 updated
Updated fields: Check text 1
Added in V1R3 (1)
- V-283667CAT IISQL Server must protect against a user falsely repudiating by ensuring that only unique Active Directory user accounts can connect to the database.
Updated in V1R3 (1)
V-271201CAT ISQL Server must implement cryptographic mechanisms to prevent unauthorized modification or disclosure of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.Check text
Check text
Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from disclosure or modification, which must include, at a minimum, PII and classified information.
If no information is identified as requiring such protection, this is not a finding.
Review the configuration of SQL Server, Windows, and additional software as relevant.
If full-disk encryption is required, and Windows or the storage system is not configured for this, this is a finding.
If database transparent data encryption (TDE) is called for, checkverify whether it is enabled:
SELECT
DB_NAME(database_id) db.name AS [Database Name]DatabaseName, db.is_encrypted AS IsEncrypted,
CASE
WHEN dm.encryption_state WHEN= 0 THEN 'No database encryption key present, no encryption'
WHEN dm.encryption_state = 1 THEN 'Unencrypted'
WHEN dm.encryption_state = 2 THEN 'Encryption in progress'
WHEN dm.encryption_state = 3 THEN 'Encrypted'
WHEN dm.encryption_state = 4 THEN 'Key change in progress'
WHEN dm.encryption_state = 5 THEN 'Decryption in progress'
WHEN dm.encryption_state = 6 THEN 'Protection change in progress'
END AS [EncryptionEncryptionState,
dm.encryption_state State]AS EncryptionState,
dm.key_algorithm AS KeyAlgorithm,
dm.key_length AS KeyLength
FROM sys.databases db
LEFT OUTER JOIN sys.dm_database_encryption_keys dm ON db.database_id = dm.database_id
WHERE db.database_id NOT IN (1,2,3,4)
For each user database forrequiring which encryption isthat called for and it is marked Unencrypted, this is a finding.
If table/column encryption and/or a separation between those who own the data (and can view it) and those who manage the data (but should have no access) is required for PII or similar types of data, use Always Encrypted. The details for configuring Always Encrypted are located here: https://msdn.microsoft.com/en-us/library/mt163865.aspx.
Review the definitions and contents of the relevant tables/columns for the Always EncryptionEncrypted settings,. ifIf any of the information defined as requiring cryptographic protection that is not encrypted this is a finding.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.