SQL Server must protect the confidentiality and integrity of all information at rest.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-271324	SQLI-22-009500	SV-271324r1109248_rule		High

Description

This control is intended to address the confidentiality and integrity of information at rest in nonmobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.

STIG	Date
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide	2025-05-30

Details

Check Text (C-75367r1109247_chk)

Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check is downgraded to CAT II.

If the application owner and authorizing official have determined that encryption of data at rest is required, verify that the data on secondary devices is encrypted.

If full-disk encryption is being used, this is not a finding.

If data encryption is required, verify that the data is encrypted before being put on the secondary device by executing the following:

SELECT
db.name AS DatabaseName,
db.is_encrypted AS IsEncrypted,
CASE
WHEN dm.encryption_state = 0 THEN 'No database encryption key present, no encryption'
WHEN dm.encryption_state = 1 THEN 'Unencrypted'
WHEN dm.encryption_state = 2 THEN 'Encryption in progress'
WHEN dm.encryption_state = 3 THEN 'Encrypted'
WHEN dm.encryption_state = 4 THEN 'Key change in progress'
WHEN dm.encryption_state = 5 THEN 'Decryption in progress'
WHEN dm.encryption_state = 6 THEN 'Protection change in progress'
END AS EncryptionState,
dm.encryption_state AS EncryptionState,
dm.key_algorithm AS KeyAlgorithm,
dm.key_length AS KeyLength
FROM
sys.databases db
LEFT JOIN sys.dm_database_encryption_keys dm ON db.database_id = dm.database_id
WHERE db.database_id > 4
ORDER BY [Database Name] ;

For each user database where encryption is required, verify that encryption is in effect. If it is not, this is a finding.

Verify that there are physical security measures, operating system access control lists, and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.

Fix Text (F-75274r1109022_fix)

Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption.

To enable database encryption, create a master key, create a database encryption key, protect it by using mechanisms tied to the master key, and then turn encryption on.

Implement physical security measures, operating system access control lists, and organizational controls appropriate to the sensitivity level of the data in the database(s).