SQL Server user-level information must be backed up based on a defined frequency.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-40930	SQL2-00-017700	SV-53284r2_rule		Medium

Description
SQL Server backups are a critical step in maintaining data assurance and availability. User-level information is data generated by information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. Applications performing backups must be capable of backing up user-level information per the DoD defined frequency. Databases that do not backup information regularly risk the loss of that information in the event of a system failure.

Description

SQL Server backups are a critical step in maintaining data assurance and availability. User-level information is data generated by information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. Applications performing backups must be capable of backing up user-level information per the DoD defined frequency. Databases that do not backup information regularly risk the loss of that information in the event of a system failure.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2016-11-16

Details

Check Text ( C-47585r2_chk )
Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding. Check evidence of inclusion user-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including user-level information backups, this is a finding.

Check Text ( C-47585r2_chk )

Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.

Check evidence of inclusion user-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including user-level information backups, this is a finding.

Fix Text (F-46212r2_fix)
Deploy a backup solution to perform backups as per organizationally defined Backup Policy.