SQL Server backups of system-level information per organization-defined frequency must be performed that is consistent with recovery time and recovery point objectives.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-40926	SQL2-00-018200	SV-53280r2_rule		Medium

Description
SQL Server backups are a critical step in maintaining data assurance and availability. System-level information includes: system-state information, operating system and application software, and licenses. Backups shall be consistent with organizationally defined recovery time and recovery point objectives. SQL Server depends upon the availability and integrity of its system-level information. Without backups, compromise or loss of system-level information can prevent a successful recovery of SQL Server operations. If SQL Server system-level information is not backed up regularly this risks the loss of SQL Server data in the event of a system failure. A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.

Description

SQL Server backups are a critical step in maintaining data assurance and availability. System-level information includes: system-state information, operating system and application software, and licenses. Backups shall be consistent with organizationally defined recovery time and recovery point objectives. SQL Server depends upon the availability and integrity of its system-level information. Without backups, compromise or loss of system-level information can prevent a successful recovery of SQL Server operations. If SQL Server system-level information is not backed up regularly this risks the loss of SQL Server data in the event of a system failure. A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2017-07-13

Details

Check Text ( C-47581r2_chk )
Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding. Check evidence of inclusion of system-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including system-level information backups, this is a finding.

Check Text ( C-47581r2_chk )

Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.

Check evidence of inclusion of system-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including system-level information backups, this is a finding.

Fix Text (F-46208r1_fix)
Deploy a backup solution to perform backups as per organizationally defined Backup Policy.