SQL Server recovery procedures that are documented must be implemented and periodically tested.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-40928	SQL2-00-017900	SV-53282r2_rule		Medium

Description
SQL Server backups are a critical step in maintaining data assurance and availability. User-level information is data generated by the information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user-generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. Applications performing backups must be capable of backing up user-level information per the DoD-defined frequency. Problems with backup procedures or backup media may not be discovered until after a recovery is needed. Testing and verification of procedures provides the opportunity to discover oversights, conflicts, or other issues in the backup procedures or use of media designed to be used. Part of an overall backup and recovery methodology includes regular recovery testing. This is very important and helps to expose any issue in the recovery process (e.g., hardware, procedures, etc.).

Description

SQL Server backups are a critical step in maintaining data assurance and availability. User-level information is data generated by the information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user-generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. Applications performing backups must be capable of backing up user-level information per the DoD-defined frequency. Problems with backup procedures or backup media may not be discovered until after a recovery is needed. Testing and verification of procedures provides the opportunity to discover oversights, conflicts, or other issues in the backup procedures or use of media designed to be used. Part of an overall backup and recovery methodology includes regular recovery testing. This is very important and helps to expose any issue in the recovery process (e.g., hardware, procedures, etc.).

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2017-12-01

Details

Check Text ( C-47583r2_chk )
Review SQL Server's documented testing and recovery procedures that exist in the system documentation. If the testing or recovery procedures are not documented in the system documentation, this is a finding. If the documented testing or recovery procedures are not sufficient to test or recover SQL Server configuration and databases, this is a finding. Review evidence of implementation of testing and verification procedures by reviewing logs from backup and recovery implementation. Logs may be in electronic form or hardcopy, and may include email or other notification. If the system recovery testing has not been implemented and documented, this is a finding.

Check Text ( C-47583r2_chk )

Review SQL Server's documented testing and recovery procedures that exist in the system documentation.

If the testing or recovery procedures are not documented in the system documentation, this is a finding.

If the documented testing or recovery procedures are not sufficient to test or recover SQL Server configuration and databases, this is a finding.

Review evidence of implementation of testing and verification procedures by reviewing logs from backup and recovery implementation. Logs may be in electronic form or hardcopy, and may include email or other notification.

If the system recovery testing has not been implemented and documented, this is a finding.

Fix Text (F-46210r2_fix)
Develop or update recovery procedures and add the new recovery procedures to the system documentation. Plan for and test system recovery procedures and document the test.