SQL Server, the DoD, and Common Criteria

  • Article

Common Criteria is an international standard for a set of security characteristics, and the U.S. Department of Defense (DoD) Database Security Technical Implementation Guide (STIG) (via the Security Readiness Review for SQL Server) requires it to be enabled. (See DG0084.)

You can turn it on by using sp_configure ("common criteria compliance enabled") or by using SQL Server Management Studio (server properties, security page, options, "Enable Common Criteria compliance" checkbox).

Enabling SQL Server's Common Criteria switch will enable 3 functions:

  1. Residual Information Protection
  2. The ability to view login statistics
  3. Prevention of a column-level GRANT from overriding a table-level DENY

For more details about these functions, see the SQL Server Books Online article here.

If you want to know about Common Criteria evaluations of different SQL Server versions and service pack levels, just go to this page and click on the tabs across the top.