I've been able to find writings on compliance topics (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) but I haven't found much on FTI (Federal tax information) and Publication 1075 outside of the IRS website itself.
Since I haven't found hardly anything out there this will be quite lengthy in the hopes of getting answers that will benefit others than myself as well.
Just like the other external audits, it recommends (requires) adherence by doing such things as:
- Set the 'Ad Hoc Distributed Queries' Server Configuration Option to 0
- Set the 'CLR Enabled' Server Configuration Option to 0
- Set the 'CLR Assembly Permission Set' to SAFE_ACCESS for All CLR Assemblies -
- Set the 'Remote Access' Server Configuration Option to 0
- Set the 'Remote Admin Connections' Server Configuration Option to 0 (what if I need to use DAC)
- Set the 'Trustworthy' Database Property to Off
- Disable the 'sa' Login Account
- Rename the 'sa' Login Account Set the 'xp_cmdshell' Server Configuration Option to 0
- Ensure the SQL Server’s SQLAgent Service Account is Not an Administrator
- Set the 'MUST_CHANGE' Option to ON for All SQL Authenticated Logins
The full list of Computer Security Evaluation Matrix (SCSEM) downloads and the one for Database – SQL Server SCSEM (XLS) are available for use in preparing an IT environment that will receive, process, or store FTI. Maybe the free downloads there could help someone else with Audit findings ideas as well.
All that to setup my questions to hopefully get answers that decrease the burden that all of this brings.
- Is there anything on the internet or print outside of the IRS website (videos, podcasts, books, whitepapers, blogs, etc.) which discusses IRS Publication 1075 (which outlines the requirements and guidelines for agencies in receipt of FTI to establish procedures to ensure the adequate protection of the FTI data they receive).
- If anyone has been through one of these audits...what is your advice and do you have any recommendations?
- Are there any resources (e.g. tools, scripts, spreadsheets) that anyone knows of for other external audits (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) that could be helpful for this or other types of audits?
- Are there specific items in the safeguards-scsem-sql-server.xls that cause the most trouble when changed and what are some of the things to look for and prepare in advance of changing?
- Lastly, how would you object to certain settings that are recommended (required) but aren't necessary an industry best practice? Looking at the SCEM spreadsheet are there any that just make your eyes roll and you can provide valid reasons for not adhering to it?
Any help you can provide me would be greatly appreciated because I'm not finding much info that's helpful.