I've been able to find writings on compliance topics (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) but I haven't found much on FTI (Federal tax information) and Publication 1075 outside of the IRS website itself.

Since I haven't found hardly anything out there this will be quite lengthy in the hopes of getting answers that will benefit others than myself as well.

Just like the other external audits, it recommends (requires) adherence by doing such things as:

  • Set the 'Ad Hoc Distributed Queries' Server Configuration Option to 0
  • Set the 'CLR Enabled' Server Configuration Option to 0
  • Set the 'CLR Assembly Permission Set' to SAFE_ACCESS for All CLR Assemblies -
  • Set the 'Remote Access' Server Configuration Option to 0
  • Set the 'Remote Admin Connections' Server Configuration Option to 0 (what if I need to use DAC)
  • Set the 'Trustworthy' Database Property to Off
  • Disable the 'sa' Login Account
  • Rename the 'sa' Login Account Set the 'xp_cmdshell' Server Configuration Option to 0
  • Ensure the SQL Server’s SQLAgent Service Account is Not an Administrator
  • Set the 'MUST_CHANGE' Option to ON for All SQL Authenticated Logins

The full list of Computer Security Evaluation Matrix (SCSEM) downloads and the one for Database – SQL Server SCSEM (XLS) are available for use in preparing an IT environment that will receive, process, or store FTI. Maybe the free downloads there could help someone else with Audit findings ideas as well.

All that to setup my questions to hopefully get answers that decrease the burden that all of this brings.

  1. Is there anything on the internet or print outside of the IRS website (videos, podcasts, books, whitepapers, blogs, etc.) which discusses IRS Publication 1075 (which outlines the requirements and guidelines for agencies in receipt of FTI to establish procedures to ensure the adequate protection of the FTI data they receive).
  2. If anyone has been through one of these audits...what is your advice and do you have any recommendations?
  3. Are there any resources (e.g. tools, scripts, spreadsheets) that anyone knows of for other external audits (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) that could be helpful for this or other types of audits?
  4. Are there specific items in the safeguards-scsem-sql-server.xls that cause the most trouble when changed and what are some of the things to look for and prepare in advance of changing?
  5. Lastly, how would you object to certain settings that are recommended (required) but aren't necessary an industry best practice? Looking at the SCEM spreadsheet are there any that just make your eyes roll and you can provide valid reasons for not adhering to it?

Any help you can provide me would be greatly appreciated because I'm not finding much info that's helpful.

  • 1
    What you're working on is similar to the standards I'm using at my organization, namely the DoD STIG: iase.disa.mil/stigs/app-security/database/pages/sql.aspx These docs contain SQL for some of the checks, which may be useful for you. I'm currently tapping this out on a phone screen, so I'll add more detail later if you're interested.
    – S M
    Mar 20, 2019 at 8:41
  • Of course that would be helpful. As a side question to what was asked above I'm also curious if you've had to do anything with Data Discovery & Classification in SQL Server and how that has gone. Mar 25, 2019 at 15:45
  • 1
    Yes and no... We still have a few MSSQL 2005 instances running around, and I did a manual form of discovery and classification and noticed a couple of databases on one instance contained sensitive employee information; management hadn't realized this. I'd love to try this Azure SQL DB feature but we don't plan on moving anything to the cloud any time soon.
    – S M
    Mar 27, 2019 at 14:39
  • I understand that it has been a while but I'm needing to look back at this now. The link you provided doesn't work. Any chance there's a new one now or more info you've learned? Dec 9, 2022 at 15:36
  • Looks like it’s moved to public.cyber.mil/stigs/downloads I’m at a different organization now, subject to PCI and gaming regulations. The biggest pain point for us was when we had to adjust all of our TLS settings. That was all pushed using SCOM/SCCM and because we still use some older SQL Server versions, we had quite a few sporadic outages for weeks after.
    – S M
    Dec 10, 2022 at 21:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.