TMA-MSSQL-7.3
Ensure Database Backups are Encrypted
Description
Ensure Database Backups are Encrypted Counts recorded backups in msdb history that were neither backup-encrypted nor taken from a TDE database. Runs one sqlcmd query with its defaults (Windows authentication to the local default instance); set SQLCMDSERVER, SQLCMDUSER and SQLCMDPASSWORD for another instance or SQL authentication. Needs VIEW SERVER STATE / sysadmin-level read access.
How it is checked
Audit method: SQL query
sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM msdb.dbo.backupset b INNER JOIN sys.databases d ON b.database_name = d.name WHERE b.key_algorithm IS NULL AND b.encryptor_type IS NULL AND d.is_encrypted = 0;"- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
SQL Server backups need to 'Back up to a new media set', not 'Back up to the existing media set' in order to allow for encryption. The backup option to Encrypt Backup can be implemented after a Certificate or Asymmetric key has been applied to the SQL Server for this purpose. Alternatively, encrypt the database with TDE. This automatically encrypts the backups as well. See 7.5
Properties
- Operating systems
- Any
- Tags
- mssqldatabaseencryptionbackup
- Reference
- CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 7.3 Ensure Database Backups are Encrypted
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target mssql --level 2