Common Criteria Compliance Enabled Server Configuration

Applies to: yesSQL Server (all supported versions)

The common criteria compliance option enables the following elements that are required for the Common Criteria for Information Technology Security Evaluation. A requirement for a world-wide compliance obligation across regulated industries and authorities.

Criteria Description
Residual Information Protection (RIP) RIP requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs.
The ability to view login statistics Login auditing is enabled after the common criteria compliance option is enabled.
Login times that are made available on a per-session basis each time a user successfully logs in to SQL Server:
- Information about the last successful login time
- The last unsuccessful login time
- The number of attempts between the last successful login and the current login.
These login statistics can be viewed by querying the sys.dm_exec_sessions dynamic management view.
That column GRANT shouldn't override table DENY After the common criteria compliance enabled option is enabled, a table-level DENY takes precedence over a column-level GRANT. When the option isn't enabled, a column-level GRANT takes precedence over a table-level DENY.

The common criteria compliance enabled option is an advanced option. Common criteria is only evaluated and certified for the Enterprise edition and Datacenter edition. For the latest status of common criteria certification, see the Microsoft SQL Server Common Criteria site.

Important

In addition to enabling the common criteria compliance enabled option, you also must download and run a script that finishes configuring SQL Server to comply with Common Criteria Evaluation Assurance Level 4+ (EAL4+). You can download this script from the Microsoft SQL Server Common Criteria site.

If you're using the sp_configure system stored procedure to change the setting, you can change common criteria compliance enabled only when show advanced options is set to 1. The setting takes effect after the server is restarted. The possible values are 0 and 1:

  • 0 indicates that common criteria compliance isn't enabled (default).

  • 1 indicates that common criteria compliance is enabled.

Examples

The following example enables common criteria compliance.

sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'common criteria compliance enabled', 1;
GO
RECONFIGURE WITH OVERRIDE;
GO

Restart SQL Server.

Next steps