Redgate Monitor includes built-in configuration compliance templates based on the Center for Internet Security (CIS) benchmarks for Microsoft SQL Server. You can use these templates to audit your SQL Server estate against the automated (machine-testable) checks defined in each benchmark, directly from within Monitor.

For each benchmark, Monitor supplies two templates: one covering server-level checks and one covering database-level checks. Apply both to get full coverage of a given benchmark's automated checks.

What we cover

Monitor covers all automated checks included in the CIS benchmarks listed below. Checks that CIS classifies as manual (requiring human judgment or external verification) are out of scope for automated compliance scanning.

Available benchmarks

Monitor supplies built-in templates for the following CIS benchmarks:

CIS has retired the 2016 and 2017 benchmarks and no longer publishes updates to them. Monitor still supplies templates for them, pinned to the last published version.

Template contents

The server-level template covers reducing attack surface, login and authentication hardening, auditing, network and instance exposure, backup and data encryption, and role permissions. The database-level template covers database property hardening, unused users and excessive permissions, common language runtime (CLR) assembly security, and encryption strength. To see the full list of checks in a template, open the template in Monitor.

Together, the two templates implement every check CIS classifies as automated (machine-testable) for a benchmark.

Editing and scope

The checks in the built-in templates are read-only: you can't add, remove, or change them directly. If you need different checks, duplicate the template and edit the copy.

You can, however, change which servers a built-in template applies to, either by platform/version or by tag. These selections are available only on the server-level template; the database-level template has no server-selection step, so it applies to every database that Monitor collects data from.

By default, each template is scoped to the exact platform and version that its benchmark targets (such as SQL Server on Windows or Amazon RDS). We recommend keeping this default, but you can change it if you want to apply the template more broadly.