SQL Audit Platform
SQL Server audit report
Prepared for

SRV-APP-01

production Microsoft SQL Server 2016 (SP3) Standard Edition (64-bit) srv-app-01.atlantique.local
70
Global health score
Fair C
out of 100
First audit — no trend yet
Audit performed on 09 September 2026
Document generated on 23 September 2026
Collector 4.2.0
SQL Audit Platform SRV-APP-01

Executive summary

70
Global health score
Fair C
First audit — no trend yet
Security
65/100
Performance
96/100
Resilience
75/100
Operations
84/100
285Compliant
29Gaps
1Warnings
9Critical
10High
90
Technical security posture — CIS SQL Server L1 (sample)
56 compliant control(s) out of 62 evaluated
These controls also contribute to GDPR (Art. 32) and NIS2 (Art. 21) technical measures.
Conformity rate over the sample of CIS controls tested by the platform — not coverage of the full CIS benchmark.

Top business risks

Translated into business language, ranked by stakes. Risk is expressed as a level (High / Medium / Low) and an effort, with no financial figure.

1
Your backups won't protect you from a failure or an attack Critical

In case of disk failure, corruption or ransomware, you risk losing data with no way to restore it.

Risk level Critical Effort High
Recommended action Schedule full backups at least weekly
2
Your database is exposed to unauthorized access Critical

A security gap can allow theft or leakage of your customer and business data.

Risk level Critical Effort Low
Recommended action Disable the SA account and create dedicated named accounts for the administrators — the SA account is a prime target for brute-force attacks. Quick fix, low risk (check beforehand that no application connects with it).
3
Your database could go down without guaranteed recovery Critical

If your service continuity isn't guaranteed, an outage can halt your operations for hours or days.

Risk level Critical Effort High
Recommended action Run a full integrity check of the database, determine the extent of the corruption, then restore the pages or the database from a healthy backup — untreated corruption leads to data loss. Urgent action, high risk (get expert assistance before attempting any repair).
4
The server configuration deviates from best practices Critical

Unsuitable settings can undermine the stability, security or performance of your database.

Risk level Critical Effort Low
Recommended action Cap the maximum server memory, reserving RAM for the OS (starting rule: total RAM - 4 GB, or - 10% above 16 GB) — without a cap, SQL Server can starve the system and cause swapping. Quick intervention, low risk.
5
Your sensitive data is not encrypted Critical

If files or media are stolen, the data stays readable and GDPR compliance is not ensured.

Risk level Critical Effort High
Recommended action Back up each TDE certificate together with its private key and keep them off-server in a secure vault — without this backup, an encrypted database becomes unrecoverable after a disaster. Quick to do, low risk (be sure to protect the key password).
6
Regular database upkeep is not in place Critical

Without maintenance, data issues go unnoticed and worsen over time.

Risk level Critical Effort Medium
Recommended action Schedule a weekly integrity check (CHECKDB) on every database — it is the only way to detect silent corruption early, before it spreads to the backups. Moderate effort, low risk.
SQL Audit Platform SRV-APP-01

Technical annex — detailed results

Detailed gaps and warnings by domain, with the recommended remediation guidance.

S
Access security Who can reach the database and what they may do there.
5 Gaps · 1 Warnings · 97 Compliant
SEC001 SA account enabled Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Disable the SA account and create dedicated named accounts for the administrators — the SA account is a prime target for brute-force attacks. Quick fix, low risk (check beforehand that no application connects with it).
SEC002 Password policy High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Apply the Windows password policy (CHECK_POLICY) to every SQL login — without it, weak or never-expiring passwords weaken authentication. Quick fix, low risk.
SEC004 sysadmin members High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Remove the unnecessary sysadmin access, use less privileged roles
SEC005 Guest account active Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Revoke the Guest account's access in every user database — an active Guest opens the database to every server login, even an unauthorized one. Quick fix, low risk (do not touch master/tempdb).
SEC003 Orphaned users Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Remap each orphaned user to its server login, or drop it if it is no longer used — an orphan can hide residual access left over from a migration. Moderate effort, low risk.
SEC006 Public role permissions Info
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Audit and revoke the permissions granted to the public role
C
Server settings Settings that drive stability and performance.
4 Gaps · 29 Compliant
CFG001 Max Server Memory Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Cap the maximum server memory, reserving RAM for the OS (starting rule: total RAM - 4 GB, or - 10% above 16 GB) — without a cap, SQL Server can starve the system and cause swapping. Quick intervention, low risk.
CFG004 MAXDOP High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: NUMA: min(8, cores/node). Without NUMA: min(8, total cores)
CFG003 Cost Threshold for Parallelism Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Raise the cost threshold for parallelism (recommended starting point: 50) — the default of 5 parallelizes too many small queries and wastes CPU on OLTP workloads. Quick intervention, low risk.
CFG002 Min Server Memory Low
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Usually 0 or 25% of max server memory
F
File layout How the database is stored on disk — room to grow.
2 Gaps · 8 Compliant
FILE002 TempDB on the system disk Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Move TempDB to a dedicated fast disk (SSD)
FILE001 Data and Log on the same disk High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Move the log files to a dedicated disk
B
Backups Your safety net if data is lost or corrupted.
3 Gaps · 8 Compliant
BACK001 Recent full backup Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Schedule full backups at least weekly
BACK003 Recent log backup Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Schedule log backups every 15-60 minutes depending on RPO
BACK002 Differential backup configured Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Schedule daily differential backups
M
Routine upkeep Housekeeping that keeps the database fast and reliable.
3 Gaps · 30 Compliant
MAINT001 Recent DBCC CHECKDB Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Schedule a weekly integrity check (CHECKDB) on every database — it is the only way to detect silent corruption early, before it spreads to the backups. Moderate effort, low risk.
MAINT002 Index fragmentation Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Reorganize (10-30%) or Rebuild (>30%) the indexes
MAINT003 Stale statistics Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Update the statistics regularly (maintenance job) and make sure the automatic statistics update is enabled — stale statistics degrade execution plans. Moderate effort, low risk.
P
Speed The responsiveness your users feel day to day.
2 Gaps · 27 Compliant
PERF001 Page Life Expectancy Medium
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Corroborate with the wait stats (PAGEIOLATCH) before concluding that there is memory pressure; check Max Server Memory
PERF002 Buffer Cache Hit Ratio Info
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Do not rely on the BCHR; use the wait stats and the PLE trend
R
Service continuity Staying available and recovering after an incident.
3 Gaps · 61 Compliant
REL001 Corruption detected Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Run a full integrity check of the database, determine the extent of the corruption, then restore the pages or the database from a healthy backup — untreated corruption leads to data loss. Urgent action, high risk (get expert assistance before attempting any repair).
REL003 Mirroring status High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Resolve the synchronization problems
REL002 Memory dumps High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Analyze the dumps and contact Microsoft support if they recur
I
Disk access Read/write speed on the underlying storage.
2 Gaps · 3 Compliant
IO002 Slowest files High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Move hot files to faster storage and spread the I/O load.
IO001 Latency per disk High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Above ~20 ms, investigate the storage (queue, cache, contention, sizing).
DS
Database options Per-database settings affecting security and speed.
3 Gaps · 10 Compliant
DBSET003 Page Verify not CHECKSUM Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Set the page verification option to CHECKSUM on each database — this is what allows silent disk corruption to be detected. Quick to do, low risk (protection only covers pages written after the change).
DBSET001 AutoClose enabled High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Turn off AutoClose on each affected database — it closes the database on every disconnect and forces a costly reopen on the next connection. Quick to do, low risk.
DBSET002 AutoShrink enabled High
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Turn off AutoShrink on each affected database — repeated automatic shrinks cause massive index fragmentation and needless I/O load. Quick to do, low risk.
En
Data encryption Whether your data stays unreadable if a disk is stolen.
2 Gaps · 12 Compliant
ENC002 TDE certificates backup Critical
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Back up each TDE certificate together with its private key and keep them off-server in a secure vault — without this backup, an encrypted database becomes unrecoverable after a disaster. Quick to do, low risk (be sure to protect the key password).
ENC001 TDE status details Info
Écart détecté — voir remédiation.
Observed: KO
Recommended action: Informational: current TDE encryption state