Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'

SOC 2

• CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
• CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives

NIST SP 800-53 Rev 5

• AC-5 Separation Of Duties
• AC-6: Least Privilege
• Access Enforcement (AC-3)
• Media Access (MP-2)

CIS GCP Benchmark v3.0.0

• 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'

CIS GCP Benchmark v4.0.0

• 6.3.2 Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'

CIS GCP Benchmark v1.2.0

• 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'

CIS GCP Benchmark v1.3.0

• 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'

CIS GCP Benchmark v2.0.0

• 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'

HIPAA Security Rule 2003

• 164.308(a)(3)(i) Workforce security
• 164.308(a)(3)(ii) Implementation specifications
• 164.312(a)(1) Access control

NIST Cybersecurity Framework v1.0

• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.