I realize this is an old thread, but if anyone is still looking for comprehensive vulnerability scanning tools for SQL STIGs, you can now use ASSET to STIG SQL 2014...

If you want to "get it perfect" try ASSET.  It will scan SQL Server, evaluate the results, and produce the database and instance checklists for either SQL Server 2014 or...

I haven't heard back about posting an evaluation version, but you can see a video of ASSET in action at https://borellisecuritysoftware.com/products/asset-automated-sql-security-evaluation-tool

It performs the STIG checks for DISA's 2014...

I've passed many SQL audits now, and I developed a tool to help perform STIG checks, if you are interested.

https://borellisecuritysoftware.com/products/asset-automated-sql-security-evaluation-tool