V-206626
SV-206626r961818_rule
CAT II
The DBMS must generate audit records when security objects are deleted.
From: Database Security Requirements Guide (V4R5)
Description
<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
If the DBMS architecture makes it impossible for any user, even with the highest privileges, to drop its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding.
Review DBMS documentation to verify that audit records can be produced when security objects are drop.
If the DBMS is not capable of this, this is a finding.
Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects are drop.
If they are not produced, this is a finding.
Fix Text
Deploy a DBMS capable of producing the required audit records when security objects are deleted.
Configure the DBMS to produce audit records when security objects are deleted.
CCI Reference
CCI-000172- Created
- 2026-03-06 17:52:29
- Last Updated
- 2026-04-07 20:08:14