V-206636
SV-206636r961836_rule
CAT II
The DBMS must be able to generate audit records when successful accesses to objects occur.
From: Database Security Requirements Guide (V4R5)
Description
<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.
In an SQL environment, types of access include, but are not necessarily limited to:
SELECT
INSERT
UPDATE
DELETE
EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
Review DBMS documentation to verify that administrative users can specify database objects for which access must be audited and can specify which kinds of access must be audited.
If the DBMS is not capable of this, this is a finding.
Review system documentation to determine whether the application owner has specified database objects (tables, views, procedures, functions, etc.) for which access must be audited. Review the DBMS/database security and audit settings to verify that the specified access to the specified objects is audited.
If not, this is a finding.
Fix Text
Deploy a DBMS capable of producing the required audit records when object access occurs.
Configure audit settings to create audit records when the specified access to the specified objects occurs.
CCI Reference
CCI-000172- Created
- 2026-03-06 17:52:29
- Last Updated
- 2026-04-07 20:08:14