USNS MONTFORD POINT - Findings

V-206623 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments ShipCLIP does not require compartmentalized data and data protection.

Check Text

Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to modify categories of information. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to modify categories of information. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to modify categories of information. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete modification of categories of information. Configure the DBMS to produce audit records when it denies modification of categories of information. Configure the DBMS to produce audit records when other errors prevent modification of categories of information.

V-206624 CAT II The DBMS must generate audit records when privileges/permiss...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing when privileges/permissions are deleted.

Check Text

Review DBMS documentation to verify that audit records can be produced when privileges/permissions/role memberships are removed, revoked, or denied to any user or role. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when privileges/permissions/role memberships are removed, revoked, or denied to any user or role. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when privileges/permissions/role memberships are removed, revoked, or denied to any user or role. Configure DBMS audit settings to generate an audit record when privileges/permissions/role memberships are removed, revoked, or denied to any user or role.

V-206625 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of when unsuccessful attempts to delete privileges/permissions occur.

Check Text

Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts remove, revoke, or deny privileges/permissions/role membership to any user or role. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to remove, revoke, or deny privileges/permissions/role membership to any user or role. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to remove, revoke, or deny privileges/permissions/role membership to any user or role. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete attempts to remove, revoke, or deny privileges/permissions/role membership to any user or role. Configure the DBMS to produce audit records when it denies attempts to remove, revoke, or deny privileges/permissions/role membership to any user or role. Configure the DBMS to produce audit records when other errors prevent attempts to remove, revoke, or deny privileges/permissions/role membership to any user or role.

V-206626 CAT II The DBMS must generate audit records when security objects a...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of when security objects are deleted.

Check Text

If the DBMS architecture makes it impossible for any user, even with the highest privileges, to drop its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding. Review DBMS documentation to verify that audit records can be produced when security objects are drop. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects are drop. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when security objects are deleted. Configure the DBMS to produce audit records when security objects are deleted.

V-206627 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of successful and unsuccessful executions of DDL statements.

Check Text

If the DBMS architecture makes it impossible for any user, even with the highest privileges, to drop its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding. Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to drop security objects. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to drop security objects. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to drop security objects. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete attempts to delete security objects. Configure the DBMS to produce audit records when it denies attempts to delete security objects. Configure the DBMS to produce audit records when other errors prevent attempts to delete security objects.

V-206628 CAT II The DBMS must generate audit records when categories of info...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments MSC IBS Afloat apps does not require compartmentalized data and data protection.

Check Text

Review DBMS documentation to verify that audit records can be produced when categories of information are deleted. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when categories of information are deleted. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when categories of information are deleted. Configure the DBMS to produce audit records when categories of information are deleted.

V-206629 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments MSC IBS Afloat apps does not require compartmentalized data and data protection.

Check Text

Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to delete categories of information. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to delete categories of information. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to delete categories of information. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete deletion of categories of information. Configure the DBMS to produce audit records when it denies deletion of categories of information. Configure the DBMS to produce audit records when other errors prevent deletion of categories of information.

V-206630 CAT II The DBMS must generate audit records when successful logons ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of when successful logons or connections occur.

Check Text

Review the DBMS audit settings. If an audit record is not generated each time a user (or other principal) logs on or connects to the DBMS, this is a finding.

Fix Text

Configure DBMS audit settings to generate an audit record each time a user (or other principal) logs on or connects to the DBMS. Ensure that the audit record contains the time of the event, the user ID, and session identifier.

V-206631 CAT II The DBMS must generate audit records when unsuccessful logon...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of when unsuccessful logons or connection attempts occur.

Check Text

Review the DBMS audit settings. If an audit record is not generated each time a user (or other principal) attempts but fails to log on or connect to the DBMS (including attempts where the user ID is invalid/unknown), this is a finding.

Fix Text

Configure DBMS audit settings to generate an audit record each time a user (or other principal) attempts but fails to log on or connect to the DBMS. Include attempts where the user ID is invalid/unknown. Ensure that the audit record contains the time of the event and the user ID that was entered (if any).

V-206632 CAT II The DBMS must generate audit records for all privileged acti...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing for all DDL statements exectutions, option changes, triggers, and xp_cmdshell invocations as well as all actions that require system privileges.

Check Text

Review DBMS documentation to verify that authorized administrative users can designate actions as privileged and that audit records can be produced when privileged actions occur. If the DBMS is not capable of this, this is a finding. Review the system documentation to obtain the definition of the database/DBMS functionality considered privileged in the context of the system in question. Review the DBMS/database security and audit configurations and/or other means used to implement audit logging. If audit logging covers at least all of the actions defined as privileged, this is not a finding; otherwise, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when privileged actions occur. Configure the DBMS to produce audit records when privileged actions occur.

V-206633 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf and SQL Anywhere 17 – Database Activity Audit.pdf specify the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of unsuccessful permission checks or executions of DDL statements, option changes, triggers, and xp_cmdshell invocations as well as all actions that require system privileges.

Check Text

Review DBMS documentation to verify that authorized administrative users can designate actions as privileged and that audit records can be produced when the DBMS prevents attempted privileged actions. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the DBMS prevents attempted privileged actions. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when the DBMS prevents attempted privileged action. Configure the DBMS to produce audit records when the DBMS prevents attempted privileged actions.

V-206634 CAT II The DBMS must generate audit records showing starting and en...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf species the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of all successful connection attempts.

Check Text

Review the DBMS audit settings. If an audit record is not generated each time a user (or other principal) logs off or disconnects from the DBMS voluntarily, or forced by the system, or because of connection or other failure, this is a finding.

Fix Text

Configure DBMS audit settings to generate an audit record each time a user (or other principal) logs off or disconnects, whether voluntarily or forced by the system, or because of connection or other failure, from the DBMS. Ensure that the audit record contains the time of the event, the user ID, and session identifier.

V-206635 CAT II The DBMS must generate audit records when concurrent logons/...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf species the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of all logon attempt even when concurrent logons/connections by the same user from different workstations occur.

Check Text

Review the DBMS audit settings. If the fact of multiple, concurrent logons by a given user (or other principal) can be reliably reconstructed from the log entries for other events, then this is not a finding. If an audit record is not generated each time a user (or other principal) who is already connected to the DBMS logs on or connects to the DBMS from a different workstation, this is a finding.

Fix Text

Configure DBMS audit settings to generate an audit record each time a user (or other principal) who is already connected to the DBMS logs on or connects to the DBMS from a different workstation.

V-206636 CAT II The DBMS must be able to generate audit records when success...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf species the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of successful permission checks on objects which translates to a successful access to an object.

Check Text

Review DBMS documentation to verify that administrative users can specify database objects for which access must be audited and can specify which kinds of access must be audited. If the DBMS is not capable of this, this is a finding. Review system documentation to determine whether the application owner has specified database objects (tables, views, procedures, functions, etc.) for which access must be audited. Review the DBMS/database security and audit settings to verify that the specified access to the specified objects is audited. If not, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when object access occurs. Configure audit settings to create audit records when the specified access to the specified objects occurs.

V-206637 CAT II The DBMS must generate audit records when unsuccessful acces...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf species the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of failed permission checks on objects which translates to an unsuccessful access to an object.

Check Text

Review DBMS documentation to verify that administrative users can specify database objects for which access must be audited, and can specify which kinds of access must be audited. If the DBMS is not capable of this, this is a finding. Review DBMS documentation to determine whether the application owner has specified database objects (tables, views, procedures, functions, etc.) for which access must be audited. Review the DBMS/database security and audit settings to verify that audit records are created for unsuccessful attempts at the specified access to the specified objects. If not, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when object access occurs. Configure audit settings to create audit records when the specified access to the specified objects is unsuccessfully attempted.

V-206638 CAT II The DBMS must generate audit records for all direct access t...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf species the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of all successful and unsuccessful connection attempts.

Check Text

If the DBMS does not generate audit records for all direct access to the database(s), this is a finding.

Fix Text

Configure the DBMS to generate audit records for all direct access to the database(s).

V-206639 CAT II The DBMS must implement NIST FIPS 140-2 or 140-3 validated c...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS does not provision Digital signatures.

Check Text

If the DBMS does not employ NIST FIPS 140-2 or 140-3 validated cryptographic modules to provision digital signatures, this is a finding.

Fix Text

Implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to provision digital signatures.

V-206640 CAT II The DBMS must implement NIST FIPS 140-2 or 140-3 validated c...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS is configured to start in FIPS mode using the -fips database server option (SQL Anywhere 17 - -fips Database Option.pdf). This option enables the DBMS to utilize NIST FIPS 140-2 or 140-3 Cryptographic modules to generate and validate cryptographic hashes.

Check Text

If the DBMS does not employ NIST FIPS 140-2 or 140-3 validated cryptographic modules to generate and verify cryptographic hashes, this is a finding.

Fix Text

Implement a NIST FIPS 140-2 or 140-3 validated cryptographic module in the DBMS for generation and verification of cryptographic hashes.

V-206641 CAT II The DBMS must implement NIST FIPS 140-2 or 140-3 validated c...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS is configured to start in FIPS mode using the -fips database server option (SQL Anywhere 17 - -fips Database Option.pdf). This option enables the DBMS to utilize NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owner’s requirements.

Check Text

Verify the DBMS implements NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements. If the DBMS does not implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements, this is a finding.

Fix Text

Configure the DBMS to implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.

V-206642 CAT II The DBMS must off-load audit data to a separate log manageme...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments An Audit log is generated in directory E:\IBSDatabaseAuditFiles\Logs\ShipCLIP. An Event runs once a day at 0002 to generate a new audit log, securely package old audit log, and stage secure package in directory ESTA Root\LESAudit\ShipCLIP\To_Shore for transmission to shore and subsequent processing into the centrally managed OpenSearch repository.

Check Text

Review the system documentation for a description of how audit records are off-loaded. If the DBMS has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. If the DBMS does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.

Fix Text

Configure the DBMS or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.

V-206643 CAT II The DBMS must be configured in accordance with the security ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS is configured according to the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.

Check Text

Review the DBMS documentation and configuration to determine if the DBMS is configured in accordance with DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs and IAVMs. If the DBMS is not configured in accordance with security configuration settings, this is a finding.

Fix Text

Configure the DBMS in accordance with DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs and IAVMs.

V-263602 CAT II The DBMS must disable accounts when the accounts have expire...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS is configured to utilize Login Policy options max_failed_login_attempts and max_days_login (SQL Anywhere 17 - Login_Policy_Options.pdf) to expire and disable non-system accounts.

Check Text

Verify the DBMS is configured to disable accounts when the accounts have expired. If the DBMS is not configured to disable accounts when the accounts have expired, this is a finding.

Fix Text

Configure the DBMS to disable accounts when the accounts have expired.

V-263603 CAT II The DBMS must disable accounts when the accounts are no long...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments All non-system accounts are associated to a user and are disabled according to Login policies.

Check Text

Verify the DBMS is configured to disable accounts when the accounts are no longer associated to a user. If the DBMS is not configured to disable accounts when the accounts are no longer associated to a user, this is a finding.

Fix Text

Configure the DBMS to disable accounts when the accounts are no longer associated to a user.

V-263604 CAT II The DBMS must implement the capability to centrally review a...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments An Audit log is generated in directory E:\IBSDatabaseAuditFiles\Logs\ShipCLIP. An Event runs once a day at 0002 to generate a new audit log, securely package old audit log, and stage secure package in directory ESTA Root\LESAudit\ShipCLIP\To_Shore for transmission to shore and subsequent processing into the centrally managed OpenSearch repository.

Check Text

Verify the DBMS is configured to implement the capability to centrally review and analyze audit records from multiple components within the system. If the DBMS is not configured to implement the capability to centrally review and analyze audit records from multiple components within the system, this is a finding.

Fix Text

Configure the DBMS to implement the capability to centrally review and analyze audit records from multiple components within the system.

V-263605 CAT II The DBMS must alert organization-defined personnel or roles ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Real time alerts are not possible in a disconnected architecture. As such, any database alerts that are produced, are sent ashore and received by the MSC IBS Ashore personnel with the next replication cycle.

Check Text

Verify the DBMS is configured to alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information. If the DBMS is not configured to alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information, this is a finding.

Fix Text

Configure the DBMS to alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

V-263606 CAT II The DBMS must prevent the installation of organization-defin...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments All software patches are obtained from the vendors and must go through the MSC Configuration Management process before being installed in a Production environment.

Check Text

Verify the DBMS is configured to prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate recognized and approved by the organization. If the DBMS is not configured to prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization, this is a finding.

Fix Text

Configure the DBMS to prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

V-263607 CAT II The DBMS must require users to be individually authenticated...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments ShipCLIP does not utilize shared accounts.

Check Text

Verify the DBMS is configured to require users to be individually authenticated before granting access to the shared accounts or resources. If the DBMS is not configured to require users to be individually authenticated before granting access to the shared accounts or resources, this is a finding.

Fix Text

Configure the DBMS to require users to be individually authenticated before granting access to the shared accounts or resources.

V-263608 CAT II The DBMS must implement multifactor authentication for local...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. The accounts within the database are a separate directory service then the Active Directory Services used to access the database server or workstation.

Check Text

Verify the DBMS is configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access. If the DBMS is not configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

Fix Text

Configure the DBMS to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.

V-263609 CAT II The DBMS must implement multifactor authentication for local...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. The accounts within the database are a separate directory service then the Active Directory Services used to access the database server or workstation.

Check Text

Verify the DBMS is configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements. If the DBMS is not configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements, this is a finding.

Fix Text

Configure the DBMS to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements.

V-263610 CAT II The DBMS must, for password-based authentication, maintain a...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Based on DOD password criteria, the minimum 15-character length, the use of 2 special, 2 upper-case and 2 lower-case characters required for login eliminate commonly used passwords.

Check Text

Verify the DBMS is configured to maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency. If the DBMS is not configured to maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency, this is a finding.

Fix Text

Configure the DBMS to maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.

V-263611 CAT II The DBMS must, for password-based authentication, update the...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Based on DOD password criteria, the minimum 15-character length, the use of 2 special, 2 upper-case and 2 lower-case characters required for login eliminate commonly used passwords.

Check Text

Verify the DBMS is configured to update the list of passwords on an organization-defined frequency. If the DBMS is not configured to update the list of passwords on an organization-defined frequency, this is a finding.

Fix Text

Configure the DBMS to update the list of passwords on an organization-defined frequency.

V-263612 CAT II The DBMS must, for password-based authentication, update the...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Based on DOD password criteria, the minimum 15-character length, the use of 2 special, 2 upper-case and 2 lower-case characters required for login eliminate commonly used passwords.

Check Text

Verify the DBMS is configured to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly. If the DBMS is not configured to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly, this is a finding.

Fix Text

Configure the DBMS to update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.

V-263613 CAT II The DBMS must, for password-based authentication, verify tha...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Based on DOD password criteria, the minimum 15-character length, the use of 2 special, 2 upper-case and 2 lower-case characters required for login eliminate commonly used passwords.

Check Text

Verify the DBMS is configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a). If the DBMS is not configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a), this is a finding.

Fix Text

Configure the DBMS to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).

V-263614 CAT II The DBMS must, for password-based authentication, require im...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user, who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Creation of password-based installer accounts is initiated from shore and utilize the procedure SC_RemoteUserMaint. Password-based application accounts are created and maintained through the application using the procedure SC_UserMaint. Both procedures use the FORCE PASSWORD CHANGE ON clause when creating or altering a login.

Check Text

Verify the DBMS is configured to require immediate selection of a new password upon account recovery. If the DBMS is not configured to require immediate selection of a new password upon account recovery, this is a finding.

Fix Text

Configure the DBMS to require immediate selection of a new password upon account recovery.

V-263615 CAT II The DBMS must, for password-based authentication, allow user...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Database contains an obfuscated procedure, f_verify_pwd, that enforces password complexity. Passwords are required to be at least 15 characters long.

Check Text

Verify the DBMS is configured to allow user selection of long passwords and passphrases, including spaces and all printable characters. If the DBMS is not configured to allow user selection of long passwords and passphrases, including spaces and all printable characters, this is a finding.

Fix Text

Configure the DBMS to allow user selection of long passwords and passphrases, including spaces and all printable characters.

V-263616 CAT II The DBMS must, for password-based authentication, employ aut...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Password changes for application and installer accounts are maintained through the application. During the password change process, the application will display a Password Criteria section to assist the user in selecting a strong password.

Check Text

Verify the DBMS is configured to employ automated tools to assist the user in selecting strong password authenticators. If the DBMS is not configured to employ automated tools to assist the user in selecting strong password authenticators, this is a finding.

Fix Text

Configure the DBMS to employ automated tools to assist the user in selecting strong password authenticators.

V-263617 CAT II The DBMS must, for public key-based authentication, implemen...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS uses the CA and CRL lists for public key-based authentication. These lists are located on the Application server.

Check Text

Verify the DBMS is configured to implement a local cache of revocation data to support path discovery and validation. If the DBMS is not configured to implement a local cache of revocation data to support path discovery and validation, this is a finding.

Fix Text

Configure the DBMS to implement a local cache of revocation data to support path discovery and validation.

V-263618 CAT II The DBMS must protect nonlocal maintenance sessions by separ...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Network paths and maintenance sessions are inherited by the hosting environment.

Check Text

Verify the DBMS is configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths. If the DBMS is not configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths, this is a finding.

Fix Text

Configure the DBMS to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.

V-263619 CAT II The DBMS must include only approved trust anchors in trust s...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user, who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Access to PKI private keys is restricted to privileged users having direct access to the server. Files containing In-transit and at-rest encryption keys are obfuscated.

Check Text

Verify the DBMS is configured to include only approved trust anchors in trust stores or certificate stores managed by the organization. If the DBMS is not configured to include only approved trust anchors in trust stores or certificate stores managed by the organization, this is a finding.

Fix Text

Configure the DBMS to include only approved trust anchors in trust stores or certificate stores managed by the organization.

V-263620 CAT II The DBMS must provide protected storage for cryptographic ke...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user, who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Access to PKI private keys is restricted to privileged users having direct access to the server. Files containing In-transit and at-rest encryption keys are obfuscated.

Check Text

Verify the DBMS is configured to provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store. If the DBMS is not configured to provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store, this is a finding.

Fix Text

Configure the DBMS to provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

V-263621 CAT II The DBMS must synchronize system clocks within and between s...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Reference document SQL Anywhere 17 Date functions.pdf states that SQL Anywhere date functions use system clock.

Check Text

Verify the DBMS is configured to synchronize system clocks within and between systems or system components. If the DBMS is not configured to synchronize system clocks within and between systems or system components, this is a finding.

Fix Text

Configure the DBMS to synchronize system clocks within and between systems or system components.

V-263622 CAT II The DBMS must compare the internal system clocks on an organ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Reference document SQL Anywhere 17 Date functions.pdf states that SQL Anywhere date functions use system clock.

Check Text

Verify the DBMS is configured to compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source. If the DBMS is not configured to compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source, this is a finding.

Fix Text

Configure the DBMS to compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text