USNS MONTFORD POINT - Findings

V-206564 CAT II The DBMS must separate user functionality (including user in...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Users are configured with roles that separate user functionality from database management functionality. Application users are not assigned to DBA or SSO roles which govern database management functions.

Check Text

Check DBMS settings and vendor documentation to verify that administrative functionality is separate from user functionality. If administrator and general user functionality are not separated either physically or logically, this is a finding.

Fix Text

Configure DBMS to separate database administration and general user functionality.

V-206565 CAT II The DBMS must invalidate session identifiers upon user logou...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS generates unique system-generated session identifiers for every database login connection. The session identifiers are invalidated upon user logout or for other session terminations. The DBMS is not accessible by a direct remote connection or URL.

Check Text

Review DBMS settings and vendor documentation to verify user sessions are terminated, and session identifiers invalidated, upon user logout. If they are not, this is a finding. Review system documentation and organization policy to identify other events that should result in session terminations. If other session termination events are defined, review DBMS settings to verify occurrences of these events would cause session termination, invalidating the session identifiers. If occurrences of defined session terminating events do not cause session terminations, invalidating the session identifiers, this is a finding.

Fix Text

Configure DBMS settings to terminate sessions, invalidating their session identifiers, upon user logout. Configure DBMS settings to terminate sessions, invalidating their session identifiers, upon the occurrence of any organization- or policy-defined session termination event.

V-206566 CAT II The DBMS must recognize only system-generated session identi...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS generates unique system-generated session identifiers for every database login connection. The DBMS is not accessible by direct remote connection or URL.

Check Text

Review DBMS settings and vendor documentation to determine whether the DBMS recognizes session identifiers that are not system-generated. If the DBMS recognizes session identifiers that are not system generated, this is a finding.

Fix Text

Utilize a DBMS product that only recognizes session identifiers that are system-generated.

V-206567 CAT II The DBMS must maintain the authenticity of communications se...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Database or application connections transmit data using TLS in-transit encryption which guard against man-in-the-middle attacks. In-transit encryption is configured in the smisdbs17-E.cfg file using the -ec option and specifying the identity path+filename of the obfuscated TLS configuration file. The DBMS is not accessible by direct remote connection or URL.

Check Text

Review DBMS vendor documentation and system behavior (and if necessary, consult vendor representatives) to determine whether the DBMS can provide demonstrably effective protection against man-in-the-middle attacks that guess at session identifier values. If not, this is a finding. Review DBMS settings to determine whether protections against man-in-the-middle attacks that guess at session identifier values are enabled. If they are not, this is a finding.

Fix Text

Utilize a DBMS product that can provide demonstrably effective protection against man-in-the-middle attacks that guess at session identifier values. Configure DBMS settings to enable protections against man-in-the-middle attacks that guess at session identifier values.

V-206568 CAT II The DBMS must fail to a secure state if system initializatio...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Section 1.6.1.2 of reference document SQL-Anywhere-Server-Database-Administration 17 -en.pdf details database shutdown and recovery processes including the Automatic Recovery Process (Section 1.6.1.2.1).

Check Text

Check DBMS settings and vendor documentation to verify the DBMS properly handles transactions in the event of a system failure. If open transactions are not rolled back to a consistent state during system failure, this is a finding. The consistent state must include a security configuration that is at least as restrictive as before the system failure. If this is not guaranteed, this is a finding.

Fix Text

Configure DBMS settings so that, in the event of a system failure, the DBMS will roll back open transactions to a consistent state, to include a security configuration that is at least as restrictive as before the system failure.

V-206569 CAT II In the event of a system failure, the DBMS must preserve any...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments DBMS utilizes service, transaction and audit logs to record the system state. The service log records the DB startup options and the state of the DBs within the service to include the date and time of DB checkpoints and database warnings and errors as to cause of failure. Transaction and audit logs record all actions that occur against a database and can provide cause of failure information.

Check Text

Check DBMS settings to determine whether organization-defined system state information is being preserved in the event of a system failure. If organization-defined system state information is not being preserved, this is a finding.

Fix Text

Configure DBMS settings to preserve any organization-defined system state information in the event of a system failure.

V-206571 CAT II The DBMS must isolate security functions from non-security f...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Isolation of security functions and non-security functions are controlled by roles. Only the DBA and SSO roles are able to execute security functions.

Check Text

Check DBMS settings to determine whether objects or code implementing security functionality are located in a separate security domain, such as a separate database or schema created specifically for security functionality. If security-related database objects or code are not kept separate, this is a finding.

Fix Text

Locate security-related database objects and code in a separate database, schema, or other separate security domain from database objects and code implementing application logic.

V-206572 CAT II Database contents must be protected from unauthorized and un...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments MSC IBS Afloat apps are not developed in the Afloat hosting production or test environments. The application is developed in a separate, stand-alone environment and deployed to the fleet as a compiled installation. As such, no code exists for moving data from Production to Test/Dev environments.

Check Text

Review the procedures for the refreshing of development/test data from production. Review any scripts or code that exists for the movement of production data to development/test systems, or to any other location or for any other purpose. Verify that copies of production data are not left in unprotected locations. If the code that exists for data movement does not comply with the organization-defined data transfer policy and/or fails to remove any copies of production data from unprotected locations, this is a finding.

Fix Text

Modify any code used for moving data from production to development/test systems to comply with the organization-defined data transfer policy, and to ensure copies of production data are not left in unsecured locations.

V-206573 CAT II The DBMS must prevent unauthorized and unintended informatio...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments DBMS is capable of effectively protecting the private resources of one process or user from unauthorized access by another user or process. DBMS is only directly accessible by privileged users on the server.

Check Text

Review the DBMS architecture to find out if and how it protects the private resources of one process or user (such as working memory, temporary tables, uncommitted data) from unauthorized access by another user or process. If it does not effectively do so, this is a finding.

Fix Text

Deploy a DBMS capable of effectively protecting the private resources of one process or user from unauthorized access by another user or process. Configure the DBMS to effectively protect the private resources of one process or user from unauthorized access by another user or process.

V-206574 CAT II Access to database files must be limited to relevant process...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days.

Check Text

Review the permissions granted to users by the operating system/file system on the database files, database log files and database backup files. If any user/role who is not an authorized system administrator with a need to know or database administrator with a need to know, or a system account for running DBMS processes, is permitted to read/view any of these files, this is a finding.

Fix Text

Configure the permissions granted by the operating system/file system on the database files, database log files, and database backup files so that only relevant system accounts and authorized system administrators and database administrators with a need to know are permitted to read/view these files.

V-206575 CAT II The DBMS must check the validity of all data inputs except t...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Application-specific logic is implemented within the database using stored procedures, functions and triggers, where appropriate. Database tables have defined columns and have primary key indexes. Database code does properly validate data before it is put into the database or acted upon by the database. Development team confirms that code accounts for invalid inputs.

Check Text

Review DBMS code (stored procedures, functions, and triggers), application code, settings, column and field definitions, and constraints to determine whether the database is protected against invalid input. If code exists that allows invalid data to be acted upon or input into the database, this is a finding. If column/field definitions do not exist in the database, this is a finding. If columns/fields do not contain constraints and validity checking where required, this is a finding. Where a column/field is noted in the system documentation as necessarily free-form, even though its name and context suggest that it should be strongly typed and constrained, the absence of these protections is not a finding. Where a column/field is clearly identified by name, caption or context as Notes, Comments, Description, Text, etc., the absence of these protections is not a finding.

Fix Text

Modify database code to properly validate data before it is put into the database or acted upon by the database. Modify the database to contain column/field definitions for each column/field in the database. Modify the database to contain constraints and validity checking on database columns and tables that require them for data integrity.

V-206576 CAT II The DBMS and associated applications must reserve the use of...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Neither the ShipCLIP application nor SQL Anywhere use dynamic code execution.

Check Text

Review DBMS source code (stored procedures, functions, triggers) and application source code, to identify cases of dynamic code execution. If dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, this is a finding.

Fix Text

Where dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, modify the code to do so.

V-206577 CAT II The DBMS and associated applications, when making use of dyn...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Neither the ShipCLIP application nor SQL Anywhere use dynamic code execution.

Check Text

Review DBMS source code (stored procedures, functions, triggers) and application source code to identify cases of dynamic code execution. If dynamic code execution is employed without protective measures against code injection, this is a finding.

Fix Text

Where dynamic code execution is used, modify the code to implement protections against code injection.

V-206578 CAT II The DBMS must provide non-privileged users with error messag...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Non-privileged users do not have direct access to the DBMS where database error messages are displayed. The application displays errors messages that only provide information for corrective action. The DBMS is not accessible by direct remote connection or URL.

Check Text

Check DBMS settings and custom database code to verify that error messages do not contain information beyond what is needed for troubleshooting the issue. If database errors contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

Fix Text

Configure DBMS settings, custom database code, and associated application code not to divulge sensitive information or information useful for system identification in error messages.

V-206579 CAT II The DBMS must reveal detailed error messages only to the ISS...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Non-privileged users do not have direct access to the DBMS where database error messages are displayed. Only Administrative users can see the error messages in the DBMS. The database server can only be accessed by a privileged user, who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Installer accounts are created and sent from shore.

Check Text

Check DBMS settings and custom database code to determine if detailed error messages are ever displayed to unauthorized individuals. If detailed error messages are displayed to individuals not authorized to view them, this is a finding.

Fix Text

Configure DBMS settings, custom database code, and associated application code not to display detailed error messages to those not authorized to view them.

V-206580 CAT II The DBMS must automatically terminate a user session after o...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS does automatically terminate a user session. The organization-defined conditions are documented in Section 12.0 of the MSC IBS Access Control Policy 2.2. When a privileged user is logged out of DBMS server after 15 minutes of inactivity, the direct connection to the DBMS is automatically terminated. The Database is configured to logout non-privileged application users after 15 minutes of inactivity and privileged application users at 10 minutes of inactivity. Application users have no direct access to the DBMS.

Check Text

Review system documentation to obtain the organization's definition of circumstances requiring automatic session termination. If the documentation explicitly states that such termination is not required or is prohibited, this is not a finding. If the documentation requires automatic session termination, but the DBMS is not configured accordingly, this is a finding.

Fix Text

Configure the DBMS to automatically terminate a user session after organization-defined conditions or trigger events requiring session termination.

V-206581 CAT II The DBMS must provide logout functionality to allow the user...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS is configured to allow a manual termination of a session by providing a logout capability to the user.

Check Text

Determine, by reviewing DBMS documentation and/or inquiring of the vendor's technical support staff, whether the DBMS satisfies this requirement; and, if it does, determine whether this is inherent, unchangeable behavior, or a configurable feature. If the DBMS does not satisfy the requirement, this is a permanent finding. If the behavior is inherent, this is permanently not a finding. If the behavior is configurable, and the current configuration does not enforce it, this is a finding.

Fix Text

Where relevant, modify the configuration to allow the user to manually terminate a session initiated by that user.

V-206582 CAT II The DBMS must associate organization-defined types of securi...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Security labeling is not required as system only handles unclassified data.

Check Text

If security labeling is not required, this is not a finding. If security labeling requirements have been specified, but the security labeling is not implemented or does not reliably maintain labels on information in storage, this is a finding.

Fix Text

Enable DBMS features, deploy third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in storage.

V-206583 CAT II The DBMS must associate organization-defined types of securi...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Security labeling is not required as system only handles unclassified data.

Check Text

If security labeling is not required, this is not a finding. If security labeling requirements have been specified, but the security labeling is not implemented or does not reliably maintain labels on information in process, this is a finding.

Fix Text

Enable DBMS features, deploy third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in process.

V-206584 CAT II The DBMS must associate organization-defined types of securi...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Security labeling is not required as system only handles unclassified data.

Check Text

If security labeling is not required, this is not a finding. If security labeling requirements have been specified, but the security labeling is not implemented or does not reliably maintain labels on information in transmission, this is a finding.

Fix Text

Enable DBMS features, deploy third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in transmission.

V-206585 CAT II The DBMS must enforce discretionary access control policies,...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments DBMS does not implement DAC policies. SQL Anywhere uses authority/permission/group and role/privilege/user-extended security models.

Check Text

Review system documentation to identify the required discretionary access control (DAC). Review the security configuration of the database and DBMS. If applicable, review the security configuration of the application(s) using the database. If the discretionary access control defined in the documentation is not implemented in the security configuration, this is a finding.

Fix Text

Implement the organization's DAC policy in the security configuration of the database and DBMS, and, if applicable, the security configuration of the application(s) using the database.

V-206586 CAT II The DBMS must prevent non-privileged users from executing pr...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Prohibiting non-privileged user from executing privileged functions is documented in Section 6.10 of the MSC IBS Access Control Policy 2.2. DBMS prevents non-privileged users from executing privileged functions through Roles. Non-privileged users do not have direct access the DBMS as it resides in a secure location. The database server can only be accessed by a privileged user, who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Installer accounts are created and sent from shore.

Check Text

Review the system documentation to obtain the definition of the database/DBMS functionality considered privileged in the context of the system in question. Review the DBMS security configuration and/or other means used to protect privileged functionality from unauthorized use. If the configuration does not protect all of the actions defined as privileged, this is a finding.

Fix Text

Configure DBMS security to protect all privileged functionality.

V-206587 CAT II Execution of software modules (to include stored procedures,...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Privilege-elevation is not used within the DBMS. Stored procedures, functions and triggers are secured by roles. Only database DBA or SSO roles can execute modules needing elevated privileges.

Check Text

Review the system documentation, database and DBMS security configuration, source code for DBMS internal logic, source code of external modules invoked by the DBMS, and source code of the application(s) using the database. If elevation of DBMS privileges is utilized but not documented, this is a finding. If elevation of DBMS privileges is documented, but not implemented as described in the documentation, this is a finding. If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Fix Text

Determine where, when, how, and by what principals/subjects elevated privilege is needed. Modify the database and DBMS security configuration, DBMS internal logic, external modules invoked by the DBMS, and the application(s) using the database, to ensure privilege elevation is used only as required.

V-206591 CAT II The DBMS must allocate audit record storage capacity in acco...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Storage requirement for audit records is not restricted on afloat environments and is able to consume the full amount of the available log drive space as needed. However, during audit log rollover, the previous log is immediately packaged and sent ashore to be translated and ingested into the OpenSearch repository. During rollover, the space on the afloat database server occupied by the previous audit file is reclaimed and a new audit log is created. Original audit files are then stored ashore in S3 buckets that have unlimited amount of storage and have access restricted to only authorized personnel.

Check Text

Investigate whether there have been any incidents where the DBMS ran out of audit log space since the last time the space was allocated or other corrective measures were taken. If there have been, this is a finding.

Fix Text

Allocate sufficient audit file/table space to support peak demand.

V-206592 CAT II The DBMS must provide a warning to appropriate support staff...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Audit logs are sent ashore daily and stored in S3 buckets that have unlimited amount of storage so the audit logs never grow large enough to consume 75% of the server’s storage. Storage size alerts on the ship are part of Operating System monitoring which falls to the hosting environment to configure.

Check Text

Review system configuration. If appropriate support staff are not notified immediately upon storage volume utilization reaching 75%, this is a finding.

Fix Text

Configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.

V-206593 CAT II The DBMS must provide an immediate real-time alert to approp...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Real time alerts are not possible in a disconnected architecture. As such, any database alerts that are produced, are sent ashore and received by the MSC IBS Ashore personnel with the next replication cycle.

Check Text

Review DBMS settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. If real-time alerts are not sent upon auditing failure, this is a finding.

Fix Text

Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.

V-206594 CAT II The DBMS must record time stamps, in audit records and appli...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17- Database Activity Audit.pdf specifies that the audit log captures accurate timestamps of all events (to a resolution of milliseconds). The DBMS records time stamps in UTC.

Check Text

Verify that the DBMS generates time stamps, in audit records and application data, that maps to UTC. If it does not, this is a finding.

Fix Text

Ensure the DBMS generates time stamps, in audit records and application data, that maps to UTC.

V-206595 CAT II The DBMS must generate time stamps, for audit records and ap...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17- Database Activity Audit.pdf specifies that the audit log captures accurate timestamps of all events (to a resolution of milliseconds). Parameter default_timestamp_increment is also set to 10000 for database operations set it to a 2-digit millisecond representation.

Check Text

Review product documentation to verify that the DBMS can generate time stamps with a granularity of one second or finer. If it cannot, this is a finding. Review audit log records produced by the DBMS for confirmation that time stamps are recorded to a precision of one second or finer. If not, this is a finding. Review time stamp values in audit trail columns/fields in application data in the database. If the time stamps are not recorded to a precision of one second or finer, this is a finding.

Fix Text

Deploy a DBMS that can generate and record time stamps with a granularity of one second or finer. Configure auditing so that the time stamps are recorded to a precision of one second or finer. Modify applications and/or column/field definitions so that the time stamps in audit trail columns/fields in application data are recorded to a precision of one second or finer.

V-206596 CAT II The DBMS must prohibit user installation of logic modules (s...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Only MSC-authorized installers with administrator privileges can install DBMS modules. Only database DBA or SSO roles can install or modify logic modules.

Check Text

If the DBMS supports only software development, experimentation and/or developer-level testing (that is, excluding production systems, integration testing, stress testing, and user acceptance testing), this is not a finding. Review the DBMS and database security settings with respect to nonadministrative users' ability to create, alter, or replace logic modules, to include but not necessarily only stored procedures, functions, triggers, and views. If any such permissions exist and are not documented and approved, this is a finding.

Fix Text

Document and obtain approval for any nonadministrative users who require the ability to create, alter or replace logic modules. Implement the approved permissions. Revoke any unapproved permissions.

V-206597 CAT II The DBMS must enforce access restrictions associated with ch...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database server can only be accessed by a privileged user who creates an Afloat Operations Service Desk ticket. Once the Afloat Operations Service Desk confirms the privileged user has the proper credentials, a domain admin account is created for the user and is valid for 14 days. Only MSC-authorized installers with DBA or SSO roles can make changes to the configuration of the DBMS.

Check Text

Review DBMS vendor documentation with respect to its ability to enforce access restrictions associated with changes to the configuration of the DBMS or database(s). If it is not able to do this, this is a finding. Review the security configuration of the DBMS and database(s). If it does not enforce access restrictions associated with changes to the configuration of the DBMS or database(s), this is a finding.

Fix Text

Deploy a DBMS capable of enforcing access restrictions associated with changes to the configuration of the DBMS or database(s). Configure the DBMS to enforce access restrictions associated with changes to the configuration of the DBMS or database(s).

V-206598 CAT II The DBMS must produce audit records of its enforcement of ac...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of successful and unsuccessful executions of DDL statements and changes to database options.

Check Text

Review DBMS documentation to verify audit records can be produced when the system denies or fails to complete attempts to change the configuration of the DBMS or database(s). If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to change the configuration of the DBMS or database(s). If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to change the configuration of the DBMS or database(s). If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete attempts to change the configuration of the DBMS or database(s). Configure the DBMS to produce audit records when it denies attempts to change the configuration of the DBMS or database(s). Configure the DBMS to produce audit records when other errors prevent attempts to change the configuration of the DBMS or database(s).

V-206599 CAT II The DBMS must disable network functions, ports, protocols, a...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The database can only start up using the port designated in the -x database option. The designated port used by the database is configured to 2639 within the smisdbs17-E.cfg file.

Check Text

Review the network functions, ports, protocols, and services supported by the DBMS. If any protocol is prohibited by the PPSM guidance and is enabled, this is a finding.

Fix Text

Deploy a DBMS capable of disabling a network function, port, protocol, or service prohibited by the PPSM guidance. Disable each prohibited network function, port, protocol, or service.

V-206600 CAT II The DBMS must require users to reauthenticate when organizat...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments The DBMS requires reauthentication when changing role or escalating privileges. Creation of password-based installer accounts is initiated from shore and utilize the procedure SC_RemoteUserMaint. Password-based application accounts are created and maintained through the application using the procedure SC_UserMaint. Both procedures use the FORCE PASSWORD CHANGE ON clause when creating or altering a login.

Check Text

Review the system documentation and the configuration of the DBMS and related applications and tools. If there are any circumstances under which a user is not required to reauthenticate when changing role or escalating privileges, this is a finding. If the information owner has identified additional cases where reauthentication is needed, but there are circumstances where the system does not ask the user to reauthenticate when those cases occur, this is a finding.

Fix Text

Modify and/or configure the DBMS and related applications and tools so that users are always required to reauthenticate when changing role or escalating privileges. Modify and/or configure the DBMS and related applications and tools so that users are always required to reauthenticate when the specified cases needing reauthorization occur.

V-206601 CAT II The DBMS must prohibit the use of cached authenticators afte...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments DBMS does not allow cached authentication. The DBMS requires reauthentication for every login attempt.

Check Text

Review system settings to determine whether the organization-defined limit for cached authentication is implemented. If it is not implemented, this is a finding.

Fix Text

Modify system settings to implement the organization-defined limit on the lifetime of cached authenticators.

V-206603 CAT II The DBMS must only accept end entity certificates issued by ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments DBMS sessions can only be launched from the server on which it is installed, so no certificate is required.

Check Text

If the DBMS will accept non-DOD approved PKI end-entity certificates, this is a finding.

Fix Text

Revoke trust in any certificates not issued by a DOD-approved certificate authority. Configure the DBMS to accept only DOD and DOD-approved PKI end-entity certificates.

V-206606 CAT II The DBMS must maintain a separate execution domain for each ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments DBMS is capable of maintaining a separate execution domain for each executing process.

Check Text

Review the DBMS architecture to find out if and how it protects the private resources of one process (such as working memory, temporary tables, uncommitted data and, especially, executable code) from unauthorized access or modification by another user or process. If it is not capable of maintaining a separate execution domain for each executing process, this is a finding. If the DBMS is capable of maintaining a separate execution domain for each executing process, but is configured not to do so, this is a finding.

Fix Text

Deploy a DBMS capable of maintaining a separate execution domain for each executing process. If this is a configurable feature, configure the DBMS to implement it.

V-206607 CAT II The DBMS must maintain the confidentiality and integrity of ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Database or application connections transmit data using TLS in-transit encryption to maintain the confidentiality and integrity of information during preparation for transmission. In-transit encryption is configured in the smisdbs17-E.cfg file using the -ec option and specifying the identity path+filename of the obfuscated TLS configuration file.

Check Text

If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, this is not a finding. If the DBMS does not employ protective measures against unauthorized disclosure and modification during preparation for transmission, this is a finding.

Fix Text

Implement protective measures against unauthorized disclosure and modification during preparation for transmission.

V-206608 CAT II The DBMS must maintain the confidentiality and integrity of ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Database or application connections transmit data using TLS in-transit encryption to maintain the confidentiality and integrity of information during reception. In-transit encryption is configured in the smisdbs17-E.cfg file using the -ec option and specifying the identity path+filename of the obfuscated TLS configuration file.

Check Text

If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, this is not a finding. If the DBMS, associated applications, and infrastructure do not employ protective measures against unauthorized disclosure and modification during reception, this is a finding.

Fix Text

Implement protective measures against unauthorized disclosure and modification during reception.

V-206609 CAT II When invalid inputs are received, the DBMS must behave in a ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Application-specific logic is implemented within the database using stored procedures, functions and triggers, where appropriate. Invalid inputs return appropriate error messages and statement execution is not committed to the database. Database code does properly validate data before it is put into the database or acted upon by the database. Development team confirms that code accounts for invalid inputs by capturing error codes and returning appropriate error messages to the user for corrective action.

Check Text

Review system documentation to determine how input errors are to be handled in general and if any special handling is defined for specific circumstances. Review the source code for database program objects (stored procedures, functions, triggers) and application source code to identify how the system responds to invalid input. If it does not implement the documented behavior, this is a finding.

Fix Text

Revise and deploy the source code for database program objects (stored procedures, functions, triggers) and application source code, to implement the documented behavior.

V-206610 CAT II When updates are applied to the DBMS software, any software ...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Software and components that are no longer used are removed during upgrades and installations.

Check Text

If software components that have been replaced or made unnecessary are not removed, this is a finding.

Fix Text

Identify and remove software components that have been replaced or made unnecessary.

V-206611 CAT II Security-relevant software updates to the DBMS must be insta...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Software patches are applied via MSC afloat operations patching schedule. Patches are sent to the Afloat environment via ESTA and are stored on a shared Drive. DBMS Patches and upgrades are rolled into, scheduled and tracked, as part of the application release schedule.

Check Text

Verify security-relevant software updates to the DBMS are installed within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs). If security-relevant software updates to the DBMS are not installed within 30 days unless the time period is directed by an authoritative source, this is a finding.

Fix Text

Install security-relevant software updates to the DBMS within 30 days unless the time period is directed by an authoritative source.

V-206612 CAT II The DBMS must be able to generate audit records when securit...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of successful permission checks on all objects which translates to a successful access to an object.

Check Text

If the DBMS architecture makes it impossible for any user, even with the highest privileges, to directly view or directly modify the contents of its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding. Review DBMS documentation to verify that audit records can be produced when security objects, such as tables, views, procedures, and functions, are accessed, to include reads, creations, modifications and deletions of data, and execution of logic. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects, such as tables, views, procedures, and functions, are accessed, to include reads, creations, modifications and deletions of data, and execution of logic. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when security objects, such as tables, views, procedures, and functions, are accessed. Configure the DBMS to produce audit records when security objects, such as tables, views, procedures, and functions, are accessed, to include reads, creations, modifications and deletions of data, and execution of logic.

V-206613 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of successful permission checks on all objects which translates to a successful access to an object.

Check Text

If the DBMS architecture makes it impossible for any user, even with the highest privileges, to directly view or directly modify the contents of its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding. Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to access security objects, such as tables, views, procedures, and functions, such access to include reads, creations, modifications and deletions of data, and execution of logic. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to access security objects, such as tables, views, procedures, and functions, such access to include reads, creations, modifications and deletions of data, and execution of logic. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to access security object. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete access to security objects, such as tables, views, procedures, and functions. Configure the DBMS to produce audit records when it denies access to security objects, such as tables, views, procedures, and functions, such access to include reads, creations, modifications and deletions of data, and execution of logic. Configure the DBMS to produce audit records when other errors prevent access to security objects, such as tables, views, procedures, and functions, such access to include reads, creations, modifications and deletions of data, and execution of logic.

V-206614 CAT II The DBMS must generate audit records when categories of info...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments ShipCLIP does not require compartmentalized data and data protection.

Check Text

Review DBMS documentation to verify that audit records can be produced when categories of information are accessed, to include reads, creations, modifications, and deletions. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when categories of information are accessed, to include reads, creations, modifications, and deletions. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when categories of information are accessed. Configure the DBMS to produce audit records when categories of information are accessed, to include reads, creations, modifications, and deletions.

V-206615 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments ShipCLIP does not require compartmentalized data and data protection.

Check Text

Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to access categories of information, such access to include reads, creations, modifications and deletions. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to access categories of information, such access to include reads, creations, modifications and deletions. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to access categories of information, such access to include reads, creations, modifications and deletions. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete access to categories of information. Configure the DBMS to produce audit records when it denies access to categories of information, such access to include reads, creations, modifications and deletions. Configure the DBMS to produce audit records when other errors prevent access to categories of information, such access to include reads, creations, modifications and deletions.

V-206616 CAT II The DBMS must generate audit records when privileges/permiss...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing when privileges and permissions are added.

Check Text

Review DBMS documentation to verify that audit records can be produced when privileges/permissions/role memberships are added. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when privileges/permissions/role memberships are added. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when privileges/permissions/role memberships are added. Configure the DBMS to produce audit records when privileges/permissions/role memberships are added.

V-206617 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of unsuccessful attempts to add privileges/permissions.

Check Text

Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to add privileges/permissions/role membership. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the DBMS denies the addition of privileges/permissions/role membership. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent the addition of privileges/permissions/role membership. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete attempts to add privileges/permissions/role membership. Configure the DBMS to produce audit records when it denies attempts to add privileges/permissions/role membership. Configure the DBMS to produce audit records when other errors prevent attempts to add privileges/permissions/role membership.

V-206618 CAT II The DBMS must generate audit records when privileges/permiss...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of when privileges/permissions are modified.

Check Text

If there is no distinction in the DBMS's security architecture between modifying permissions on the one hand, and adding and deleting permissions on the other hand, this is not a finding. Review DBMS documentation to verify that audit records can be produced when privileges/permissions/role memberships are modified. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when privileges/permissions/role memberships are modified. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when privileges/permissions/role memberships are modified. Configure the DBMS to produce audit records when privileges/permissions/role memberships are modified.

V-206619 CAT II The DBMS must generate audit records when unsuccessful attem...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of when unsuccessful attempts to modify privileges/permissions occur.

Check Text

If there is no distinction in the DBMS's security architecture between modifying permissions on the one hand, and adding and deleting permissions on the other hand, this is not a finding. Review DBMS documentation to verify that audit records can be produced when the system denies or fails to complete attempts to modify privileges/permissions/role membership. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when the system denies attempts to modify privileges/permissions/role membership. If they are not produced, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when other errors prevent attempts to modify privileges/permissions/role membership. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when it denies or fails to complete attempts to modify privileges/permissions/role membership. Configure the DBMS to produce audit records when it denies attempts to modify privileges/permissions/role membership. Configure the DBMS to produce audit records when other errors prevent attempts to modify privileges/permissions/role membership.

V-206620 CAT II The DBMS must generate audit records when security objects a...

1 asset 1 Closed Database Security Re...

Hostname	IP Address	Status	Assigned To	Last Scan	Actions
MONT-DB-002	-			2026-03-06
Finding Details No details recorded. Comments Page 2 of reference document SQL Anywhere 17 - Auditing Options.pdf specifies the types of auditing events captured in the audit log. A setting of ‘all’ includes auditing of DDL statements including when security objects are modified.

Check Text

If the DBMS architecture makes it impossible for any user, even with the highest privileges, to modify the structure and logic of its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding. Review DBMS documentation to verify that audit records can be produced when security objects are modified. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects are modified. If they are not produced, this is a finding.

Fix Text

Deploy a DBMS capable of producing the required audit records when security objects, such as tables, views, procedures, and functions, are modified. Configure the DBMS to produce audit records when security objects, such as tables, views, procedures, and functions, are modified.

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Check Text

Fix Text