The DBMS must generate audit records when security objects are deleted.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-206626 | SRG-APP-000501-DB-000336 | SV-206626r961818_rule | CCI-000172 | medium |
| Description | ||||
| The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged. | ||||
| STIG | Date | |||
| Database Security Requirements Guide | 2024-12-04 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AU-12
1.00
- DISA · 4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.3.1
1.00
- DISA · 4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.3.2
1.00
- DISA · 4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000172
1.00
- DISA · 4 · disa_xccdf · related
Details
Check Text (C-206626r961818_chk)
If the DBMS architecture makes it impossible for any user, even with the highest privileges, to drop its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding.
Review DBMS documentation to verify that audit records can be produced when security objects are drop.
If the DBMS is not capable of this, this is a finding.
Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects are drop.
If they are not produced, this is a finding.
Fix Text (F-6886r291547_fix)
Deploy a DBMS capable of producing the required audit records when security objects are deleted.
Configure the DBMS to produce audit records when security objects are deleted.