If MongoDB supports only software development, experimentation and/or developer-level testing (that is, excluding production systems, integration testing, stress testing, and user acceptance testing), this is not a finding. MongoDB can control nonadministrative users' ability to create, alter, or replace logic modules by defining specific roles and permissions. While MongoDB does not directly support stored procedures, functions, triggers, and views in the way relational databases do, similar functionalities can be implemented using various features. An organizational or site-specific document should exist and be reviewed to determine what built-in MongoDB roles and associated privileges may be considered authorized and what users are administrative users. For each database, run the following commands in MongoDB as an administrative user to determine what users and roles they are assigned: > use <database> > db.getUsers() For any nonadministrative user in a database, check if any roles are not compliant with the site-specific documentation for users. If any user in any database is found to have a role that is not allowed, this is a finding. MongoDB allows users to store JavaScript functions on the server. Javascript should be disabled for all users. Review the Mongodb configuration file (default location /etc/mongod.conf) and ensure the following is set to disable JavaScript: security: javascriptEnabled: false If this is not set in the MongoDB configuration file, this is a finding.