Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

Database Security Requirements Guide

The Database Security Requirements Guide (V4 R6) has 142 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

142STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V4 · R6

CurrentPublished Wed Sep 30 2026

The DBMS must initiate session auditing upon startup.

Database Security Requirements Guide

Assessment Title

Rule Text

Description

Discussion Text

Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time the DBMS is running.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-206527

Rule

SV-206527r960888_rule

Severity

medium

Rule Version

SRG-APP-000092-DB-000208

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review DBMS vendor documentation to determine whether the DBMS software is capable of session auditing.

If the DBMS is not capable of session auditing and a third party product is not being used for session level auditing, this is a finding.

If the DBMS is capable of session level auditing and specific session audits are currently defined but session auditing is not enabled; or if a third-party product is available for session auditing and specific session audits are currently defined but session auditing is not enabled, this is a finding.

Implementation Procedure

Fix Text

Deploy a DBMS capable of session auditing.

Configure the DBMS software or third-party product to enable session auditing.

STIG check 9 of 142 in the Database Security Requirements Guide checklist

← Previous · V-206526The DBMS must be able to generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.Next · V-206528 →The DBMS must produce audit records containing sufficient information to establish what type of events occurred.