| CCC.RDMS.CN01 | Password Management | Ensure default vendor-supplied DB administrator credentials are replaced with strong, unique passwords and that these credentials are properly managed using a secure password or secrets management solution. | Access Control | 1 | 2 | 1 |
| CCC.RDMS.CN02 | Account Lockout and Rate-Limiting | Ensure the database enforces lockouts or rate-limiting after a specified number of failed authentication attempts. This prevents brute force or password-guessing attacks from succeeding. | Access Control | 1 | 2 | 1 |
| CCC.RDMS.CN04 | Access Control for Backup and Restore Operations | Restrict who can initiate, manage, and validate database backup or restore operations through strict role-based or least-privilege access. Prevents accidental or malicious restorations, protecting data integrity and availability. | Access Control | 1 | 2 | 1 |
| CCC.RDMS.CN05 | Restrict Snapshot Sharing to Authorized Accounts | Ensure database snapshots can only be shared with explicitly authorized accounts, thereby minimizing the risk of data exposure or exfiltration. | Access Control | 1 | 2 | 1 |
| CCC.RDMS.CN06 | Apply Database Engine Security Patches | Ensure that the database engine runs a supported version and receives security patches automatically, so that published engine vulnerabilities cannot be exploited against the instance. | Compute | 1 | 0 | 2 |
| CCC.RDMS.CN07 | Enforce Least Privilege Within the Database | Ensure that database roles and grants inside the engine give each login only the privileges its function requires, so that one compromised login cannot read or modify every schema. | Access Control | 1 | 0 | 2 |
| CCC.RDMS.CN08 | Authenticate Users with Cloud Identity | Ensure that database users authenticate with short-lived tokens issued to cloud identity principals, so that no long-lived password exists to be exposed and reused. | Access Control | 1 | 0 | 2 |
| CCC.RDMS.CN09 | Reset Session State Between Pooled Connections | Ensure that a managed connection pool clears session-level state before handing a server connection to another client, so that no client observes or acts on state set by a previous client. | Data Resilience | 1 | 0 | 1 |
| CCC.RDMS.CN11 | Apply Primary Protections to Read Replicas | Ensure that every read replica carries the same public access restriction and network access rules as its primary, so that the replicated data is not reachable under weaker protection. | Data Resilience | 1 | 0 | 2 |
| CCC.RDMS.CN12 | Prevent Data Loss During Failover | Ensure that automatic failover promotes a standby that holds every committed transaction and that the former primary stops accepting writes, so that failover does not lose or fork data. | Data Resilience | 1 | 0 | 2 |