Database / Relational / Controls / v2026.11
Account Lockout and Rate-Limiting
CCC.RDMS.CN02 · Access Control
Ensure the database enforces lockouts or rate-limiting after a specified number of failed authentication attempts. This prevents brute force or password-guessing attacks from succeeding.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.RDMS.CP07 | DB Self Managed Credentials | The service always supports database users authenticated by a username and password that the user creates and manages. |
| CCC.RDMS.CP08 | Support for IPv4 | The service always exposes an IPv4 endpoint through which clients connect to the database. |
| CCC.RDMS.CP09 | Support for IPv6 | The service may be configured to expose an IPv6 endpoint through which clients connect to the database. |
Related Threats
| ID | Title | Description |
|---|
| CCC.RDMS.TH02 | Brute Force Attempts on Database Authentication | Repeated attempts to guess database user passwords may be made through brute force techniques. This condition could result in unauthorized access if successful, compromising database security and sensitive information. Attempts arrive over whichever IPv4 or IPv6 endpoint the network access rules leave reachable. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.RDMS.CN02.AR01 | When repeated failed login attempts are made in a short timeframe, the account MUST be locked out or rate-limited to prevent further login attempts. | tlp-amber, tlp-red |