openskills.info
Course catalog
Course Preview

Database Auditing and Compliance

Database auditing records who accessed or changed database resources, what they did, when it happened, and whether it succeeded. Compliance work turns those records into protected, reviewable evidence that specific security and privacy requirements are operating as intended.

itDatabases and data storage

Database Auditing and Compliance

Database auditing is the controlled recording and examination of activity that affects a database. It answers questions such as who connected, which identity issued a statement, which object the statement touched, what result occurred, and when the event happened. Compliance uses that evidence to show that required controls exist and operate over time.

An audit trail is not the same as a transaction log. A transaction log supports database recovery and consistency. An audit trail supports accountability, investigation, and control assessment. A monitoring dashboard can show current health, but it does not automatically provide durable evidence. The same event may feed monitoring, detection, investigation, and compliance, but each use has different requirements for scope, protection, retention, and review.

From requirement to evidence

A defensible audit program forms a chain:

  1. A law, standard, contract, or internal risk decision creates a requirement.
  2. A control objective translates that requirement into observable behavior.
  3. An audit policy selects the database events and identities that must be recorded.
  4. The database engine, proxy, cloud service, or application produces records.
  5. A protected pipeline collects, normalizes, stores, and retains those records.
  6. Detection rules and scheduled reviews examine the records.
  7. Evidence packages connect records, policy, review results, and remediation to the control objective.

The requirement rarely says which database switch to enable. HIPAA, for example, requires mechanisms that record and examine activity in systems containing electronic protected health information. NIST SP 800-53 separates audit-event selection, record content, generation, review, storage capacity, time synchronization, protection, and retention into related controls. PCI DSS Requirement 10 addresses logging and monitoring access to system components and cardholder data. These sources define outcomes. Database and platform documentation defines the mechanisms that can produce evidence for those outcomes.

Compliance is therefore not a product mode. Enabling an audit feature creates records; it does not prove that event coverage matches the requirement, that the records cannot be altered by the subjects being audited, that reviews occur, or that exceptions are resolved.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources