Database Management

Database Management, in the ISACA-CISA context, is the operational discipline of ensuring that databases—the structured repositories underlying virtually all business applications—function reliably, securely, and in compliance with defined service levels and regulatory requirements. It encompasses four interdependent control domains: (1) Availability Management—maintaining uptime, failover, and replication to meet SLA targets; (2) Security Controls—enforcing access restrictions, encryption at rest and in transit, privileged access management (PAM), and audit logging; (3) Backup and Recovery—executing and testing backup schedules aligned to negotiated RPO and RTO, and validating restoration procedures; and (4) Performance Monitoring—tracking query throughput, capacity utilization, and response times to prevent degradation-driven outages. From an auditor's perspective, Database Management is the set of controls and procedures an organization has implemented to ensure its databases remain available, protected, and recoverable under both normal and adverse conditions. It is NOT: database design or schema architecture, SQL development or query optimization, data science or analytics engineering, or vendor-specific product administration.