You should take Security Requirements for DBMS into your consideration and document whatever practice you perform to apply these requirements. Ex: i. Access control: what model you used? How do you apply it? ii. User authentication: What mechanisms you used? How do you apply it? iii. Availability: What mechanisms you used? How do you apply it? iv. Auditability: What mechanisms you used? Which significant functions do you audit? How do you apply it? b. Provide your Database Backup and Recovery Strategy (disaster recovery plan, Database recovery, Business continuity plan).