DB admin tools on-demand and Zero Trust protected

Severity: Critical

This is a guided manual check.

Prompt user:

How do you manage database admin tools (phpMyAdmin, Adminer, pgAdmin)?

Please provide:

1. What tool is used (if any)
2. How it's deployed (always-on, on-demand, separate service)
3. How access is protected (Zero Trust, VPN, IP whitelist)
4. Who can spin it up and when it's turned off

Verify:

• Tool is not always running in production
• Protected behind Cloudflare Zero Trust when active
• Clear process for spinning up and down

Pass criteria:

• No DB admin tool used, OR
• Tool is on-demand only AND behind Zero Trust

Fail criteria:

• DB admin tool running 24/7 in production
• No access protection when active

Evidence to capture:

• Tool used
• Deployment method
• Zero Trust policy or equivalent protection
• Access procedure

Cross-reference with:

• Section 04 (Environments) - Zero Trust for dev/staging

---