The NIST Cybersecurity Framework gives clear guidance to identify, protect, detect, respond, and recover. But for databases, the most overlooked part is role design and access control. In practice, mapping the NIST CSF to database roles means reducing permissions to the minimum required, enforcing role-based access control (RBAC), and aligning