Every database lives on a database server. Findings checks data protection: PII/PHI/PCI data must be encrypted and classified, and databases that require backup must be on a server that has a backup solution.