Quality Database Security Metrics Fellow DBAs and Engineers,
I'm looking for few quality Database security metrics. Purpose of these metric is to demonstrate level of security provided to database schemas in the organisation. Specifically, I'm looking for security metrics which can show state of confidentiality and integrity provided to the DBs in the environment.
As an example:

Percentage of DBs encrypted and Redacted.
Percentage of DBs hosting PII information.


Metric request is platform agnostic but mostly pertaining to Oracle environment in hosted DB environment.
Let me know if you have any questions.
Regards
~ RS
The only way to get to what you're looking for is through an audit process of some kind, using a pre-defined checklist like the DISA STIG or CIS or some other recognized benchmark. These will all include a variety (even a majority) of &quot;metrics&quot; about documentation and policy that can't be measured through automation, so don't think there's an easy way to do this to get meaningful results.
There are whole areas of research and organization dedicated to how to approach this on a complete infrastructure or system level, like the Risk Management Framework. There are also legal requirements to evaluate against if your system is covered by the Fair Credit Reporting Act, Graham-Beach-Bliley Act, Children's Online Privacy Protection Act, The Health Information Technology for Economic and Clinical Health Act, HIPPA, the Federal Information Security Act of 2002, or GDPR. These carry their own auditing requirements.
It's also important to recognize that a system or application's security is about all layers of that system: database; operating systems; application servers; web servers; application code; network infrastructure; storage; authentication and authorization; and even user and admin training. All must be evaluated from top to bottom to get anything close to a complete picture. Even then with these checklists all you're really demonstrating is what you've prepared for / hardened against; there's no absolute measure of a system's security, per se.