CIS Oracle Cloud Infrastructure Foundations Benchmark
Secure configuration guidelines for Oracle Cloud Infrastructure (OCI)
v2.0.0 December 2024Overview
▶This CIS Benchmark provides prescriptive guidance for establishing a secure configuration posture for Oracle Cloud Infrastructure (OCI). Recommendations cover identity and access management, networking, compute, storage, database, and logging and monitoring.
| Section | Area | Focus |
|---|---|---|
| 1 | IAM | Policies, MFA, federation |
| 2 | Networking | VCN, gateways, flow logs |
| 3 | Compute | Instances, shielded, metadata |
| 4 | Storage | Object, block, file |
| 5 | Database | Autonomous DB, Data Guard |
| 6 | Logging | Audit, Cloud Guard |
Profile Definitions
▶| Profile | Description | Intended Use |
|---|---|---|
| L1 | Level 1 — Standard | Essential security for all Oracle Cloud Infrastructure deployments; minimal performance impact. |
| L2 | Level 2 — Hardened | Advanced hardening for PCI-DSS, HIPAA, or high-security environments. |
1 — Identity & Access Management
▶1.1 IAM Policies
▶This recommendation verifies that Service-Level Admins Are Created for Each Compartment on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Service-Level Admins Are Created for Each Compartment:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Service-Level Admins Are Created for Each Compartment:
oci iam ... update ...
This recommendation verifies that Multi-Factor Authentication Is Enabled for All Users on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Multi-Factor Authentication Is Enabled for All Users:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Multi-Factor Authentication Is Enabled for All Users:
oci iam ... update ...
This recommendation verifies that API Keys Are Rotated Within 90 Days on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that API Keys Are Rotated Within 90 Days:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure API Keys Are Rotated Within 90 Days:
oci iam ... update ...
This recommendation verifies that No Policy Statements Allow All Resources in Tenancy on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that No Policy Statements Allow All Resources in Tenancy:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure No Policy Statements Allow All Resources in Tenancy:
oci iam ... update ...
This recommendation ensures that IAM Password Policy Requires Minimum 14 Characters on the Oracle Cloud Infrastructure cloud platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Oracle Cloud Infrastructure cloud platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Use the OCI CLI or Console and verify that IAM Password Policy Requires Minimum 14 Characters:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure IAM Password Policy Requires Minimum 14 Characters:
oci iam ... update ...
1.2 Authentication & Federation
▶This recommendation verifies that Identity Provider Federation Is Configured on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Identity Provider Federation Is Configured:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Identity Provider Federation Is Configured:
oci iam ... update ...
This recommendation verifies that Auth Tokens Are Rotated Regularly on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Auth Tokens Are Rotated Regularly:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Auth Tokens Are Rotated Regularly:
oci iam ... update ...
This recommendation verifies that Customer Secret Keys Are Rotated Within 90 Days on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Customer Secret Keys Are Rotated Within 90 Days:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Customer Secret Keys Are Rotated Within 90 Days:
oci iam ... update ...
This recommendation verifies that Dynamic Groups Are Scoped Narrowly on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Dynamic Groups Are Scoped Narrowly:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Dynamic Groups Are Scoped Narrowly:
oci iam ... update ...
2 — Networking
▶2.1 VCN Configuration
▶This recommendation verifies that No Security List Allows Ingress from 0.0.0.0/0 to Port 22 on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that No Security List Allows Ingress from 0.0.0.0/0 to Port 22:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure No Security List Allows Ingress from 0.0.0.0/0 to Port 22:
oci iam ... update ...
This recommendation verifies that No Security List Allows Ingress from 0.0.0.0/0 to Port 3389 on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that No Security List Allows Ingress from 0.0.0.0/0 to Port 3389:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure No Security List Allows Ingress from 0.0.0.0/0 to Port 3389:
oci iam ... update ...
This recommendation verifies that Default Security Lists Restrict All Traffic on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Default Security Lists Restrict All Traffic:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Default Security Lists Restrict All Traffic:
oci iam ... update ...
This recommendation verifies that Network Security Groups Are Used on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that Network Security Groups Are Used:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Network Security Groups Are Used:
oci iam ... update ...
2.2 Gateways & Connectivity
▶This recommendation ensures that Internet Gateway Is Attached Only Where Required on the Oracle Cloud Infrastructure cloud platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Oracle Cloud Infrastructure cloud platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Use the OCI CLI or Console and verify that Internet Gateway Is Attached Only Where Required:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Internet Gateway Is Attached Only Where Required:
oci iam ... update ...
This recommendation verifies that NAT Gateway Is Used for Private Subnet Egress on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that NAT Gateway Is Used for Private Subnet Egress:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure NAT Gateway Is Used for Private Subnet Egress:
oci iam ... update ...
This recommendation verifies that Service Gateway Is Configured for OCI Services on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Service Gateway Is Configured for OCI Services:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Service Gateway Is Configured for OCI Services:
oci iam ... update ...
This recommendation verifies that VCN Flow Logs Are Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that VCN Flow Logs Are Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure VCN Flow Logs Are Enabled:
oci iam ... update ...
3 — Compute
▶3.1 Instance Configuration
▶This recommendation verifies that Instances Use Shielded Instances on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that Instances Use Shielded Instances:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Instances Use Shielded Instances:
oci iam ... update ...
This recommendation verifies that Instance Metadata Service v2 Is Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Instance Metadata Service v2 Is Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Instance Metadata Service v2 Is Enabled:
oci iam ... update ...
This recommendation verifies that Legacy Instance Metadata Endpoint Is Disabled on the Oracle Cloud Infrastructure cloud platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Oracle Cloud Infrastructure cloud platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Use the OCI CLI or Console and verify that Legacy Instance Metadata Endpoint Is Disabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Legacy Instance Metadata Endpoint Is Disabled:
oci iam ... update ...
This recommendation verifies that OS Management Service Agent Is Configured on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that OS Management Service Agent Is Configured:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure OS Management Service Agent Is Configured:
oci iam ... update ...
3.2 Instance Access
▶This recommendation verifies that SSH Keys Are Managed Securely on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that SSH Keys Are Managed Securely:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure SSH Keys Are Managed Securely:
oci iam ... update ...
This recommendation verifies that Serial Console Access Is Disabled on the Oracle Cloud Infrastructure cloud platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Oracle Cloud Infrastructure cloud platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Use the OCI CLI or Console and verify that Serial Console Access Is Disabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Serial Console Access Is Disabled:
oci iam ... update ...
This recommendation verifies that Bastion Service Is Used for Administrative Access on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that Bastion Service Is Used for Administrative Access:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Bastion Service Is Used for Administrative Access:
oci iam ... update ...
4 — Storage
▶4.1 Object Storage
▶This recommendation verifies that Object Storage Buckets Are Not Public on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Object Storage Buckets Are Not Public:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Object Storage Buckets Are Not Public:
oci iam ... update ...
This recommendation verifies that Object Storage Encryption Uses Customer-Managed Keys on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that Object Storage Encryption Uses Customer-Managed Keys:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Object Storage Encryption Uses Customer-Managed Keys:
oci iam ... update ...
This recommendation verifies that Object Storage Versioning Is Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Object Storage Versioning Is Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Object Storage Versioning Is Enabled:
oci iam ... update ...
This recommendation verifies that Object Storage Lifecycle Policies Are Configured on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Object Storage Lifecycle Policies Are Configured:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Object Storage Lifecycle Policies Are Configured:
oci iam ... update ...
4.2 Block & File Storage
▶This recommendation verifies that Block Volume Encryption Uses Customer-Managed Keys on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that Block Volume Encryption Uses Customer-Managed Keys:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Block Volume Encryption Uses Customer-Managed Keys:
oci iam ... update ...
This recommendation verifies that Block Volume Backups Are Configured on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Block Volume Backups Are Configured:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Block Volume Backups Are Configured:
oci iam ... update ...
This setting ensures that File Storage Exports Are Restricted on the Oracle Cloud Infrastructure cloud platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Oracle Cloud Infrastructure cloud platform is essential for defense in depth.
Use the OCI CLI or Console and verify that File Storage Exports Are Restricted:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure File Storage Exports Are Restricted:
oci iam ... update ...
5 — Database
▶5.1 Autonomous & DB Systems
▶This recommendation verifies that Autonomous Database Private Endpoint Is Configured on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Autonomous Database Private Endpoint Is Configured:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Autonomous Database Private Endpoint Is Configured:
oci iam ... update ...
This recommendation verifies that Database Encryption Uses Customer-Managed Keys on the Oracle Cloud Infrastructure cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Oracle Cloud Infrastructure cloud platform uses the correct component aligns with industry best practices and standards.
Use the OCI CLI or Console and verify that Database Encryption Uses Customer-Managed Keys:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Database Encryption Uses Customer-Managed Keys:
oci iam ... update ...
This recommendation verifies that Data Guard Is Configured for Critical Databases on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Data Guard Is Configured for Critical Databases:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Data Guard Is Configured for Critical Databases:
oci iam ... update ...
This recommendation verifies that Automatic Backups Are Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Automatic Backups Are Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Automatic Backups Are Enabled:
oci iam ... update ...
5.2 Database Access
▶This setting ensures that Database Access Is Restricted to Private Subnets on the Oracle Cloud Infrastructure cloud platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Oracle Cloud Infrastructure cloud platform is essential for defense in depth.
Use the OCI CLI or Console and verify that Database Access Is Restricted to Private Subnets:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Database Access Is Restricted to Private Subnets:
oci iam ... update ...
This recommendation verifies that Database Audit Is Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Database Audit Is Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Database Audit Is Enabled:
oci iam ... update ...
This recommendation verifies that Database Patching Is Current on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Database Patching Is Current:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Database Patching Is Current:
oci iam ... update ...
6 — Logging & Monitoring
▶6.1 Audit & Logging
▶This recommendation verifies that Audit Log Retention Is Set to 365 Days on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Audit Log Retention Is Set to 365 Days:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Audit Log Retention Is Set to 365 Days:
oci iam ... update ...
This recommendation verifies that Audit Configuration Changes Are Monitored on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Audit Configuration Changes Are Monitored:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Audit Configuration Changes Are Monitored:
oci iam ... update ...
This recommendation verifies that Service Connector Hub Is Configured for Log Export on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Service Connector Hub Is Configured for Log Export:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Service Connector Hub Is Configured for Log Export:
oci iam ... update ...
6.2 Monitoring & Notifications
▶This recommendation verifies that Cloud Guard Is Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Cloud Guard Is Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Cloud Guard Is Enabled:
oci iam ... update ...
This recommendation verifies that Notification Topics Are Configured for Critical Events on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Notification Topics Are Configured for Critical Events:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Notification Topics Are Configured for Critical Events:
oci iam ... update ...
This recommendation verifies that Security Zone Is Configured on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Security Zone Is Configured:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Security Zone Is Configured:
oci iam ... update ...
This recommendation verifies that Vulnerability Scanning Service Is Enabled on the Oracle Cloud Infrastructure cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Oracle Cloud Infrastructure cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the OCI CLI or Console and verify that Vulnerability Scanning Service Is Enabled:
oci iam ... list --compartment-id <compartment_ocid>
Use the OCI CLI or Console to configure Vulnerability Scanning Service Is Enabled:
oci iam ... update ...