STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

The Oracle Database data files, transaction logs and audit files must be stored in dedicated directories or disk partitions separate from software or other application files.

DISA Rule

SV-270538r1064892_rule

Vulnerability Number

V-270538

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-010800

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Specify dedicated host system disk directories to store database data, transaction and audit files.

Example directory structure:
/*/app/oracle/oradata/db_name
/*/app/oracle/admin/db_name/arch/*
/*/app/oracle/oradata/db_name/audit
/*/app/oracle/fast_recovery_area/db_name/

When multiple applications are accessing a single database, configure DBMS default file storage according to application to use dedicated disk directories.

/*/app/oracle/oradata/db_name/app_name

Refer to Oracle Optimal Flexible Architecture:
https://docs.oracle.com/en/database/oracle/oracle-database/19/ladbi/optimal-flexible-architecture.html

Check Contents

Review the disk/directory specification where database data, transaction log and audit files are stored.

If DBMS data, transaction log or audit data files are stored in the same directory, this is a finding.

If multiple applications are accessing the database and the database data files are stored in the same directory, this is a finding.

If multiple applications are accessing the database and database data is separated into separate physical directories according to application, this check is not a finding.

Vulnerability Number

V-270538

Documentable

False

Rule Version

O19C-00-010800

Severity Override Guidance

Check Content Reference

Target Key

5672