STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Changes to configuration options must be audited.

DISA Rule

SV-270540r1064898_rule

Vulnerability Number

V-270540

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-011300

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

For Standard auditing, from SQL*Plus:

alter system set audit_sys_operations = TRUE scope = spfile;

The above SQL*Plus command will set the parameter to take effect at next system startup.

If Unified Auditing is used, to ensure auditable events are captured:
Link the oracle binary with uniaud_on, and then restart the database. Oracle Database Upgrade Guide describes how to enable unified auditing.

For additional information on creating audit policies, refer to the Oracle Database Security Guide:
https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-audit-policies.html

Check Contents

For Unified or mixed auditing, from SQL*Plus:

select count(*) from audit_unified_enabled_policies where entity_name = 'SYS';

If the count is less than one row, this is a finding.

For Standard auditing, from SQL*Plus:

select value from v$parameter where name = 'audit_sys_operations';

If the value returned is FALSE, this is a finding.

Vulnerability Number

V-270540

Documentable

False

Rule Version

O19C-00-011300

Severity Override Guidance

For Unified or mixed auditing, from SQL*Plus:

select count(*) from audit_unified_enabled_policies where entity_name = 'SYS';

If the count is less than one row, this is a finding.

For Standard auditing, from SQL*Plus:

select value from v$parameter where name = 'audit_sys_operations';

If the value returned is FALSE, this is a finding.

Check Content Reference

M

Target Key

5672