STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must provide a mechanism to automatically remove or disable temporary user accounts after 72 hours.

DISA Rule

SV-270547r1064919_rule

Vulnerability Number

V-270547

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-012100

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

If using database mechanisms to satisfy this requirement, use a profile with a distinctive name (for example, TEMPORARY_USERS), so that temporary users can be easily identified. Whenever a temporary user account is created, assign it to this profile.

Create a job to lock accounts under this profile that are more than 72 hours old.

Check Contents

If the organization has a policy, consistently enforced, forbidding the creation of emergency or temporary accounts, this is not a finding.

If all user accounts are authenticated by the OS or an enterprise-level authentication/access mechanism, and not by Oracle, this is not a finding.

Check database management system (DBMS) settings, OS settings, and/or enterprise-level authentication/access mechanisms settings to determine if the site uses a mechanism whereby temporary are terminated after a 72-hour time period. If not, this is a finding.

Vulnerability Number

V-270547

Documentable

False

Rule Version

O19C-00-012100

Severity Override Guidance

Check Content Reference

Target Key

5672