STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must isolate security functions from nonsecurity functions by means of separate security domains.

DISA Rule

SV-270576r1065006_rule

Vulnerability Number

V-270576

Group Title

SRG-APP-000233-DB-000124

Rule Version

O19C-00-017100

Severity

CAT II

CCI(s)

CCI-001084 - Isolate security functions from nonsecurity functions.

Weight

Fix Recommendation

Locate security-related database objects and code in a separate database, schema, or other separate security domain from database objects and code implementing application logic. (This is the default behavior for Oracle.) Review any site-specific applications security modules built into the database: determine what schema they are located in and take appropriate action.

Check Contents

Check DBMS settings to determine whether objects or code implementing security functionality are located in a separate security domain, such as a separate database or schema created specifically for security functionality.

If security-related database objects or code are not kept separate, this is a finding.

The Oracle elements of security functionality, such as the roles, permissions, and profiles, along with password complexity requirements, are stored in separate schemas in the database. Review any site-specific applications security modules built into the database and determine what schema they are located in and take appropriate action. The Oracle objects will be in the Oracle Data Dictionary.

Vulnerability Number

V-270576

Documentable

False

Rule Version

O19C-00-017100

Severity Override Guidance

Check Content Reference

Target Key

5672