STIGQter STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

A minimum of three Oracle Control Files must be created and each stored on a separate physical and logical device.

DISA Rule

SV-275999r1115962_rule

Vulnerability Number

V-275999

Group Title

SRG-APP-000516-DB-000363

Rule Version

O19C-00-020500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To prevent loss of service during disk failure, multiple copies of Oracle control files must be maintained on separate disks in archived directories or on separate, archived directories within one or more RAID devices.

Adding or moving a control file requires careful planning and execution.

Consult and follow the instructions for creating control files in the Oracle Database Administrator's Guide, under Steps for Creating New Control Files.

Check Contents

Use the SQL statement below to obtain information on each currently existing Control File:

SELECT name
FROM sys.v$controlfile
ORDER BY 1;

Oracle Best Practice:
Oracle recommends a minimum of three Oracle Control Files and each stored on a separate physical and logical device (RAID 1 + 0).

DOD guidance recommends:
Each control file must be located on a separate physical and logical (virtual) storage device.

Consult with the storage administrator, system administrator, or database administrator to determine whether the mount points or partitions referenced in the file paths indicate separate physical disks or directories on RAID devices.

Note: Distinct does not equal dedicated. May share directory space with other Oracle database instances if present.

If the minimum of three control files is not met, this is a finding.

Vulnerability Number

V-275999

Documentable

False

Rule Version

O19C-00-020500

Severity Override Guidance

Use the SQL statement below to obtain information on each currently existing Control File:

SELECT name
FROM sys.v$controlfile
ORDER BY 1;

Oracle Best Practice:
Oracle recommends a minimum of three Oracle Control Files and each stored on a separate physical and logical device (RAID 1 + 0).

DOD guidance recommends:
Each control file must be located on a separate physical and logical (virtual) storage device.

Consult with the storage administrator, system administrator, or database administrator to determine whether the mount points or partitions referenced in the file paths indicate separate physical disks or directories on RAID devices.

Note: Distinct does not equal dedicated. May share directory space with other Oracle database instances if present.

If the minimum of three control files is not met, this is a finding.

Check Content Reference

M

Target Key

5672