STIGhubSTIGhub
STIGsRMF ControlsCompare
STIGhub— A free STIG search and compliance tool·STIGs updated 3 days ago
Powered by Pylon·Privacy·Terms·© 2026 Beacon Cloud Solutions, Inc.
← Back to Oracle Database 19c Security Technical Implementation Guide

V-275999

CAT II (Medium)

A minimum of three Oracle Control Files must be created and each stored on a separate physical and logical device.

Rule ID

SV-275999r1115962_rule

STIG

Oracle Database 19c Security Technical Implementation Guide

Version

V1R5

CCIs

CCI-000366

Discussion

Oracle control files store information critical to Oracle database integrity. Oracle uses these files to maintain time synchronization of database files and verify the validity of system data and log files at system startup. Loss of access to the control files can affect database availability, integrity, and recovery. Oracle Pluggable Databases (PDBs) do not contain their own control files; instead, all PDBs within a Container Database (CDB) share control files managed by the CDB.

Check Content

Use the SQL statement below to obtain information on each currently existing Control File:

SELECT name
FROM sys.v$controlfile
ORDER BY 1;

Oracle Best Practice:
Oracle recommends a minimum of three Oracle Control Files and each stored on a separate physical and logical device (RAID 1 + 0).  

DOD guidance recommends:
Each control file must be located on a separate physical and logical (virtual) storage device.

Consult with the storage administrator, system administrator, or database administrator to determine whether the mount points or partitions referenced in the file paths indicate separate physical disks or directories on RAID devices.

Note: Distinct does not equal dedicated. May share directory space with other Oracle database instances if present.

If the minimum of three control files is not met, this is a finding.

Fix Text

To prevent loss of service during disk failure, multiple copies of Oracle control files must be maintained on separate disks in archived directories or on separate, archived directories within one or more RAID devices.

Adding or moving a control file requires careful planning and execution.

Consult and follow the instructions for creating control files in the Oracle Database Administrator's Guide, under Steps for Creating New Control Files.