Frameworks and Connectors
CIS Oracle Cloud Infrastructure Foundations Benchmark and connectors
Which connectors provide evidence for CIS Oracle Cloud Infrastructure Foundations Benchmark, for which controls, and how to connect them.
Safeguard's automated tests map to 51 recommendations of CIS Oracle Cloud Infrastructure Foundations Benchmark v3.0.0. 40 tests apply: 40 read a connected system, and 0 read Safeguard's own records (policies, people, training and devices), so they need no connector. A passing result is evidence toward a control, not proof that the control is met on its own.
A CIS benchmark is a catalogue mapping: results show on the tests, filters and evidence with their recommendation numbers, and the benchmark is not a framework in your library.
How to connect for this framework
- Connect the systems you run from the table below. Each connector links to its setup steps.
- Open Compliance › Tests and filter by the benchmark to see its results.
- Tests run on their schedule, or straight away with Run now on Compliance › Tests. A passing test counts toward its controls once its preview period has ended.
Automated tests are switched on per workspace by the Safeguard team.
Connectors with automated evidence (1)
| Connector | Controls it provides evidence for | Tests |
|---|---|---|
| Oracle Cloud (also Oracle Cloud Government) | 1.10, 1.12, 1.13, 1.15, 1.16, 1.17, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 3.1, 3.2, 3.3, 4.1, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 5.1.1, 5.1.2, 5.1.3, 5.2.1, 5.2.2, 5.3.1, 6.1, 6.2 | 40 |
Recommendations (51)
| Recommendation | Title | Automated tests | Connectors |
|---|---|---|---|
1.2 | Only the Administrators group may manage every resource | 1 | 2 |
1.3 | Delegated IAM administrators cannot change the Administrators group | 1 | 2 |
1.4 | Passwords must be at least 14 characters long | 1 | 2 |
1.5 | Passwords expire within one year | 1 | 2 |
1.6 | Earlier passwords cannot be reused | 1 | 2 |
1.7 | Every Console user with a password uses MFA | 1 | 2 |
1.8 | User API keys are replaced at least every 90 days | 1 | 2 |
1.9 | Customer secret keys are replaced at least every 90 days | 1 | 2 |
1.10 | Auth tokens are replaced at least every 90 days | 1 | 2 |
1.12 | Tenancy administrators hold no API keys | 1 | 2 |
1.13 | Local users have a verified email address | 1 | 2 |
1.15 | Storage administrators cannot delete the resources they manage | 1 | 2 |
1.16 | Credentials idle for 45 days are disabled | 1 | 2 |
1.17 | A user has at most one active API key | 1 | 2 |
2.1 | Security lists do not admit 0.0.0.0/0 on port 22 | 1 | 2 |
2.2 | Security lists do not admit 0.0.0.0/0 on port 3389 | 1 | 2 |
2.3 | Network security groups do not admit 0.0.0.0/0 on port 22 | 1 | 2 |
2.4 | Network security groups do not admit 0.0.0.0/0 on port 3389 | 1 | 2 |
2.5 | The default security list allows only ICMP inside the VCN | 1 | 2 |
2.6 | Integration Cloud network access is restricted | 1 | 2 |
2.7 | Analytics Cloud network access is restricted | 1 | 2 |
2.8 | Shared Autonomous Databases are restricted to allowed sources or a VCN | 1 | 2 |
3.1 | Legacy instance metadata endpoints are off | 1 | 2 |
3.2 | Instances boot with Secure Boot | 1 | 2 |
3.3 | Boot volume traffic is encrypted in transit | 1 | 2 |
4.1 | Default tags record the creating principal | 1 | 2 |
4.2 | A notification topic has a confirmed subscription | 1 | 2 |
4.3 | Identity provider changes raise a notification | 1 | 2 |
4.4 | Identity provider group mapping changes raise a notification | 1 | 2 |
4.5 | IAM group changes raise a notification | 1 | 2 |
4.6 | IAM policy changes raise a notification | 1 | 2 |
4.7 | User changes raise a notification | 1 | 2 |
4.8 | VCN changes raise a notification | 1 | 2 |
4.9 | Route table changes raise a notification | 1 | 2 |
4.10 | Security list changes raise a notification | 1 | 2 |
4.11 | Network security group changes raise a notification | 1 | 2 |
4.12 | Network gateway changes raise a notification | 1 | 2 |
4.13 | Every subnet has VCN flow logging | 1 | 2 |
4.14 | Cloud Guard is enabled in the root compartment | 1 | 2 |
4.15 | Cloud Guard problems raise a notification | 1 | 2 |
4.16 | Customer-managed keys are rotated at least yearly | 1 | 2 |
4.17 | Bucket writes are logged | 1 | 2 |
4.18 | Local user sign-ins raise a notification | 1 | 2 |
5.1.1 | No Object Storage bucket is publicly visible | 1 | 2 |
5.1.2 | Object Storage buckets use a customer-managed key | 1 | 2 |
5.1.3 | Object Storage buckets keep object versions | 1 | 2 |
5.2.1 | Block volumes use customer-managed keys | 1 | 2 |
5.2.2 | Boot volumes use customer-managed keys | 1 | 2 |
5.3.1 | File systems use customer-managed keys | 1 | 2 |
6.1 | Resources are organised in compartments | 1 | 2 |
6.2 | The root compartment holds no workloads | 1 | 2 |