Oracle Cloud Infrastructure security audit
Fewer firms review Oracle Cloud Infrastructure in depth. We audit your tenancy against the CIS Oracle Cloud Infrastructure Foundations Benchmark and review the compartment design and IAM policy statements that decide who can do what.
Who it is for
- Organizations running Oracle databases and applications on OCI.
- Multi-cloud estates where OCI sits alongside AWS or Azure.
- Organizations with data residency requirements, including in the Middle East.
What we assess
- Tenancy and compartment structure, and how environments are separated.
- IAM policy statements, groups and dynamic groups, console multi-factor authentication and API key age.
- Cloud Guard and Security Zones: whether they are enabled and acted on.
- Virtual cloud network security lists and network security groups open to the internet.
- Object Storage buckets with public access or pre-authenticated requests.
- Vault keys, encryption and audit logging.
What you receive
- CIS OCI Foundations Benchmark results, reviewed by hand.
- An IAM policy review that translates each risky statement into plain language.
- Findings that name the exact policy or setting to change.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two weeks for one tenancy.
Common questions
What access do you need?
A read-only auditor group with inspect and read permissions at tenancy level. We send the exact policy statements in advance.
Can you check data residency?
Yes. We list which regions hold which data and compare that with the residency rules you are under, such as the Saudi NCA Cloud Cybersecurity Controls.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Oracle Cloud security audit
We reply within one business day.
Nothing you send is shared outside Calibre.