Security
Security readiness is based on layered controls: physical barriers, continuous monitoring, alarmed entrances, and auditable access into every Oracle-occupied area.
| Security Domain | Requirement | Key Value |
|---|---|---|
| Staffing and monitoring | Provide 24x7x365 security monitoring by dedicated, trained security personnel. | Security staff must not serve a dual role. |
| Logs and evidence | Retain visitor, badge, alarm, and video records that support audit and incident review. | Retain visitor and access logs for at least 3 months. Retain CCTV footage for at least 90 days. |
| Alarm response | Doors must alarm on abnormal conditions, and security must respond quickly. | Target 15-minute physical response and preliminary email notification within 30 minutes of awareness. |
| Access model | Use a layered access design with multiple security boundaries and dual authentication. | Use at least three security layers. Badge plus biometric authentication is preferred for ingress to Oracle space. |