2-BPM006737_AZRAMP Supplement - OCI Report.pdf

System and Organization Controls (SOC 2) Type 2 Report

Description of the Oracle Cloud Infrastructure System

For the Period October 1, 2023 to March 31, 2024

Prepared in Accordance with AICPA Attestation Standards and IAASB Standard ISAE No. 3000

Copyright © 2024, Oracle and/or its affiliates Confidential - Oracle Internal

1 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System Copyright © 2024, Oracle and/or its affiliates | Confidential - Oracle Internal

TABLE OF CONTENTS

SECTION I – ORACLE CLOUD INFRASTRUCTURE’S MANAGEMENT ASSERTION 2

SECTION II – INDEPENDENT SERVICE AUDITOR’S ASSURANCE REPORT 7

SECTION III – DESCRIPTION OF THE ORACLE CLOUD INFRASTRUCTURE SYSTEM 15

ORACLE OVERVIEW 15

ORACLE CLOUD INFRASTRUCTURE OVERVIEW 15

RELEVANT ASPECTS OF THE CONTROL ENVIRONMENT 39

INFORMATION AND COMMUNICATION 43

RISK ASSESSMENT 44

MONITORING 44

CONTROL ACTIVITIES 44

COMPLEMENTARY SUBSERVICE ORGANIZATION CONTROLS (CSOCS) 58

COMPLEMENTARY USER ENTITY CONTROLS (CUECS) 59

SECTION IV – ORACLE CLOUD INFRASTRUCTURE CONTROLS, TEST PROCEDURES, AND RESULTS OF

TESTING 67

DESCRIPTION OF CRITERIA, CONTROLS, TESTS, AND RESULTS OF TESTING 67

PROCEDURES FOR ASSESSING COMPLETENESS AND ACCURACY OF INFORMATION PROVIDED BY THE ENTITY 67

SECTION V – ADDITIONAL INFORMATION PROVIDED BY ORACLE CLOUD INFRASTRUCTURE 126

DOCUMENTATION 126

SECURITY PRACTICES 126

GENERAL DATA PROTECTION REGULATION 126

CONTRACTS AND POLICIES 126

2 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

World Headquarters 2300 Oracle Way Austin, TX 78741 Phone +1.737.867.1000 oracle.com

SECTION I – ORACLE CLOUD INFRASTRUCTURE’S MANAGEMENT

ASSERTION

We have prepared the accompanying description titled “Description of the Oracle Cloud Infrastructure System” (Description) of Oracle Cloud Infrastructure (Service Organization) in accordance with the criteria for a description of a service organization’s system set forth in the Description Criteria DC section 200 2018 Description Criteria for a Description of a Service Organization’s System in a SOC 2 Report (Description Criteria). The Description is intended to provide report users with information about the Oracle Cloud Infrastructure System that may be useful when assessing the risks arising from interactions with the System, particularly information about system controls that the Service Organization has designed, implemented and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the trust services criteria relevant to security, availability and confidentiality (applicable trust services criteria) set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, in AICPA Trust Services Criteria.

The System consists of the following services:

• Access Governance

• Account Tracking and Automation Tool

• Accounts Management

• Analytics Cloud

• Anomaly Detection

• API Gateway

• Application Dependency Management

• Application Performance Monitoring

• Archive Storage

• Artifact Registry

• Audit

• Autonomous Database on Dedicated Exadata Infrastructure (ADB-D) (formerly known as - Autonomous Database on Dedicated Exadata Infrastructure (ADB-D on ExaCS))

• Autonomous Database on Exadata Cloud at Customer (ADB-C@C) (formerly known as

- Autonomous Database on Cloud at Customer)

• Autonomous Database Serverless

• Autonomous Recovery Service (formerly known as - Recovery Database Service)

• Base Database Service (formerly known as - Bare Metal and Virtual Machine Database Systems)

• Bastion

• Big Data

• Bling

• Block Volume

• Blockchain Platform

• Budgets

• Cache with Redis

• Certificates

• Fusion Analytics Warehouse

• Fusion Applications Environment Management (formerly known as - Fusion Applications as a Service (FAaaS))

• Generative AI

• GoldenGate

• Health Checks

• Identity and Access Management

• Integration

• Inter-Region Latency

• Java Management

• Language

• License Manager

• Load Balancer

• Logging

• Logging Analytics

• Managed Access

• Management Agent

• Marketplace - Consumer

• Media Services (formerly known as - Digital Media)

• Monitoring

• MySQL Heatwave (formerly known as - MySQL

Database)

• NetSuite Analytics Warehouse

• NetSuite Health Check

• Network Firewall

• Network Load Balancer

• Network Path Analyzer

• Networking

• NoSQL Database

• Notifications

3 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

World Headquarters 2300 Oracle Way Austin, TX 78741 Phone +1.737.867.1000 oracle.com

• Client Logging

• Cloud Advisor

• Cloud Guard

• Cloud Incident Service

• Cloud Shell

• Compute

• Compute Cloud@Customer

• Console Announcements

• Container Engine for Kubernetes

• Container Instances

• Content Management

• Customer Feedback Service

• Data Catalog

• Data Flow

• Data Integration

• Data Labeling

• Data Lake

• Data Safe

• Data Science

• Data Transfer

• Database Management

• Database Migration

• Database Tools

• DevOps - Build Pipelines (formerly known as -

DevOps - Build Service)

• DevOps - Code Repositories (formerly known as - DevOps - Source Code Management)

• DevOps - Deployment Pipelines

• DevOps - Projects (formerly known as -

DevOps - Project Service)

• Digital Assistant

• Distributed Denial of Service

Mitigation (formerly known as - DDoS Protection)

• Document Understanding

• Domain Name System (DNS)

• Email Delivery

• Events

• Exadata Database on Cloud at Customer (ExaDB-C@C) (formerly known as - Exadata Cloud at Customer)

• Exadata Database on Dedicated Infrastructure (ExaDB-D) (formerly known as - Exadata Cloud Service)

• Exadata Fleet Update

• FastConnect

• Object Storage

• Oracle Cloud Infrastructure Database with PostgreSQL

• Operator Access Control

• Operator Insights

• Ops Insights (formerly known as - Operations Insights)

• Oracle Cloud Migrations

• Oracle Database Service for Azure

• Oracle Database@Azure

• Oracle Ksplice

• Oracle Open Data

• Oracle Search Cloud

• OS Management

• Process Automation

• Publisher

• Queue

• Registry

• Resource Manager

• Roving Edge Infrastructure

• Search

• Search with OpenSearch

• Secure Desktops (formerly known as - Desktop as a Service)

• Security Assurance System

• Security Zones

• Serverless Kubernetes

• Service Connector Hub

• Service Manager Proxy

• Service Mesh

• Site-to-Site VPN

• Speech

• Stack Monitoring

• Status Service

• Streaming

• Subscription Pricing Service

• Tagging

• Threat Intelligence

• Vault

• Vision

• Visual Builder (formerly known as - Visual

Builder Cloud)

• Visual Builder Studio

• VMWare Solution

• Vulnerability Scanning

4 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

World Headquarters 2300 Oracle Way Austin, TX 78741 Phone +1.737.867.1000 oracle.com

• File Storage

• Full Stack Disaster Recovery

• Functions

• Web Application Acceleration

• Web Application Firewall supported by availability domains and points of presence in the following regions:

Commercial Regions

• Australia East, Sydney, Australia

• Australia Southeast, Melbourne, Australia

• Brazil East, Sao Paulo, Brazil

• Brazil Southeast, Vinhedo, Brazil

• Canada Southeast, Montreal, Canada

• Canada Southeast, Toronto, Canada

• Chile Central, Santiago, Chile

• Chile West, Valparaiso, Chile

• Colombia Central, Bogota, Colombia

• France Central, Paris, France

• France South, Marseille, France

• Germany Central, Frankfurt am Main, Federal Republic of Germany

• India South, Hyderabad, India

• India West, Mumbai, India

• Israel Central, Jerusalem, Israel

• Italy Northwest, Milan, Italy

• Japan Central, Osaka, Japan

• Japan East, Tokyo, Japan

• Mexico Central, Queretaro, Mexico

• Mexico Northeast, Monterrey, Mexico

• Netherlands Northwest, Amsterdam, Netherlands

• Saudi Arabia West, Jeddah, Saudi Arabia

• Serbia Central, Jovanovac, Serbia

• Singapore, Singapore

• South Africa Central, Johannesburg, South Africa

• South Korea Central, Seoul, Republic of Korea

• South Korea North, Chuncheon, Republic of Korea

• Spain Central, Madrid, Spain

• Sweden Central, Stockholm, Sweden

• Switzerland North, Zurich, Switzerland

• UAE Central, Abu Dhabi, UAE

• UAE East, Dubai, UAE

• United Kingdom South, London, United Kingdom

• United Kingdom West, Newport, United Kingdom

• United States East, Ashburn, Virginia, United States

• United States Midwest, Chicago, Illinois, United States

• United States West, Phoenix, Arizona, United States

• United States West, San Jose, California, United States

5 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

World Headquarters 2300 Oracle Way Austin, TX 78741 Phone +1.737.867.1000 oracle.com

Government Regions

• Australia Government Southeast, Canberra, Australia

• United Kingdom Government South, London, United Kingdom

• United Kingdom Government West, Newport, United Kingdom

• United States Department of Defense East, Ashburn, Virginia, United States

• United States Department of Defense North, Chicago, Illinois, United States

• United States Department of Defense West, Phoenix, Arizona, United States

• United States Government East, Ashburn, Virginia, United States

• United States Government West, Phoenix, Arizona, United States

Sovereign Regions

• EU Sovereign Central, Frankfurt am Main, Federal Republic of Germany

• EU Sovereign South, Madrid, Spain

Dedicated Regions

• Chiyoda, Japan

• Dublin, Ireland 1

• Dublin, Ireland 2

• Milan, Italy 1

• Milan, Italy 2

• Muscat, Oman

• Osaka, Japan

• Ratingen, Germany 1

• Ratingen, Germany 2

• Zurich, Switzerland

Oracle Alloy

• Rome, Italy

Office facilities and security/network operating centers in the following locations:

• Bangalore, India

• Dublin, Ireland

• Guadalajara, Mexico

• Noida, India

• Seattle, Washington, United States and Dedicated Transparency Centers:

• Columbia, Maryland, United States

• Denver, Colorado, United States

• Reading, United Kingdom

• North Ryde, Australia

(collectively, the “System”).

Oracle Cloud Infrastructure System uses Microsoft Azure to provide multi-cloud data center hosting services. The

6 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

World Headquarters 2300 Oracle Way Austin, TX 78741 Phone +1.737.867.1000 oracle.com

Description indicates that complementary controls at Microsoft Azure that are suitably designed and operating effectively are necessary, along with controls at Oracle Cloud Infrastructure, to achieve Oracle Cloud Infrastructure’s service commitments and system requirements, based on the applicable trust services criteria. The Description presents Oracle Cloud Infrastructure’s controls and the types of complementary subservice organization controls assumed in the design of Oracle Cloud Infrastructure’s controls. The Description does not disclose the actual controls at Microsoft Azure.

The Description also indicates complementary user entity controls that are suitably designed and operating effectively are necessary along with Oracle Cloud Infrastructure’s controls to achieve the service commitments and system requirements. The Description presents Oracle Cloud Infrastructure’s controls and the complementary user entity controls assumed in the design of Oracle Cloud Infrastructure’s controls.

We confirm, to the best of our knowledge and belief, that:

a. The Description presents the System that was designed and implemented throughout the period October 1, 2023 to March 31, 2024 in accordance with the Description Criteria.

b. The controls stated in the Description were suitably designed throughout the period October 1, 2023 to March 31, 2024 to provide reasonable assurance that Oracle Cloud Infrastructure service commitments and system requirements would be achieved based on the applicable trust services criteria, if the controls operated effectively throughout October 1, 2023 to March 31, 2024, and if user entities applied the complementary user entity controls and the carved-out subservice organization applied the complementary controls assumed in the design of Oracle Cloud Infrastructure’s controls throughout the period October 1, 2023 to March 31, 2024.

c. The Oracle Cloud Infrastructure controls stated in the Description operated effectively throughout the period October 1, 2023 to March 31, 2024 to provide reasonable assurance that Oracle Cloud Infrastructure’s service commitments and system requirements were achieved based on the applicable trust services criteria, if the complementary user entity controls and the complementary carved-out subservice organization controls assumed in the design of Oracle Cloud Infrastructure’s controls operated effectively throughout that period.

Very truly yours, 15 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

SECTION III – DESCRIPTION OF THE ORACLE CLOUD INFRASTRUCTURE SYSTEM

Oracle Overview Oracle provides products and services that address enterprise information technology (IT) environments. Our products and services include enterprise applications and infrastructure offerings that are delivered worldwide through a variety of flexible and interoperable IT deployment models. These models include on-premise, cloud-based and hybrid deployments (an approach that combines both on-premise and cloud-based deployments), such as Oracle Exadata Cloud at Customer and Dedicated Region offerings (instances of Oracle Cloud in a customer’s own data center) and multi-cloud options that enable customers to use Oracle Cloud in conjunction with other public clouds. Accordingly, we offer choice and flexibility to our customers and facilitate the product, service and deployment combinations that best suit our customers’ needs. Our customers include businesses of many sizes, government agencies, educational institutions, and resellers that we market and sell to directly through our worldwide sales force and indirectly through the Oracle Partner Network. Using Oracle technologies, our customers build, deploy, run, manage and support their internal and external products, services and business operations.

Oracle Cloud Services offerings, which include Oracle Software-as-a-Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS), provide comprehensive and integrated applications and infrastructure services delivered via various cloud delivery models enabling our customers to choose the best option that meets their specific business needs.

Oracle Cloud Services integrate the IT components, including software, hardware and services, on a customer’s behalf in a cloud-based IT environment that Oracle deploys, manages, supports and upgrades for the customer and that a customer may access utilizing common web browsers via a broad spectrum of devices.

Oracle Cloud Services are designed to be rapidly deployable to enable customers shorter time to innovation; intuitive for casual and experienced users; easily maintainable to reduce upgrade, integration and testing work; connectable among differing deployment models to enable interoperability and extensibility to easily move workloads among the Oracle Cloud and other IT and cloud environments; cost-effective by lowering upfront customer investments and implementing usage-based resource consumption costs; and highly secure, standards-based and reliable.

Oracle cloud license and on-premise license deployment offerings include Oracle Applications, Oracle Database and Oracle Middleware software offerings, among others, which customers deploy using IT infrastructure from the Oracle Cloud or their own cloud-based or on-premise IT environments. Substantially all customers opt to purchase license support contracts when they purchase an Oracle license.

Oracle hardware products include Oracle Engineered Systems, servers, storage and industry-specific products, among others.

Customers generally opt to purchase hardware support contracts when they purchase Oracle hardware products. Oracle also offers professional services to assist our customers and partners to maximize the performance of their investments in Oracle products and services. Providing choice and flexibility to Oracle customers as to when and how they deploy Oracle applications and infrastructure technologies is an important element of our corporate strategy. Oracle believes that offering customers broad, comprehensive, flexible and interoperable deployment models for Oracle applications and infrastructure technologies is important to its growth strategy.

Oracle Cloud Infrastructure Overview Oracle Cloud Infrastructure is a set of complementary cloud services that enable customers to build and run a range of applications and services in a highly available hosted environment. Oracle Cloud Infrastructure provides high-performance capabilities (as physical hardware instances) and storage capacity in a flexible overlay virtual network that is securely accessible from customer's on-premise networks.

Oracle Cloud Infrastructure's distributed cloud provides customers with the flexibility to choose where and how cloud services are delivered to meet their regulatory, performance, and other needs. The distributed cloud offerings deliver the full functionality and superior economics of Oracle's public cloud to customer data centers and edge locations, with a range of deployment models and operational controls. By design, Oracle Cloud Infrastructure's distributed cloud offerings are all built on the same foundation.

In addition to the full suite of Oracle Cloud Infrastructure offerings delivered by dozens of Oracle public cloud regions across the globe, Oracle provides its customers with flexibility by offering certain Oracle Cloud Infrastructure services to address

16 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System customer latency requirements and address restrictions imposed upon customers that operate in certain regulated industries, entities or jurisdictions with our Dedicated Region and Sovereign cloud offerings. A Dedicated Region is designed to enable customers to bring a self-contained Oracle Cloud Infrastructure instance into their data centers while accessing a substantial portfolio of Oracle Cloud Infrastructure and Oracle SaaS offerings. Oracle European Union (EU) Sovereign Cloud enables commercial and public sector organizations to place sensitive data and applications in the cloud in alignment with EU data privacy and sovereignty requirements.

Oracle Alloy is a complete cloud infrastructure platform that enables partners to become cloud providers and offer a full range of cloud services to expand their businesses. Partners control the commercial and customer experience of Oracle Alloy and can customize and extend it to address their specific market needs. Partners can operate Oracle Alloy independently in their own data centers and fully control its operations to better fulfill customer and regulatory requirements. While Oracle maintains a direct relationship with the Oracle Alloy partner, the Oracle Alloy partner retains a direct relationship with their end customers. Oracle does not have a contractual relationship with the Oracle Alloy partner end customers.

The concepts and terminology described below are critical to understanding Oracle’s controls over the Oracle Cloud Infrastructure System.

Physical Architecture Concepts

Regions and Availability Domains Oracle Cloud Infrastructure is physically hosted in regions and availability domains (ADs). A region is a localized geographic area, and an AD is one or more data centers located within a region. A region is comprised of one or more ADs. Most Oracle Cloud Infrastructure resources are either region-specific, such as a virtual cloud network (VCN), or AD specific, such as a compute instance. Traffic between ADs and between regions is encrypted. ADs are isolated from each other, fault tolerant, and very unlikely to fail simultaneously. Because ADs do not share infrastructure such as power or cooling, or the internal AD network, a failure at one AD within a region is unlikely to impact the availability of the others within the same region.

The ADs within the same region are connected to each other by a low-latency, high-bandwidth network, which makes it possible for customers to provide high-availability connectivity to the internet and on-premises, and to build replicated systems in multiple ADs for both high-availability and disaster recovery.

Regions are independent of each other and can be separated by vast geographical distances. Generally, customers would deploy an application in the region where it is most heavily used, because using nearby resources is faster than using distant resources. However, customers can also deploy applications in different regions for these reasons:

• To mitigate the risk of region-wide events such as large weather systems or earthquakes.

• To meet varying requirements for legal jurisdictions, tax domains, and other business or social criteria.

The Exadata Cloud at Customer service is hosted physically in regions and ADs. The accompanying Exadata Database Machine is hosted at the customer’s designated data center.

Fault Domains A fault domain is a grouping of hardware and infrastructure within an AD. Each AD contains three fault domains. Fault domains provide anti-affinity: they let customers distribute their instances so that the instances are not on the same physical hardware within a single AD. A hardware failure or Compute hardware maintenance event that affects one fault domain does not affect instances in other fault domains.

To control the placement of compute instances, bare metal DB system instances, or virtual machine DB system instances, customers can optionally specify the fault domain for a new instance or instance pool at launch time. If the customer doesn’t specify the fault domain, the system selects one automatically. Oracle Cloud Infrastructure makes a best-effort anti-affinity placement across different fault domains, while optimizing for available capacity in the AD.

Realms Regions are grouped into realms. A realm is a logical collection of regions. Realms are isolated from each other and do not share any data. A customer tenancy exists in a single realm and the customer can have resources in the regions within that realm. Customers cannot access regions that are not in their realm.

17 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

Oracle Cloud Infrastructure has multiple realms within the public and dedicated cloud:

• Public Cloud o Commercial - A secure, high performance cloud platform for all workloads o EU Sovereign - Cloud regions in the European Union to help customers control their data and applications in alignment with data residency and sovereignty requirements. Regions are physically and logically separated from other public cloud regions.

o US Government - Cloud regions for the US government.

o UK Government - A sovereign, dedicated dual-region cloud for UK government and defense customers.

• Dedicated Cloud o Dedicated Region - A complete cloud region inside a customer's data center.

o Oracle Alloy - A complete cloud infrastructure platform that enables partners to offer Oracle Cloud

Infrastructure and custom cloud services to their own customers.

The following table lists the regions in the commercial realms included in the scope of the System:

REGION NAME

REGION

IDENTIFIER REGION LOCATION

REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

Australia East (Sydney) ap-sydney-1 Sydney, Australia SYD OC1 1

Australia Southeast (Melbourne) ap-melbourne-1 Melbourne, Australia MEL OC1 1

Brazil East (Sao Paulo) sa-saopaulo-1 Sao Paulo, Brazil GRU OC1 1

Brazil Southeast (Vinhedo) sa-vinhedo-1 Vinhedo, Brazil VCP OC1 1

Canada Southeast (Montreal) ca-montreal-1 Montreal, Canada YUL OC1 1

Canada Southeast (Toronto) ca-toronto-1 Toronto, Canada YYZ OC1 1

Chile Central (Santiago) sa-santiago-1 Santiago, Chile SCL OC1 1

Chile West (Valparaiso) sa-valparaiso-1 Valparaiso, Chile VAP OC1 1 – From 12/21/2023

Colombia Central (Bogota) sa-bogota-1 Bogota, Colombia BOG OC1 1 – From 11/27/2023

France Central (Paris) eu-paris-1 Paris, France CDG OC1 1

France South (Marseille) eu-marseille-1 Marseille, France MRS OC1 1

Germany Central (Frankfurt) eu-frankfurt-1 Frankfurt, Germany FRA OC1 3

India South (Hyderabad) ap-hyderabad-1 Hyderabad, India HYD OC1 1

India West (Mumbai) ap-mumbai-1 Mumbai, India BOM OC1 1

Israel Central (Jerusalem) il-jerusalem-1 Jerusalem, Israel MTZ OC1 1

Italy Northwest (Milan) eu-milan-1 Milan, Italy LIN OC1 1

Japan Central (Osaka) ap-osaka-1 Osaka, Japan KIX OC1 1

Japan East (Tokyo) ap-tokyo-1 Tokyo, Japan NRT OC1 1

18 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

REGION NAME REGION

IDENTIFIER

REGION LOCATION REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

Mexico Central (Queretaro) mx-queretaro-1 Queretaro, Mexico QRO OC1 1

Mexico Northeast (Monterrey) mx-monterrey-1 Monterrey, Mexico MTY OC1 1

Netherlands Northwest (Amsterdam) eu-amsterdam-1 Amsterdam, Netherlands

AMS OC1 1

Saudi Arabia West (Jeddah) me-jeddah-1 Jeddah, Saudi Arabia JED OC1 1

Serbia Central (Jovanovac) eu-jovanovac-1 Jovanovac, Serbia BEG OC20 1

Singapore (Singapore) ap-singapore-1 Singapore, Singapore SIN OC1 1

South Africa Central (Johannesburg) af-johannesburg-1

Johannesburg, South Africa

JNB OC1 1

South Korea Central (Seoul) ap-seoul-1 Seoul, South Korea ICN OC1 1

South Korea North (Chuncheon) ap-chuncheon-1 Chuncheon, South Korea

YNY OC1 1

Spain Central (Madrid) eu-madrid-1 Madrid, Spain MAD OC1 1

Sweden Central (Stockholm) eu-stockholm-1 Stockholm, Sweden ARN OC1 1

Switzerland North (Zurich) eu-zurich-1 Zurich, Switzerland ZRH OC1 1

UAE Central (Abu Dhabi) me-abudhabi-1 Abu Dhabi, UAE AUH OC1 1

UAE East (Dubai) me-dubai-1 Dubai, UAE DXB OC1 1

UK South (London) uk-london-1 London, UK LHR OC1 3

UK West (Newport) uk-cardiff-1 Newport, UK CWL OC1 1

US East (Ashburn) us-ashburn-1 Ashburn, Virginia, US IAD OC1 3

US Midwest (Chicago) us-chicago-1 Chicago, IL ORD OC1 3

US West (Phoenix) us-phoenix-1 Phoenix, Arizona, US PHX OC1 3

US West (San Jose) us-sanjose-1 San Jose, California, US SJC OC1 1

The following table lists the regions in the United States Government Cloud realm (with FedRAMP authorization) included in the scope of the System:

REGION NAME REGION

IDENTIFIER

REGION LOCATION REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

US Gov East (Ashburn) us-langley-1 Ashburn, Virginia, US LFI OC2 1

Us Gov West (Phoenix) us-luke-1 Phoenix, Arizona, US LUF OC2 1

19 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

The following table lists the regions in the United States Federal Cloud realm (with DISA Impact Level 5 authorization) included in the scope of the System:

REGION NAME REGION

IDENTIFIER

REGION LOCATION REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

US DoD East (Ashburn) us-gov-ahsburn-1

Ashburn, Virginia, US RIC OC3 1

US DoD North (Chicago) us-gov-chicago-

Chicago, Illinois, US PIA OC3 1

US DoD West (Phoenix) us-gov-phoenix-1

Phoenix, Arizona, US TUS OC3 1

The following table lists the regions in the United Kingdom Government Cloud realm included in the scope of the System:

REGION NAME REGION

IDENTIFIER

REGION LOCATION REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

UK Gov South (London) uk-gov-london-1 London, UK LTN OC4 1

UK Gov West (Newport) uk-gov-cardiff-1 Newport, UK BRS OC4 1

The following table lists the region in the Australia Government Cloud realm included in the scope of the System:

IDENTIFIER

REGION LOCATION REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

Australia Government Southeast (Canberra) ap-canberra-1 Canberra, Australia WGA OC10 1

The following table lists the regions in the EU Sovereign Cloud realm included in the scope of the System:

IDENTIFIER

REGION LOCATION REGION

KEY

REALM

KEY

AVAILABILITY

DOMAINS

EU Sovereign Central (Frankfurt) eu-frankfurt-2 Frankfurt, Germany STR OC19 1

EU Sovereign South (Madrid) eu-madrid-2 Madrid, Spain VLL OC19 1

The following table lists the Dedicated Regions included in the scope of the System:

REGION NAME REGION IDENTIFIER REGION LOCATION REGION KEY REALM KEY

NJA Dedicated Region ap-chiyoda-1 Chiyoda, Japan NJA OC8

UKB Dedicated Region ap-ibaraki-1 Osaka, Japan UKB OC8

MCT Dedicated Region me-dcc-muscat-1 Muscat, Oman MCT OC9

BGY Dedicated Region eu-dcc-milan-1 Milan, Italy BGY OC14

DTM Dedicated Region eu-dcc-rating-2 Ratingen, Germany DTM OC14

DUS Dedicated Region eu-dcc-rating-1 Ratingen, Germany DUS OC14

MXP Dedicated Region eu-dcc-milan-2 Milan, Italy MXP OC14

20 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

REGION NAME REGION IDENTIFIER REGION LOCATION REGION KEY REALM KEY

ORK Dedicated Region eu-dcc-dublin-1 Dublin, Ireland ORK OC14

SNN Dedicated Region eu-dcc-dublin-2 Dublin, Ireland SNN OC14

AVZ Dedicated Region eu-dcc-zurich-1 Zurich, Switzerland AVZ OC24 – From 11/14/2023

The following table lists the Oracle Alloys included in the scope of the System:

REGION NAME REGION IDENTIFIER REGION LOCATION REGION KEY REALM KEY

NAP Alloy Region eu-dcc-rome-1 Rome, Italy NAP OC22 – From 1/9/2024

Account and Access Concepts Console The Console is an intuitive, graphical interface to create and manage instances, cloud networks, and storage volumes, as well as users and permissions. For Oracle Alloy, partners have their own operator console, enabling them to manage both their cloud region's services and business operations. The operating team can customize branding, including logos, color themes, and terms of use. They can configure their customers' front-end experience, including notifications and announcements.

Tenancy When a customer signs up or subscribes to Oracle Cloud services, Oracle creates a tenancy for the customer. The customer can think of the tenancy as their account, but it is also a secure and isolated partition with Oracle Cloud Infrastructure where they can create, organize, and administer their cloud resources. When a customer signs up, the customer’s tenancy is created in a home region designated by the customer, but the customer can subscribe their tenancy to as many regions as needed.

Large organizations can have multiple tenancies.

Compartment Compartments allow the customer to organize and control access to their cloud resources. A compartment is a collection of related resources (such as instances, VCNs, and block volumes) that can be accessed only by groups that have been given permission by an administrator. A compartment should be thought of as a logical group and not a physical container. When working with resources in the Console, the compartment acts as a filter for what each customer can view.

When a customer signs up for Oracle Cloud Infrastructure, Oracle creates the customer’s tenancy, which is the root compartment that holds all cloud resources for the customer. The customer then creates additional compartments within the tenancy (root compartment) and corresponding policies to control access to the resources in each compartment. When a customer creates a cloud resource such as an instance, block volume, or cloud network, the customer must specify to which compartment they want the resource to belong. Each person has access to only the resources they need.

Identity Domains and Policies An identity domain is a container for managing users and roles, federating and provisioning of users, secure application integration through Oracle Single Sign-On (SSO) configuration, and OAuth administration. It represents a user population in Oracle Cloud Infrastructure and its associated configurations and security settings (such as MFA).

A policy is a document that specifies who can access which resources and how. Customers can write policies to control access to their services within Oracle Cloud Infrastructure. Access is granted at the group and compartment level, which means customers can write a policy that gives a group a specific type of access within a specific compartment, or to the tenancy itself.

If a customer gives a group access to the tenancy, the group automatically gets the same type of access to all the compartments inside the tenancy.

Oracle Cloud Identifier (OCID) Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID). This ID is included as part of the resource’s information in both the Console and API.

21 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

Security Zone Security Zones allow customers to be confident that their Compute, Networking, Object Storage, Database, and other resources comply with Oracle security principles and best practices. A security zone is associated with one or more compartments and a security zone recipe. When a customer creates and updates resources in a security zone, Oracle Cloud Infrastructure validates these operations against security zone policies in the zone’s recipe. If any security zone policy is violated, then the operation is denied.

Core Services Concepts Virtual Cloud Network A VCN is a virtual version of a traditional network—including subnets, route tables, and gateways—on which the customer’s instances run. A cloud network resides within a single region but includes all the region’s ADs. Each subnet that is defined by the customer in the cloud network can either be in a single AD or span all the ADs in that region. At least one cloud network needs to be set up before instances can be launched. Customers may configure their cloud network with an optional internet gateway to handle public traffic, and an optional IPSec connection or FastConnect to securely extend their on-premises network.

Instance An instance is a compute host running in the cloud. An Oracle Cloud Infrastructure compute instance allows customers to utilize hosted physical hardware, as opposed to the traditional software-based virtual machines, ensuring a high level of security and performance.

The image is a template on a virtual hard drive that defines the operating system and other software for an instance, for example, Oracle Linux. When a customer launches an instance, they can define its characteristics by choosing its image. Oracle provides a set of platform images that customers can use. Customers can also save an image from an instance that they have already configured to use as a template to launch more instances with the same software and customizations.

In Compute, the shape specifies the number of CPUs and amount of memory allocated to the instance. Oracle Cloud Infrastructure offers shapes to fit various computing requirements.

Block Volume A block volume is a virtual disk that provides persistent block storage space for Oracle Cloud Infrastructure instances. A block volume is used in the same way as a physical hard drive on a computer, for example, to store data and applications. Block volumes can be detached from one instance and attached to another instance without loss of data.

Service Essentials Security Credentials When working with Oracle Cloud Infrastructure, customers may use the following credentials: console password when accessing their console; API signing key when using API; instance SSH key for accessing a compute instance; and Auth Token for authenticating with third-party APIs that do not support Oracle Cloud Infrastructure's signature-based authentication.

IP Address Ranges There are public IP address ranges for services that are deployed in Oracle Cloud Infrastructure. Customers need to allow traffic to these Classless Inter-Domain Routing (CIDR) blocks to access the services.

Resource Monitoring Customers can monitor the health, capacity, and performance of their Oracle Cloud Infrastructure resources as required using queries or on a passive basis using alarms. Queries and alarms rely on metrics emitted by their resource to the Monitoring service.

Resource Tags Tags allow customers to define keys and values and associate them with resources. Customers can then use the tags to help organize and list resources based on business needs. There are two types of tags:

22 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

• Defined tags are set up in a customer’s tenancy by an administrator. Only users granted permission to work with the defined tags can apply them to resources.

• Free-form tags can be applied by any user with permissions on the resource.

Service Limits A set of service limits are configured for each tenancy, as established when a customer purchases Oracle Cloud Infrastructure.

The service limit is the quota or allowance set on a resource. These limits may be increased automatically based on the resource usage and account standing, but customers can also request a service limit increase.

Service Logs Customers can enable service logs for some resources. Service logs provide diagnostic information about the resources in a tenancy. When customers enable logging on resources, they receive information about the resource in a log file. This information allows customers to analyze, optimize, and troubleshoot their resources.

Tenancy Explorer Tenancy explorer allows customers to obtain a cross-region view of all resources in a compartment.

Work Requests Work requests allow customers to monitor long-running operations such as database backups or provisioning of compute instances. When such an operation is launched, the service spawns a work request. A work request is an activity log that enables customers to track each step in the operation’s process. Each work request has an OCID that allows the customer to interact with it programmatically and use it for automation.

Service Descriptions The scope of this report includes the controls placed in operation specifically for the following Oracle Cloud Infrastructure services to meet the Trust Services Criteria related to security, availability, and confidentiality and excludes the controls performed by the subservice organization. These criteria are set forth in TSP section 100, of the 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Services available to customers may include, but are not limited to, the offerings described below. The actual services provided by Oracle depends on the contractual agreement with and the services provisioned by each individual customer, as well as the availability of the service within a region or realm. Customers can refer to the publicly available Infrastructure Regions list to find out where a service is available.

Access Governance Access Governance is an Identity Governance and Administration (IGA) solution that provides insights-based access reviews, identity analytics, and intelligence capabilities for businesses.

Account Tracking and Automation Tool The Account Tracking and Automation Tool (ATAT) maintains metadata about resources it creates for ATAT Portfolio resources. It provides a cost tracking and reporting.

Accounts Management Accounts Management provides various billing and cost management tools that make it easy for customers to manage service costs. Customers can estimate costs, create budgets to set spending thresholds, view usage, and visualize spending with charts and reports. Customers can also view subscription details, invoices, payment history, manage payment method, and earn rewards.

Analytics Cloud Analytics Cloud empowers business analysts and consumers with modern, AI-powered, self-service analytics capabilities for data preparation, visualization, enterprise reporting, augmented analysis, and natural language processing.

23 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

Anomaly Detection Anomaly Detection provides customers with a rich set of tools to identify undesirable events or observations in business data in real time so that customers can take action to avoid business disruptions.

API Gateway API Gateway allows customers to create governed HTTP/S interfaces for other services, including Functions, Container Engine for Kubernetes, and Container Registry. API Gateway also provides policy enforcement such as authentication and rate-limiting to HTTP/S endpoints.

Application Dependency Management Application Dependency Management (ADM) detects security vulnerabilities in application dependencies. It is a reporting and management service integrated with Oracle Cloud Infrastructure services to detect and remediate security vulnerabilities in the applications' dependencies. It relies on vulnerabilities reported by community sources including the National Vulnerability Database (NVD).

Application Performance Monitoring Application Performance Monitoring provides a comprehensive set of features to monitor applications and diagnose performance issues.

Archive Storage Archive Storage allows customers to store data that is accessed infrequently and requires long retention periods. It is ideal for storing data that is seldom accessed but requires long retention periods. Archive Storage data retrieval is not instantaneous.

By default, Archive Storage encrypts data on the server with Advanced Encryption Standard (AES) 256-bit encryption. The customer has the option to encrypt Archive Storage with keys that the customer owns and manages via the Vault service.

Artifact Registry Artifact Registry is a repository service for storing, sharing, and managing software development packages. An artifact is a software package, library, zip file, or any other type of file used for deploying applications. Examples are Python or Maven libraries. Artifacts are grouped into repositories, which are collections of related artifacts.

Audit The Audit service provides visibility into activities related to a customer’s Oracle Cloud Infrastructure resources and tenancy.

Audit log events can be used for security audits, to track usage of and changes to Oracle Cloud Infrastructure resources. Audit automatically records calls to all supported Oracle Cloud Infrastructure public application programming interface (API) endpoints as log events. Currently, all services support logging by Audit. Log events recorded by the Audit service include API calls made by the Oracle Cloud Infrastructure Console, Command Line Interface (CLI), Software Development Kits (SDK), custom clients, or other Oracle Cloud Infrastructure services. Information in the logs includes the following: time the API activity occurred, source of the activity, target of the activity, type of action, and type of response.

Bastion Bastion provides restricted and time-limited access to target resources that don't have public endpoints. Bastions let authorized users connect from specific IP addresses to target resources using Secure Shell (SSH) sessions. When connected, users can interact with the target resource by using any software or protocol supported by SSH.

Big Data Big Data Service provisions fully configured, secure, highly available, and dedicated Hadoop and Spark clusters on demand.

Customers can scale the cluster to fix their big data and analytics workloads by using a range of Oracle Cloud Infrastructure compute shapes that support small test and development clusters to large production clusters.

Bling Bling is an Oracle internal service that provides the cost and usage reports for customers. Cost reports indicate the cost of resource consumption, and usage reports indicate the quantity of what is consumed.

24 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

Block Volume Block Volume allows customers to dynamically provision and manage block storage volumes. The customer can create, attach, connect, and move volumes as needed to meet storage, performance, and application requirements. By default, Block Volume service encrypts block volumes, boot volumes, and volume backups at rest using AES 256-bit encryption. The customer has the option to encrypt volumes at rest with keys that the customer owns and manages via the Vault service.

Blockchain Platform Blockchain Platform is a network consisting of validating nodes (peers) that update the ledger and respond to queries by executing smart contract code – the business logic that runs on the blockchain. External applications invoke transactions or run queries through client SDKs or REST API calls, which prompts selected peers to run the smart contracts. Multiple peers endorse (digitally sign) the results, which are then verified and sent to the ordering service. After consensus is reached on the transaction order, transaction results are grouped into cryptographically secured, tamper-proof data blocks and sent to peer nodes to be validated and appended to the ledger.

Budgets A budget is a feature that customers can use to set soft limits on their Oracle Cloud Infrastructure spending. Customers can set alerts on their budget to be informed when they may exceed their budget and can view all their budgets and spending from one single place in the Oracle Cloud Infrastructure console.

Cache with Redis Cache with Redis is a managed service that enables customers to build and manage Redis clusters, which are memory-based storage solutions for their applications. Cache with Redis handles the management and operations of clusters, including operations such as security updates.

Certificates Certificates lets customers create and manage TLS certificates, certificate authorities (CAs), and CA bundles. It provides customers with certificate issuance, storage, and management capabilities, including revocation and automatic renewal.

Client Logging Client Logging is a multi-tenant service that accepts trace logs from the client part of the product, validates requests, augments with additional data, and routes to persistent store in the Oracle Cloud Infrastructure platform. Client Logging is an internal Oracle service.

Cloud Advisor Cloud Advisor allows customers to find potential inefficiencies in their tenancy and offers guided solutions that explain how to address them. The recommendations help optimize the performance, security, and availability of the customer's tenancy.

It complements and cross-sells Cloud Guard and Data Safe, displays summary Cloud Guard data, and redirects customers directly to Cloud Guard for all security issues.

Cloud Guard Cloud Guard allows customers to monitor, identify, achieve, and maintain a strong security posture on Oracle Cloud.

Customers can examine their Oracle Cloud Infrastructure resources for security weakness related to configuration, and their operators and users for risky activities. Upon detection, Cloud Guard can suggest, assist, or take corrective actions, based on their configurations.

Cloud Incident Service Cloud Incident Service provides the Support Center feature access in the Oracle Cloud Infrastructure console. It enables customers to browse and create tickets for technical and billing requests, including service limit increases.

Cloud Shell Cloud Shell is a web browser-based terminal accessible from the Oracle Cloud Console. It provides access to a Linux shell, with a pre-authenticated Oracle Cloud Infrastructure Command Line Interface (CLI), a pre-authenticated Ansible installation, and other useful tools to follow Oracle Cloud Infrastructure service tutorials and labs.

25 System and Organization Controls 2 (SOC 2) Type 2 Report | Description of the Oracle Cloud Infrastructure System

Compute Compute allows customers to provision and manage compute hosts, known as instances. Oracle Cloud Infrastructure offers both bare metal and virtual machine compute instances.

Bare metal compute instances give customers dedicated physical server access for the highest performance and strong isolation.

Virtual machine (VM) instances are independent computing environments that run on top of physical bare metal hardware.

Virtualization makes it possible to run multiple VMs that are isolated from each other. VMs are useful for running applications that do not require the performance and resources (CPU, memory, network bandwidth, storage) of an entire physical machine.

When the customer creates a Compute instance, they can select the most appropriate type of instance for their applications based on characteristics such as the number of CPUs, amount of memory, and network resources. Oracle Cloud Infrastructure offers a variety of instances features, shape types, and capacity types that are designed to meet a range of compute and application requirements.

Compute Cloud@Customer Compute Cloud@Customer is Oracle-owned and remotely managed cloud infrastructure that is installed on-premises. The Compute Cloud@Customer rack is installed in the customer's data center, connected to their Oracle Cloud Infrastructure tenancy. It allows customers to run scalable Oracle Cloud Infrastructure compute, storage, and networking services while enabling data residency requirements and the need for low-latency connections to existing data center assets and real-time operations.

Console Announcements Announcements are displayed in the Console to communicate timely, important information about service status. Customers can also view a list of past and ongoing announcements. Announcement types currently include the following: required action, emergency change, emergency maintenance extended, emergency maintenance reschedule, recommended action, planned change, planned change extended, planned change rescheduled, event notification, schedule maintenance, emergency maintenance completed, planned change completed, and information.

Container Engine for Kubernetes Container Engine for Kubernetes allows customers to enable the deployment, scaling, and management of containerized applications. The service uses Kubernetes, the open-source system for automating deployment, scaling, and management of containerized applications across clusters of hosts.