Cloud Guard is enabled in the root compartment

Check ID: cloudguard_enabled
Provider: Oracle Cloud (OCI)
Service: cloudguard
Severity: HIGH
Categories: forensics-ready
Resource type: Compartment

What this check verifies

OCI Cloud Guard status in the tenancy’s root compartment is evaluated, expecting ENABLED to indicate the service is active for organization-wide detection and response.

Risk

Without Cloud Guard at the root, signals across compartments can be missed, allowing misconfigurations and malicious activity to persist. This undermines confidentiality (undetected data access), integrity (unauthorized changes), and availability (ongoing abuse without automated response).

Recommendation

Enable Cloud Guard at the tenancy root to centralize monitoring and automated response. Apply defense in depth by using detectors/responders, integrate alerts with monitoring, and enforce least privilege for its roles. Regularly tune policies and review findings to prevent blind spots.

Remediation

CLI
Terraform
Dashboard steps

oci cloud-guard cloud-guard-configuration update —compartment-id <tenancy-ocid> —status ENABLED —reporting-region <region>

resource "oci_cloud_guard_cloud_guard_configuration" "<example_resource_name>" {
  compartment_id   = var.tenancy_ocid
  reporting_region = var.region
  status           = "ENABLED" # Critical: Turns on Cloud Guard in the root compartment
}

References

https://docs.oracle.com/en-us/iaas/cloud-guard/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudguard_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Boot volume is encrypted with Customer Managed Key Compute instance has in-transit encryption enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires