Engagements · The entry point
The architecture review.
The entry point for every Fortova engagement. We build the picture of your Oracle estate as it actually runs, measure it against the CIS OCI Foundations Benchmark, and give you numbered findings and a prioritized roadmap to fix them. Scoped to your estate and agreed in writing before we start.
What you receive
Five artifacts, one register.
Current-state tenancy diagram
Compartments, networking, identity domains and integration topology, drawn from what is running rather than what the code intended. The anchor diagram of every later document.
CIS benchmark baseline report
The CIS OCI Foundations Benchmark run by your administrator, read-only, from the published source, with a run guide and a pairing session from us. The "before" that later work is measured against.
Cloud Guard posture
Cloud Guard enabled (or reviewed, if already on), high-level problems triaged, and the resolution path for each written down.
Identity, governance and integration inventory
Identity domains, federation and privileged accounts; Fusion role and segregation-of-duties exposure; AI features and agents in use; and every OIC, VBCS and API connection with its authentication method.
Findings register and roadmap
Findings numbered from F-01, each with severity, evidence and a recommended fix, sequenced into a roadmap your team can run, or that we deliver with you as a security program.
A working session
Findings and roadmap walked through with your sponsor and the people who will own each item. Decisions get sessions, not email chains.
How it runs
Three stages, in order.
The review runs the first phases of our method to the same standard as a full program. How long it takes depends on the estate: one tenancy with a focused Fusion scope moves faster than a multi-environment estate with a hundred integrations. We agree the timeline in writing before we start.
- Stage 1
Intake and seeding
Documentation review from the outside. The tenancy diagram is pre-built from your intended design with every area marked to verify. Access is read-only and yours to grant; benchmark tooling is run by your administrator with our run guide.
- Stage 2
Capture and baseline
Verification turns the seeded diagram into the current state; drift between intent and reality becomes the first findings. The CIS benchmark report is produced and Cloud Guard is enabled or reviewed.
- Stage 3
Register, roadmap, session
Findings are written up with evidence and sequenced. The roadmap is circulated ahead of time and decided in a working session with owners assigned.
What we need from you
Very little, and nothing elevated.
- A sponsor and a technical contact who can grant read-only access to the tenancy and Fusion security console.
- Whatever architecture and security documentation exists, in whatever state it is in.
- An administrator willing to run the benchmark script from the published source, with us on the call.
- Time with the people who will own the findings, for the closing working session.
Questions we are asked
Before the review.
How long does it take?
It depends on the estate: the number of environments, the Fusion scope and how many integrations are running. We scope it with you on the first call and agree the timeline in writing before we start.
What happens after the review?
Most clients continue into delivery: the roadmap becomes the plan for a security program or a migration workstream, and we put the controls in place with your team. The artifacts are yours either way.
Is this a penetration test?
No. It is an architecture and configuration review against the CIS benchmark and Oracle's published patterns. It tells you whether the estate is built to the plan, and where it is not.
Can it run on a Fusion-only estate?
Yes. The Fusion identity and role review, integration inventory and monitoring design apply without OCI workloads. The tenancy diagram becomes an identity and integration diagram.
Start with an architecture review.
Tell us what runs in the estate and when you need the picture. We reply directly, normally within one business day.