Ensure Integration Account Secrets Are Rotated on a Regular Schedule

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

1. Review integration accounts in Oracle Fusion Applications and identify all OAuth clients, JWT keys, and certificates in use. 2. Confirm that each credential has a documented rotation policy, including expiration and renewal dates. 3. Validate logs or change records to confirm that credentials have been rotated within the organization's defined schedule (for example, within the past 180 days). 4. Check for expired or inactive credentials and confirm they are removed from production environments.

How it is fixed

Fix method: Guidance or infrastructure patch

1. Develop an inventory of all integration account secrets, including OAuth credentials, JWT keys, and certificates. 2. Define a rotation schedule (for example, 90 or 180 days) aligned with organizational policy and compliance requirements. 3. Rotate each credential according to the schedule, updating dependent integrations and notifying stakeholders. 4. Remove or revoke any unused or expired credentials to reduce the attack surface. 5. Document the process and maintain records of all credential rotations for audit purposes.