Break Glass – Putting You in Control of Access & Encryption in Oracle EPM.

 Oracle EPM April 2026: Break Glass – Putting You in Control of Access & Encryption

Why This Matters More Than Ever

 

One of the most common questions I hear from security teams, auditors, and CISOs is:

“Who from Oracle can access our EPM data, and how do we control it?”

With the April 2026 (26.04) update, Oracle has delivered a long‑awaited answer by introducing Break Glass for Oracle EPM Cloud — a governance‑first capability designed for organizations that care deeply about data sovereignty, compliance, and zero‑trust principles.

Break Glass is not just another toggle in the UI. It fundamentally changes the access model between Oracle Operations and your EPM environments.

 

What Is Break Glass in Oracle EPM?

Break Glass is a new subscription option for Oracle EPM Cloud that gives customers explicit control over:

• When Oracle support personnel can access your environments
• How your data is encrypted at rest

It introduces two tightly integrated security pillars:

 

1. Oracle Managed Access (OMA)

With OMA enabled:

• Oracle cannot access your environment by default
• Every access attempt requires explicit customer approval
• Access is temporary, time‑bound, and auditable

This is a major shift from the traditional cloud support model.

Think of it like this: Oracle now needs a temporary, customer‑issued key to enter your environment — and every use is logged.

 

2. Bring Your Own Key (BYOK)

BYOK gives you control over encryption keys used for your EPM data at rest:

• Keys are customer‑managed
• Stored and controlled using OCI Vault
• You can rotate or revoke keys based on internal policies

This aligns EPM with enterprise‑grade security standards commonly seen in OCI, ERP, and regulated workloads.

 

How Break Glass Works – End to End

Here’s what the real‑world flow looks like when Break Glass is enabled:

1. An issue requires Oracle support involvement
2. Oracle submits an access request, usually linked to a Service Request (SR)
3. Your designated EPM administrators review and approve or deny the request
4. If approved:
• Access is granted only for the approved duration
• All actions are logged and auditable
5. Access automatically expires when the time window closes

No silent access. No assumptions. No permanent privileges.

 

Key Benefits for Customers

• Stronger Security & Zero Trust

·       Oracle access is explicit, not implicit

·       Eliminates "always‑on" operator access

·       Supports zero‑trust security models

• Audit & Compliance Readiness

• Complete audit trail of who accessed what and when
• Ideal for SOX, GDPR, HIPAA, ISO 27001, and similar requirements

• Encryption Ownership

• You control the encryption keys
• Aligns EPM with broader enterprise key‑management strategies

 

 Built for Regulated Industries

Especially valuable for:

• Banking & Financial Services
• Healthcare & Life Sciences
• Government & Public Sector
• Any organization with strict data‑residency obligations

 

Which EPM Modules Are Supported?

Break Glass applies across major EPM Cloud modules, including:

• Planning
• Financial Consolidation and Close (FCCS)
• Account Reconciliation (ARCS)
• FreeForm
• Narrative Reporting
• Enterprise Data Management
• Tax Reporting
• Profitability and Cost Management

 

How to Get Break Glass

Customers can enable Break Glass in two ways:

• Include it during initial EPM subscription onboarding
• Add it later as an additional subscription (SKU B112331)

Because it impacts governance, access workflows, and encryption, enabling Break Glass typically involves IT security, EPM admins, and compliance teams working together.

 

Should You Enable Break Glass?

The short answer is: it depends on your risk profile, regulatory exposure, and security posture.

Use the table below as a quick decision guide when discussing Break Glass with Security, Risk, and EPM stakeholders.

Question	If Your Answer Is YES	Recommendation
Are you subject to regulatory, audit, or data‑sovereignty requirements (SOX, GDPR, HIPAA, ISO)?	You must demonstrate controlled, auditable access to cloud data	✅ Strongly recommended
Do security or audit teams ask who at Oracle can access your EPM environments?	You need explicit approval and traceability	✅ Strongly recommended
Do you operate under a Zero‑Trust or least‑privilege security model?	Always‑on vendor access is a risk	✅ Strongly recommended
Do you need customer‑controlled encryption keys for compliance or internal policy?	Oracle‑managed keys may not be sufficient	✅ Strongly recommended (BYOK)
Is your EPM environment business‑critical or used for external reporting?	Risk impact of unauthorized access is high	✅ Recommended
Are you in Banking, Life Sciences, Government, or Public Sector?	Enhanced governance is typically mandatory	✅ Recommended
Is your organization comfortable with standard Oracle support access and Oracle‑managed encryption?	Risk tolerance is higher	⚠️ Optional
Do you prioritize faster support access over approval controls?	Manual approvals may add friction	⚠️ Evaluate carefully

 

Rule of thumb:

If your EPM environment is reviewed by auditors, regulators, or internal security teams — Break Glass should be part of your standard architecture.

Final Thoughts

Oracle Break Glass is one of the most important governance and security advancements EPM Cloud has seen in years.

It answers a long‑standing enterprise question:

“Can we trust the cloud — and still stay in control?”

With Break Glass, the answer is finally yes.

 

If you operate EPM in a regulated environment — or simply want enterprise‑grade control over your data — this is a feature you should be actively evaluating as part of the 26.04 release planning.