Oracle gives one narrow break for disaster recovery, and a replicated standby is not it. Here is the boundary, the option parity rule, and the evidence that closes the question before an auditor opens it.
Oracle's failover concession is narrow. One spare node, shared storage, a limited number of separate days a year, and only for failover. A replicated standby running Data Guard is a deployment in its own right, and it is licensable from the day the binaries are installed.
Disaster recovery is where Oracle licensing costs the most money for the least deliberate reason. Nobody sets out to buy a second full set of licenses, and almost nobody plans to be told they already needed one.
This guide separates the four recovery patterns Oracle treats differently, sets the boundary on each, and shows what evidence closes the question before an auditor opens it.
It is a single, tightly conditioned allowance for unplanned failover inside one cluster. It is not a disaster recovery exemption, and reading it as one is the most expensive mistake in this subject.
When production fails, Oracle permits one otherwise unlicensed node in the same cluster to run the database for a limited number of separate days in a calendar year. Oracle's published figure is ten, set out in the Oracle Software Investment Guide.
Read the current version of that document against your own ordering documents before you rely on it. Policy documents are not contracts, and the wording has been revised more than once.
Past the annual allowance, the failover node needs a full license for the database and for every option running on it. The concession is also silent on a number of things buyers assume it covers.
It does not cover a second site. It does not cover a standby copy. It does not cover a node used for batch, reporting, development or load balancing on any day of the year.
Oracle's guide also carries a narrow backup testing provision, commonly read as permitting a small number of short tests a year on an unlicensed machine for the purpose of testing physical copies of backups. The published wording is short and the treatment of planned failover drills has been read both ways by reasonable people.
Do not resolve that ambiguity in your own favour in a slide. Ask your Oracle contact to confirm the treatment of planned drills in writing, keep the reply, and design the runbook around the conservative reading until you have it.
Yes, in almost every real configuration. A standby holds its own copy of the data on its own storage, so it fails the shared storage condition before you get to any other test.
The licensing trigger is installation and capability, not activity. Oracle's position is that software installed on a server that can run it is licensable, which is why a standby sitting quietly in mount mode still counts.
A Data Guard standby in mount mode with redo apply running needs the same Enterprise Edition license as the primary. Data Guard itself is included in Enterprise Edition, so there is no separate Data Guard line to buy.
What people miss is the options. If the primary runs Partitioning, the standby carries the partitioned objects and needs Partitioning too. See our Active Data Guard licensing guide for where the extra option line begins.
Active Data Guard is a separately priced option, and you need it when the standby is open read only while redo apply is running. A standby that is only ever mounted does not need it.
Storage replication that copies the database files to a remote site needs a full license at the target, because Oracle software is installed there and can be started against those files. Oracle outlines the supported designs on its high availability page.
The one genuinely arguable case is a target where no Oracle binaries exist at all, so the copy cannot be opened without an installation first. That is a defensible position, and it is also a position you have to be able to prove with a build record.
Match the standby line by line against the primary. A standby licensed for the database engine alone is a partial answer, and partial answers are what audit letters are built from.
Oracle recovery patterns and what each one needs
| Recovery pattern | Database license | Options | Concession available |
|---|---|---|---|
| Clustered failover node, shared storage | Covered while the conditions hold | Confirm in writing before you rely on it | Yes, limited days per year |
| Physical standby, mounted, redo apply | Full Enterprise Edition | Every option on the primary | None |
| Standby open read only with apply | Full Enterprise Edition | Options plus Active Data Guard | None |
| Array based remote mirror with binaries present | Full Enterprise Edition | Every option on the primary | None |
| Cold backup files, no binaries, never opened | None | None | Backup treatment |
| Restored and opened for any purpose | Full Enterprise Edition | Every option used | None |
It costs the same as the primary, plus support, plus back support for every year the standby has existed. That last clause is the one that turns a design decision into a board conversation.
Take a single standby server with two sockets and eight cores per socket, running Enterprise Edition with Partitioning and Advanced Security, mirroring a primary of the same shape.
| Line | Arithmetic | Result |
|---|---|---|
| Cores on the standby | 2 sockets x 8 cores | 16 cores |
| Core factor applied | Intel Xeon at 0.5 | 8 Processor licenses |
| Enterprise Edition at list | 8 x $47,500 | $380,000 |
| Partitioning at list | 8 x $11,500 | $92,000 |
| Advanced Security at list | 8 x $15,000 | $120,000 |
| License subtotal | $380,000 + $92,000 + $120,000 | $592,000 |
| Support, one year at 22 percent | $592,000 x 0.22 | $130,240 |
| Three years of back support | $130,240 x 3 | $390,720 |
| Exposure as first presented | $592,000 + $390,720 | $982,720 |
List prices from the Oracle Technology Global Price List, before discount. Substitute your own option mix and core factor. The point is the shape of the number, not the exact figure.
Nothing in that column is unusual. It is one server, one design decision, and a support line that compounds quietly for as long as the design stays undocumented.
Put the standby in a public cloud and the counting rule changes with it. In an authorized cloud environment Oracle applies a vCPU based rule and the Processor Core Factor Table does not apply.
Oracle Cloud Infrastructure is not an authorized cloud environment. It has its own conversion rules, so do not carry an AWS or Azure calculation across to an OCI standby and assume it holds.
Backups are free until you open them, and testing is where teams trip. The line is whether Oracle software runs against the data, not whether the data exists.
A backup that is never mounted or opened does not need a license. The moment you recover and open it for use, it does. Oracle confirms the boundary in the Oracle Database Licensing Information manual.
A planned drill runs Oracle software on the target, so treat the target as licensable for the duration unless you hold written confirmation otherwise. Where the drill runs on an already licensed standby, there is no incremental question at all.
That is the cheapest fix available in this subject. Run the drill on the licensed standby rather than on an unlicensed spare, and the argument disappears.
You evidence it with four artefacts: a topology map, a dated database role extract, a storage relationship record, and a failover log. Together they answer every question an auditor can ask about recovery in a single folder.
Run this on the primary and on every standby, keep the output with a date and a hostname, and refresh it quarterly.
SELECT name, db_unique_name, database_role, open_mode,
protection_mode, switchover_status, log_mode
FROM v$database;
SELECT dest_id, dest_name, status, target, type, database_mode
FROM v$archive_dest_status
WHERE status != 'INACTIVE';DATABASE_ROLE tells you what the instance thinks it is. OPEN_MODE is the column that decides whether Active Data Guard is in play, and the value to look for is READ ONLY WITH APPLY.
The feature usage view carries an Active Data Guard row, and it is dated. Pull it on the standby before anyone else does, because it will be read as the record of whether you ever opened the standby with apply running.
If the row shows use that stopped years ago, that is a closed historic event and it should be argued as one. If it shows current use, the option is a budget line, not a debate.
A concession you cannot evidence is a concession you do not have. Keep a single register, one row per event, and review it annually against the allowance.
Shared storage is a factual question with a documentary answer. Keep the array mapping, the cluster node list and the disk group configuration together, dated, and signed off by whoever runs the storage.
In several of our reviews the DBA team believed the storage was shared and the storage team knew that it was not. Two teams, one assumption, and a license position that did not survive the first question.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
Nobody buys a standby. They design one, and the license arrives three years later with interest attached.
The common advice is that the failover concession makes most disaster recovery effectively free, so teams build a recovery site and assume no license cost. We disagree, and the evidence is not close. In roughly 6 out of 10 estates we reviewed, the concession did not even apply, because the design used a separate standby copy or failed the shared storage condition, so the site was unlicensed and exposed. The buyer side move is to classify every recovery component against the actual wording before you call any of it free, then buy the standby licenses inside a renewal where you have leverage rather than inside a compliance settlement where you have none.
Four moves remove most of the risk, and three of them cost nothing. The fourth is a commercial decision you want to make on your own timetable.
Label each node as clustered failover, standby, mirror, or backup, and write the label on the topology diagram. The label sets the license rule, and an unlabelled node defaults to the expensive answer.
Confirm in writing that the failover node shares storage with production. If it does not, the concession does not apply and the node is a licensed node from the day it was built.
Log every event with a date, a node and a reason, and keep the two categories apart. A single register that mixes drills with failovers destroys the evidence value of both.
If you know the standby needs licensing, put it on the next order rather than waiting to be told. The same product bought as a planned purchase and bought as a compliance remedy are two very different conversations.
Ask for the standby quantity to be named on the ordering document, ask for the option lines to match the primary explicitly, and ask how the support base will be recalculated. Silence on any of those three is where next year's surprise lives.
It lets one otherwise unlicensed node in a cluster run Oracle during failover for a limited number of separate days per calendar year, published by Oracle as ten. The failover node must share storage with production, and any part of a day counts as a full day.
No. A Data Guard standby is a separate copy of the database on its own storage, so it fails the shared storage condition. It must be fully licensed for Enterprise Edition and every matching option, with no relief.
Only when the standby is open read only while redo apply is running. A standby that stays in mount mode with apply running needs Enterprise Edition and the primary's options, but not the Active Data Guard option.
Yes. Partitioning, Advanced Security, Advanced Compression and the rest apply on the standby wherever the data or the configuration uses them. A standby licensed for the engine alone is the most common partial finding we see.
Yes, where Oracle software is installed at the target and could be started against the replicated files. The replication technology does not change the position, and the only arguable case is a target with no Oracle installation at all.
A backup that is never mounted or opened does not need a license. The moment you restore and open it for use, it becomes a running deployment and needs a full license like any other.
Oracle's published wording is short on this point and has been read both ways, so get the treatment confirmed in writing. The safe design is to run drills on already licensed hardware, which removes the question entirely.
Not as a Data Guard standby for an Enterprise Edition primary, because Data Guard is an Enterprise Edition feature and editions cannot be mixed that way. Standard Edition 2 has also included no form of Real Application Clusters since 19c, so cluster based designs need a rethink.
In an authorized cloud environment Oracle counts vCPUs under its cloud policy and the Processor Core Factor Table does not apply. Oracle Cloud Infrastructure is not an authorized cloud environment and uses its own ratios, so never carry an AWS or Azure calculation across to OCI.
Keep a failover register with dates, node names, incident references and the running annual total. A dated log maintained before the audit is worth more than any reconstruction afterwards.
The governance, renewal and negotiation moves that hold Oracle cost across a five year horizon.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.