STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

CA-ACF2 must limit Write or greater access to SYS1.UADS To system programmers only and read and update access must be limited to system programmer personnel and/or security personnel.

DISA Rule

SV-223441r1225673_rule

Vulnerability Number

V-223441

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

ACF2-ES-000200

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Evaluate the impact of correcting any deficiency. Develop a plan of action and implement the changes as required to protect SYS1.UADS.

SYS1.UADS WRITE or Greater authority is limited to the systems programming staff.

READ and/or WRITE access should be limited to the security staff.

READ access is limited to Auditors when included in the site security plan

Configure allocate access to SYS1.UADS to be limited to system programmers only; Read and Update access to SYS1.UADS to be limited to system programmer personnel and/or security personnel and all dataset access is logged.

Check Contents

The ACF2 data set rules for SYS1.UADS restrict ALLOCATE access to only z/OS systems programming personnel.

The ACF2 data set rules for SYS1.UADS restrict READ and/or WRITE access to z/OS systems programming personnel and/or security personnel.

The ACF2 data set rules for SYS1.UADS restrict READ access to auditors as documented in the Security Plan.

The ACF2 data set rules for SYS1.UADS specify that all (i.e., failures and successes) data set access authorities (i.e., READ, WRITE, ALLOCATE, and CONTROL) will be logged.

If all of the above are untrue, this is not a finding.

If any of the above is true, this is a finding.

Vulnerability Number

V-223441

Documentable

False

Rule Version

ACF2-ES-000200

Severity Override Guidance

The ACF2 data set rules for SYS1.UADS restrict ALLOCATE access to only z/OS systems programming personnel.

The ACF2 data set rules for SYS1.UADS restrict READ and/or WRITE access to z/OS systems programming personnel and/or security personnel.

The ACF2 data set rules for SYS1.UADS restrict READ access to auditors as documented in the Security Plan.

The ACF2 data set rules for SYS1.UADS specify that all (i.e., failures and successes) data set access authorities (i.e., READ, WRITE, ALLOCATE, and CONTROL) will be logged.

If all of the above are untrue, this is not a finding.

If any of the above is true, this is a finding.

Check Content Reference

M

Target Key

4100