STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

ACF2 PSWD GSO record value must be set to prohibit password reuse for a minimum of five generations or more.

DISA Rule

SV-223508r1225738_rule

Vulnerability Number

V-223508

Group Title

SRG-OS-000077-GPOS-00045

Rule Version

ACF2-ES-000910

Severity

CAT II

CCI(s)

CCI-004061 - For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
CCI-004065 - For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.

Weight

Fix Recommendation

Configure Password option "PSWXHST" is coded and "PSWXHST#" is "5" or greater.

Check Contents

From an ACF command screen enter:
SET CONTROL(GSO)
LIST PSWD

If "PSWDXHIST" is not specified, this is a finding.

If "PSWDXHIST#" is set to "5" or greater, this is not a finding.

Vulnerability Number

V-223508

Documentable

False

Rule Version

ACF2-ES-000910

Severity Override Guidance

From an ACF command screen enter:
SET CONTROL(GSO)
LIST PSWD

If "PSWDXHIST" is not specified, this is a finding.

If "PSWDXHIST#" is set to "5" or greater, this is not a finding.

Check Content Reference

Target Key

4100