STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

The IBM z/OS system must use a time protocol that syncs with an authoritative external time source.

DISA Rule

SV-223552r1225778_rule

Vulnerability Number

V-223552

Group Title

SRG-OS-000355-GPOS-00143

Rule Version

ACF2-OS-000160

Severity

CAT II

CCI(s)

• CCI-004923 - Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.

Weight

10

Fix Recommendation

Coordinate with system staff to determine the best time protocols available for the z/OS systems at the site. SNT is one protocol available.
Obtain a copy of this sample procedure from SEZAINST and store it in one of the PROCLIB concatenation data sets.

Perform the following to start SNTPD as a procedure:
Invoke the procedure using the system operator start command. The following sample, SEZAINST(SNTPD), shows how to start SNTPD as a procedure:
//*
//* Sample procedure for the Simple Network Time Protocol (SNTP)
//*
//* z/OS Communications Server Version 1 Release 13
//* SMP/E Distribution Name: SEZAINST(EZASNPRO)
//*
//* Copyright: Licensed Materials - Property of IBM
//* 5650-ZOS
//* Copyright IBM Corp. 2002, 2015
//*
//* Status: CSV2R2
//*
//SNTPD EXEC PGM=SNTPD,REGION=4096K,TIME=NOLIMIT,
//PARM='/ -d'
//SYSPRINT DD SYSOUT=*,DCB=(RECFM=F,LRECL=132,BLKSIZE=132)
//SYSIN DD DUMMY
//SYSERR DD SYSOUT=*
//SYSOUT DD SYSOUT=*,DCB=(RECFM=F,LRECL=132,BLKSIZE=132)
//CEEDUMP DD SYSOUT=*
//SYSABEND DD SYSOUT=*

Check Contents

Verify the operating system, for networked systems, compares internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

If it does not, this is a finding.

Vulnerability Number

V-223552

Documentable

False

Rule Version

ACF2-OS-000160

Severity Override Guidance

Verify the operating system, for networked systems, compares internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

If it does not, this is a finding.

Check Content Reference

M

Target Key

4100