STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

IBM RACF user accounts must uniquely identify system users.

DISA Rule

SV-223722r998345_rule

Vulnerability Number

V-223722

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

RACF-ES-000750

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-004045 - Require users to be individually authenticated before granting access to the shared accounts or resources.
• CCI-000804 - Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
• CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Identify user accounts defined to the ESM that are being shared among multiple users. This may require interviews with appropriate system-level support personnel. Remove the shared user accounts from the ESM.

Check Contents

Obtain a list of all userids that are shared among multiple users (i.e., not uniquely identified system users).

If there are no shared userids on this domain, this is not a finding.

If there are shared userids on this domain, this is a finding.

Vulnerability Number

V-223722

Documentable

False

Rule Version

RACF-ES-000750

Severity Override Guidance

Obtain a list of all userids that are shared among multiple users (i.e., not uniquely identified system users).

If there are no shared userids on this domain, this is not a finding.

If there are shared userids on this domain, this is a finding.

Check Content Reference

M

Target Key

4101