STIGQter: STIG Summary: z/OS BMC CONTROL-D for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

BMC CONTROL-D resources will be properly defined and protected.

DISA Rule

SV-224111r1141444_rule

Vulnerability Number

V-224111

Group Title

SRG-OS-000018

Rule Version

ZCTDA020

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002234 - Log the execution of privileged functions.

Weight

10

Fix Recommendation

The ISSO will work with the systems programmer to verify that the following are properly specified in the ACP.

Note: To determine what resource class is used review the IOACLASS setting in SECPARM. The "Trigger" resources, i.e., $$SECxxx (xxx is unique to the product) are defined in the FACILITY resource class

(Note: The resource class, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource class, resources, and/or resource prefixes are determined when the product is installed on a system through the product's installation guide and can be site specific.)

Use BMC CONTROL-D Resources and BMC INCONTROL Resources Descriptions tables in the zOS STIG Addendum. These tables list the resources, descriptions, and access and logging requirements. Ensure the guidelines for the resources and/or generic equivalent specified in the z/OS STIG Addendum are followed.

The following commands are provided as a sample for implementing resource controls:

$key($$addnot) type(ioa)
- uid(<appsaudt>) allow
- uid(<operaudt>) allow
- uid(<pcspaudt>) allow
- uid(<syspaudt>) allow
- uid(*) prevent

Check Contents

Refer to the following report produced by the dataset and Resource Data Collection:

- SENSITVE.RPT(ZCTD0020).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZCTD0020).

Verify that the accesses to resources and/or generic equivalent are properly restricted according to the requirements specified in BMC CONTROL-D Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.

Note: To determine what resource class is used review the IOACLASS setting in SECPARM. The "Trigger" resources, i.e., $$SECxxx (xxx is unique to the product) are defined in the FACILITY resource class

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging requirements are specified.

Vulnerability Number

V-224111

Documentable

False

Rule Version

ZCTDA020

Severity Override Guidance

Refer to the following report produced by the dataset and Resource Data Collection:

- SENSITVE.RPT(ZCTD0020).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZCTD0020).

Verify that the accesses to resources and/or generic equivalent are properly restricted according to the requirements specified in BMC CONTROL-D Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.

Note: To determine what resource class is used review the IOACLASS setting in SECPARM. The "Trigger" resources, i.e., $$SECxxx (xxx is unique to the product) are defined in the FACILITY resource class

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging requirements are specified.

Check Content Reference

M

Target Key

4103