STIGQter: STIG Summary: z/OS BMC CONTROL-M for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

BMC C0NTROL-M resources must be properly defined and protected.

DISA Rule

SV-224118r1141462_rule

Vulnerability Number

V-224118

Group Title

SRG-OS-000018

Rule Version

ZCTMA020

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002234 - Log the execution of privileged functions.

Weight

10

Fix Recommendation

Verify that the following are properly specified in the ACP.

Note: To determine what resource class is used review the IOACLASS setting in SECPARM. The "Trigger" resources, i.e., $$SECxxx (xxx is unique to the product) are defined in the FACILITY resource class

(Note: The resource class, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource class, resources, and/or resource prefixes are determined when the product is installed on a system through the product's installation guide and can be site specific.)

Use BMC CONTROL-M Resources and BMC INCONTROL Resources Descriptions tables in the zOS STIG Addendum. These tables list the resources, descriptions, and access and logging requirements. Ensure the guidelines for the resources and/or generic equivalent specified in the z/OS STIG Addendum are followed.

Note: It is the responsibility of the ISSM to determine and document appropriate personnel for access in accordance with DoD 8500.1 para 18(a),(b),(c).

The following commands are provided as a sample for implementing resource controls:

$key($$ctmpnl3) type(ioa)
- uid(BMC STCs) allow
- uid(<operaudt>) allow
- uid(<pcspaudt>) allow
- uid(<syspaudt>) allow
- uid(*) prevent

Check Contents

Refer to the following report produced by the ACF2 Data Collection and dataset and Resource Data Collection:

- SENSITVE.RPT(ZCTM0020).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZCTM0020).

Verify that the accesses to resources and/or generic equivalent are properly restricted according to the requirements specified in BMC CONTROL-M Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.

Note: To determine what resource class is used review the IOACLASS setting in SECPARM. The "Trigger" resources, i.e., $$SECxxx (xxx is unique to the product) are defined in the FACILITY resource class.

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging requirements are specified.

Vulnerability Number

V-224118

Documentable

False

Rule Version

ZCTMA020

Severity Override Guidance

Refer to the following report produced by the ACF2 Data Collection and dataset and Resource Data Collection:

- SENSITVE.RPT(ZCTM0020).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZCTM0020).

Verify that the accesses to resources and/or generic equivalent are properly restricted according to the requirements specified in BMC CONTROL-M Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.

Note: To determine what resource class is used review the IOACLASS setting in SECPARM. The "Trigger" resources, i.e., $$SECxxx (xxx is unique to the product) are defined in the FACILITY resource class.

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging requirements are specified.

Check Content Reference

M

Target Key

4104