STIGQter: STIG Summary: z/OS BMC MAINVIEW for z/OS for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

BMC Mainview for z/OS Resource Class will be defined or active in the ACP.

DISA Rule

SV-224254r1141592_rule

Vulnerability Number

V-224254

Group Title

SRG-OS-000309

Rule Version

ZMVZA038

Severity

CAT II

CCI(s)

• CCI-002358 - Implement a reference monitor for organization-defined access control policies that is always invoked.
• CCI-000336 - After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.

Weight

10

Fix Recommendation

Use SAF security to define and protect the Products resouceresource class(es).

Ensure that the following GSO CLASMAP record entry(ies) is (are) defined:

CLASMAP.class RESOURCE(class) RSRCTYPE(type) ENTITYLN(nn)

Note: The site determines the appropriate three letter RSRCTYPE that is unique for Mainview. The ENTITYLN should be appropriate for the site's installation.

Example:

SET C(GSO)
LIST CLASMAP.BMCVIEW
INSERT CLASMAP.BMCVIEW ENTITYLN(39) RESOURCE(BMCVIEW) RSRCTYPE(BBM)

F ACF2,REFRESH(CLASMAP)

Ensure that the following GSO SAFDEF record entry(ies) is (are) defined:

SAFDEF.ssid ID(BBCS) MODE(GLOBAL)REP RACROUTE(SUBSYS=ssid REQSTOR=-)

Example:

ACF
SET C(GSO)
LIST SAFDEF.ssid
INSERT SAFDEF.ssid ID(BBCS) MODE(GLOBAL)REP RACROUTE(SUBSYS=ssid REQSTOR=-)

F ACF2,REFRESH(SAFDEF)

Check Contents

Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO).

If the following GSO CLASMAP record entry(ies) is (are) defined, this is not a finding.

CLASMAP.class RESOURCE(class) RSRCTYPE(type) ENTITYLN(nn)

Note: The site determines the appropriate three letter RSRCTYPE that is unique for Mainview. The ENTITYLN should be appropriate for the site's installation.

If the following GSO SAFDEF record entries are defined this not a finding.

INSERT SAFDEF.ssid ID(BBCS) MODE(GLOBAL)REP -
RACROUTE(SUBSYS=ssid REQSTOR=-)

Vulnerability Number

V-224254

Documentable

False

Rule Version

ZMVZA038

Severity Override Guidance

Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO).

If the following GSO CLASMAP record entry(ies) is (are) defined, this is not a finding.

CLASMAP.class RESOURCE(class) RSRCTYPE(type) ENTITYLN(nn)

Note: The site determines the appropriate three letter RSRCTYPE that is unique for Mainview. The ENTITYLN should be appropriate for the site's installation.

If the following GSO SAFDEF record entries are defined this not a finding.

INSERT SAFDEF.ssid ID(BBCS) MODE(GLOBAL)REP -
RACROUTE(SUBSYS=ssid REQSTOR=-)

Check Content Reference

M

Target Key

4109