STIGQter: STIG Summary: z/OS Catalog Solutions for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

Catalog Solutions resources must be properly defined and protected.

DISA Rule

SV-224273r1141430_rule

Vulnerability Number

V-224273

Group Title

SRG-OS-000018

Rule Version

ZCSLA020

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002234 - Log the execution of privileged functions.

Weight

10

Fix Recommendation

The ISSO will work with the systems programmer to verify that the following are properly specified in the ACP.

(Note: The resource type, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is installed on a system through the product's installation guide and can be site specific.)

Ensure that all Catalog Solutions resources and/or generic equivalent are properly protected according to the requirements specified in Catalog Solutions Resources table in the z/OS STIG Addendum.

Use Catalog Solutions Resources table in the z/OS STIG Addendum. This table lists the resources, access requirements, and logging requirements for Catalogued Solutions. Ensure the following guidelines are followed:

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging is correctly specified.

The following commands are provided as a sample for implementing resource controls:

$KEY(hlq1) TYPE(FAC)
hlq2.GLOBAL.DATASET UID(dasdaudt) LOG
hlq2.GLOBAL.DATASET UID(dasbaudt) LOG
hlq2.GLOBAL.DATASET UID(syspaudt) LOG
hlq2.GLOBAL.DATASET UID(*) PREVENT
- UID(*) PREVENT

Check Contents

Refer to the following report produced by the ACF2 Data Collection and dataset and Resource Data Collection:

- SENSITVE.RPT(ZCSL0020).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZCSL0020).

Verify that all Catalog Solutions resources and/or generic equivalents are properly protected according to the requirements specified in Catalog Solutions Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging is correctly specified.

Vulnerability Number

V-224273

Documentable

False

Rule Version

ZCSLA020

Severity Override Guidance

Refer to the following report produced by the ACF2 Data Collection and dataset and Resource Data Collection:

- SENSITVE.RPT(ZCSL0020).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZCSL0020).

Verify that all Catalog Solutions resources and/or generic equivalents are properly protected according to the requirements specified in Catalog Solutions Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.

The ACF2 resources are defined with a default access of PREVENT.

The ACF2 resource access authorizations restrict access to the appropriate personnel.

The ACF2 resource logging is correctly specified.

Check Content Reference

M

Target Key

4111