STIGQter STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

Sensitive CICS transactions are not protected in accordance with the proper security requirements.

DISA Rule

SV-224312r1141402_rule

Vulnerability Number

V-224312

Group Title

SRG-OS-000480

Rule Version

ZCICA024

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

The systems programmer and ISSO will ensure the ACF2/CICS parameter SAFELIST are coded with the values specified below.

Browse the ACF2/CICS dataset allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

Ensure the following items are in effect for entries specified in the SAFELIST parameter:

Transactions are uniquely identified.
Transactions are not masked.
Sensitive transactions are not included.

Note: For information on transactions that are eligible for exemption from security checking, refer to Category 3 Transactions for CICS TS 3.1 - 5.1 in the z/OS STIG addendum.

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Browse the ACF2/CICS dataset allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

If the following items are in effect for entries specified in the SAFELIST parameter, this is not a finding.

Transactions are uniquely identified.
Transactions are not masked.
Sensitive transactions are not included.

Note: For information on transactions that are eligible for exemption from security checking, refer to Category 3 Transactions for CICS TS 3.1 - 5.1 in the z/OS STIG addendum.

If the above items are true for all entries specified in the SAFELIST parameter for each CICS region, this is not a finding.

Vulnerability Number

V-224312

Documentable

False

Rule Version

ZCICA024

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Browse the ACF2/CICS dataset allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

If the following items are in effect for entries specified in the SAFELIST parameter, this is not a finding.

Transactions are uniquely identified.
Transactions are not masked.
Sensitive transactions are not included.

Note: For information on transactions that are eligible for exemption from security checking, refer to Category 3 Transactions for CICS TS 3.1 - 5.1 in the z/OS STIG addendum.

If the above items are true for all entries specified in the SAFELIST parameter for each CICS region, this is not a finding.

Check Content Reference

M

Target Key

4122