STIGQter: STIG Summary: z/OS ROSCOE for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

The ROSCOE's Resource Class is not defined or active in the ACP.

DISA Rule

SV-224340r1141634_rule

Vulnerability Number

V-224340

Group Title

SRG-OS-000309

Rule Version

ZROSA038

Severity

CAT II

CCI(s)

• CCI-000336 - After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.
• CCI-002358 - Implement a reference monitor for organization-defined access control policies that is always invoked.

Weight

10

Fix Recommendation

Use SAF security to define and protect the Products resource class(es).

Ensure that the following GSO CLASMAP record entry(ies) is (are) defined:

CLASMAP.ROSCOE ENTITYLN(nn) RESOURCE(ROSRES)
RSRCTYPE(rosid)

Note: The site determines the appropriate three letter RSRCTYPE that is unique for each Roscoe system. The ENTITYLN should be appropriate for the site's installation.

Example:

SET C(GSO)
LIST CLASMAP.ROSCOE
INSERT CLASMAP.ROSCOE ENTITYLN(39) RESOURCE(ROSRES) RSRCTYPE(ROS)

F ACF2,REFRESH(CLASMAP)

Check Contents

Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO).

If the following GSO CLASMAP record entry(ies) is (are) defined, this is not a finding.

CLASMAPqual RESOURCE(ROSRES) RSRCTYPE(rosid) ENTITYLN(nn)

Note: The site determines the appropriate three letter RSRCTYPE that is unique for each Roscoe system. The ENTITYLN should be appropriate for the site's installation.

Vulnerability Number

V-224340

Documentable

False

Rule Version

ZROSA038

Severity Override Guidance

Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO).

If the following GSO CLASMAP record entry(ies) is (are) defined, this is not a finding.

CLASMAPqual RESOURCE(ROSRES) RSRCTYPE(rosid) ENTITYLN(nn)

Note: The site determines the appropriate three letter RSRCTYPE that is unique for each Roscoe system. The ENTITYLN should be appropriate for the site's installation.

Check Content Reference

M

Target Key

4128