STIGQter: STIG Summary: zOS WebSphere MQ for ACF2 Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 01 Jul 2026:

Production WebSphere MQ Remotes must utilize Certified Name Filters (CNF).

DISA Rule

SV-224356r1144158_rule

Vulnerability Number

V-224356

Group Title

SRG-OS-000480

Rule Version

ZWMQ0014

Severity

CAT II

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

The responsible MQ systems programmer(s) shall create and maintain a spreadsheet that contains a list of all Production WebSphere MQ Remotes, associated individual USERIDs with corresponding valid Certified Name Filters (CNF). This documentation will be reviewed and validated annually by responsible MQ systems programmer(s) and forwarded for approval by the ISSM.

The ISSO will define the associated USERIDs, the CNF, and grant the minimal need-to-know access by granting only the required resources and Commands for each USERID in the ACP. Refer to IBM WebSphere MQ Security manual for details on defining CNF for WebSphere MQ.

Generic access shall not be granted such as resource permission at the SSID. MQ resource level.

Check Contents

Validate that the list of all Production WebSphere MQ Remotes exists and contains approved Certified Name Filters and associated USERIDS.

If the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding.

If there is no Certificate Name Filter for WebSphere MQ Remotes this is a finding.

Note: Improper use of CNF filters for MQ Series will result in the following Message ID.

CSQX632I found in the following example:

CSQX632I csect-name SSL certificate has no
associated user ID, remote channel
channel-name - channel initiator user ID
used

Vulnerability Number

V-224356

Documentable

False

Rule Version

ZWMQ0014

Severity Override Guidance

Validate that the list of all Production WebSphere MQ Remotes exists and contains approved Certified Name Filters and associated USERIDS.

If the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding.

If there is no Certificate Name Filter for WebSphere MQ Remotes this is a finding.

Note: Improper use of CNF filters for MQ Series will result in the following Message ID.

CSQX632I found in the following example:

CSQX632I csect-name SSL certificate has no
associated user ID, remote channel
channel-name - channel initiator user ID
used

Check Content Reference

M

Target Key

4133