STIGQter: STIG Summary: zOS WebSphere MQ for ACF2 Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 01 Jul 2026:

WebSphere MQ connection class resources must be protected in accordance with security.

DISA Rule

SV-224362r1144165_rule

Vulnerability Number

V-224362

Group Title

SRG-OS-000080

Rule Version

ZWMQ0052

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Ensure all connections to WebSphere MQ resources are restricted using connection security.

Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class):

Resource Authorized Users
ssid.BATCH TSO and batch job userids
ssid.CICS CICS region userids
ssid.IMS IMS region userids
ssid.CHIN Channel initiator userids

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

For all connection resources defined to TYPE(MQK), ensure the following items are in effect:

Access authorization to these connections restricts access to the appropriate users as indicated above.

All access FAILURE is logged.

Example:

$KEY(ssid) TYPE(MQK)
BATCH UID(STCssid) SERVICE(READ)
BATCH UID(syspaudt) SERVICE(READ)
BATCH UID(*) PREVENT
CHIN UID(STCssidCHIN) SERVICE(READ)
CHIN UID(*) PREVENT
CICS UID(*) PREVENT
IMS UID(*) PREVENT

Check Contents

Refer to the following report produced by the ACF2 Data Collection:

- SENSITVE.RPT(MQCONN).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Review the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class):

Resource Authorized Users
ssid.BATCH TSO and batch job userids
ssid.CICS CICS region userids
ssid.IMS IMS region userids
ssid.CHIN Channel initiator userids

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

For all connection resources defined to TYPE(MQK) (i.e., MQCONN resource class). If the following guidance is true, this is not a finding.

Access authorization to these connections restricts access to the appropriate users as indicated above.
All access FAILUREs are logged.

Vulnerability Number

V-224362

Documentable

False

Rule Version

ZWMQ0052

Severity Override Guidance

Refer to the following report produced by the ACF2 Data Collection:

- SENSITVE.RPT(MQCONN).
- ACF2CMDS.RPT(RESOURCE) - Alternate report.

Review the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class):

Resource Authorized Users
ssid.BATCH TSO and batch job userids
ssid.CICS CICS region userids
ssid.IMS IMS region userids
ssid.CHIN Channel initiator userids

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

For all connection resources defined to TYPE(MQK) (i.e., MQCONN resource class). If the following guidance is true, this is not a finding.

Access authorization to these connections restricts access to the appropriate users as indicated above.
All access FAILUREs are logged.

Check Content Reference

M

Target Key

4133