STIGQter: STIG Summary: z/OS CL/SuperSession for RACF Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

CL/SuperSessions Resouce Class must be defined or active in the ACP.

DISA Rule

SV-224467r1144737_rule

Vulnerability Number

V-224467

Group Title

SRG-OS-000309

Rule Version

ZCLSR038

Severity

CAT II

CCI(s)

• CCI-000336 - After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.
• CCI-002358 - Implement a reference monitor for organization-defined access control policies that is always invoked.

Weight

10

Fix Recommendation

Ensure that the CL/SuperSession Resource Class(es) is (are) active. The SYS3.OMEGAMON.qualifier.RLSPARM(KLKINNAM) member for Version 3 of CL/Supersession or the SYS3.OMEGAMON.qualifier.RLSPARM(KLVINNAM) member for version 2 of CL/Supersession contains a "CLASSES=" entry, this entry identifies the member that contains the "VGWAPLST EXTERNAL=" entry. The "VGWAPLST EXTERNAL=" entry identifies the resource class that is used by CL/SuperSession and this resource class will be active. Current guidance identifies that APPL is the resource class identified in the above location.

Use the following commands as an example:

SETROPTS CLASSACT(APPL)

Check Contents

Refer to the following report produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS).

Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession)
Refer to the following report produced by the RACF Data Collection:

- PDI(ZCLSR038).

If the CL/SuperSession resource class(es) is (are) active, this is not a finding.

Vulnerability Number

V-224467

Documentable

False

Rule Version

ZCLSR038

Severity Override Guidance

Refer to the following report produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS).

Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession)
Refer to the following report produced by the RACF Data Collection:

- PDI(ZCLSR038).

If the CL/SuperSession resource class(es) is (are) active, this is not a finding.

Check Content Reference

M

Target Key

4148