STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for RACF Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

DISA Rule

SV-224495r1144706_rule

Vulnerability Number

V-224495

Group Title

SRG-OS-000104

Rule Version

ZCIC0040

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure that the following is defined for each CICS region:

A unique userid is defined.

Use the RACF Adduser command to accomplish this. A sample command is provided here:

AU <cicsregionid> NAME('STC, CICS Region') DFLTGRP(STC) OWNER(STC)

Defined to the STARTED resource class.

Use the RACF RDEFINE command. A sample is provided here:

RDEF STARTED <cicsprocname>.** UACC(NONE) OWNER(ADMIN) DATA('USED TO MAP <cicsprocname> TO A VALID RACF USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(LISTUSER).
- DSMON.RPT(RACCDT).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

If the following is defined for each CICS region, this is not a finding.

A unique userid is defined.
Defined to the STARTED resource class.

Vulnerability Number

V-224495

Documentable

False

Rule Version

ZCIC0040

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(LISTUSER).
- DSMON.RPT(RACCDT).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

If the following is defined for each CICS region, this is not a finding.

A unique userid is defined.
Defined to the STARTED resource class.

Check Content Reference

M

Target Key

4154