STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for RACF Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

External RACF Classes are not active for CICS transaction checking.

DISA Rule

SV-224499r1144716_rule

Vulnerability Number

V-224499

Group Title

SRG-OS-000080

Rule Version

ZCICR038

Severity

CAT II

CCI(s)

• CCI-000336 - After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.
• CCI-002358 - Implement a reference monitor for organization-defined access control policies that is always invoked.

Weight

10

Fix Recommendation

Review each CICS SIT to ensure each region has a unique resource class or resource prefix specified.

The resources classes are activated in RACF using the following command: SETR CLASSACT(<classname>)

Check Contents

Refer to the following report produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

If each CICS transaction resource class pair are active, this is a finding.

Vulnerability Number

V-224499

Documentable

False

Rule Version

ZCICR038

Severity Override Guidance

Refer to the following report produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

If each CICS transaction resource class pair are active, this is a finding.

Check Content Reference

M

Target Key

4154