STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for TSS Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

DISA Rule

SV-224732r1146380_rule

Vulnerability Number

V-224732

Group Title

SRG-OS-000104

Rule Version

ZCIC0040

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure the following items are in effect for each CICS region ACID:

A unique ACID is associated with the CICS region.
No access to interactive online facilities (e.g., TSO) other than CICS.
CICS region ACID does not have any BYPASS privilege.
CICS region ACID is associated with a TSS CICS facility. (The ISSO will determine the MASTFAC used.)
CICS region is defined in the STC table.

For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACID).
- TSSCMDS.RPT(#STC).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

If the following items are in effect for each CICS region ACID, this is not a finding.

A unique ACID is associated with the CICS region.
No access to interactive online facilities (e.g., TSO) other than CICS.
CICS region ACID does not have any BYPASS privilege. EXCEPT: NOSUBCHK - REQUIRED FOR CICS REGIONS TO SUBMIT BATCH PROCESSING/JOBS OF THE USER WHO IS LOGGED INTO CICS.
Ensure that each CICS region ACID is associated with a TSS CICS facility. For example:

TSS ADD(CICS region ACID) MASTFAC(CICS facility)
CICS region is defined in the STC table. For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

Vulnerability Number

V-224732

Documentable

False

Rule Version

ZCIC0040

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACID).
- TSSCMDS.RPT(#STC).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

If the following items are in effect for each CICS region ACID, this is not a finding.

A unique ACID is associated with the CICS region.
No access to interactive online facilities (e.g., TSO) other than CICS.
CICS region ACID does not have any BYPASS privilege. EXCEPT: NOSUBCHK - REQUIRED FOR CICS REGIONS TO SUBMIT BATCH PROCESSING/JOBS OF THE USER WHO IS LOGGED INTO CICS.
Ensure that each CICS region ACID is associated with a TSS CICS facility. For example:

TSS ADD(CICS region ACID) MASTFAC(CICS facility)
CICS region is defined in the STC table. For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

Check Content Reference

M

Target Key

4195