STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for TSS Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.

DISA Rule

SV-224733r1146382_rule

Vulnerability Number

V-224733

Group Title

SRG-OS-000104

Rule Version

ZCIC0041

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure the following items are in effect for the CICS default ACID (i.e., DFLTUSER=default userid):

Not granted the TSS BYPASS privilege.

No access to interactive online facilities (e.g., TSO) other than CICS.

OPTIME parameter is set to 15 minutes. Can be increased up to 30 if justified by the ISSM.

Restricted from accessing all data sets and resources with the following exceptions:

(a) Non-restricted CICS transactions (e.g., CESF,
CESN, 'good morning' transaction, etc.).

(b) If applicable, resources necessary to operate in an
intersystem communication (ISC) environment (i.e.,
LU6.1, LU6.2, and MRO).

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection:

- TSSCMDS.RPT(@ACIDS).
- SENSITVE.RPT(WHOHOTRA).

Refer to the information gathered from the CICS Systems Programmer's Worksheet filled out from previous vulnerability ZCIC0010.

Ensure the following items are in effect for the CICS default ACID (i.e., DFLTUSER=default userid). If the following guidance is true, this is not a finding.

Not granted the TSS BYPASS privilege.
No access to interactive online facilities (e.g., TSO) other than CICS.
OPTIME parameter is set to 15 minutes.

A system's default time for terminal lockout or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a timeout adjusted beyond the 15-minute recommendation to explain the basis for this decision.

Restricted from accessing all data sets and resources with the following exceptions:

Non-restricted CICS transactions (e.g., CESF, CESN, 'good morning' transaction, etc.).
If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO).

Note: Refer to the IBM CICS Transaction Server Resource Definition Guide for latest and most accurate definition for the Default CICS User.
Note: Any exceptions to these guidelines must be approved by the site ISSO and documented in site security plan.

Vulnerability Number

V-224733

Documentable

False

Rule Version

ZCIC0041

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection:

- TSSCMDS.RPT(@ACIDS).
- SENSITVE.RPT(WHOHOTRA).

Refer to the information gathered from the CICS Systems Programmer's Worksheet filled out from previous vulnerability ZCIC0010.

Ensure the following items are in effect for the CICS default ACID (i.e., DFLTUSER=default userid). If the following guidance is true, this is not a finding.

Not granted the TSS BYPASS privilege.
No access to interactive online facilities (e.g., TSO) other than CICS.
OPTIME parameter is set to 15 minutes.

A system's default time for terminal lockout or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a timeout adjusted beyond the 15-minute recommendation to explain the basis for this decision.

Restricted from accessing all data sets and resources with the following exceptions:

Non-restricted CICS transactions (e.g., CESF, CESN, 'good morning' transaction, etc.).
If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO).

Note: Refer to the IBM CICS Transaction Server Resource Definition Guide for latest and most accurate definition for the Default CICS User.
Note: Any exceptions to these guidelines must be approved by the site ISSO and documented in site security plan.

Check Content Reference

M

Target Key

4195