STIGQter: STIG Summary: zOS WebSphere MQ for TSS Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 01 Jul 2026:

Production WebSphere MQ Remotes must utilize Certified Name Filters (CNF).

DISA Rule

SV-225625r1146204_rule

Vulnerability Number

V-225625

Group Title

SRG-OS-000480

Rule Version

ZWMQ0014

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

The responsible MQ systems programmer(s) will create and maintain a spreadsheet that contains a list of all Production WebSphere MQ Remotes and associated individual USERIDs with corresponding valid Certified Name Filters (CNF). This documentation will be reviewed and validated annually by responsible MQ systems programmer(s) and forwarded for approval by the ISSM.

The ISSO will define the associated USERIDs, the CNF, and grant the minimal need-to-know access, by granting only the required resources and commands for each USERID in the ACP. Refer to the IBM WebSphere MQ Security manual for details on defining CNF for WebSphere MQ.

Generic access will not be granted, such as resource permission at the SSID MQ resource level.

Check Contents

Validate that the list of all Production WebSphere MQ Remotes exist, and contains approved Certified Name Filters and associated USERIDS.

If the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding.

If there is no Certificate Name Filter for WebSphere MQ Remotes this is a finding.

Note: Improper use of CNF filters for MQ Series will result in the following Message ID.

CSQX632I found in the following example:

CSQX632I csect-name SSL certificate has no
associated user ID, remote channel
channel-name - channel initiator user ID
used

Vulnerability Number

V-225625

Documentable

False

Rule Version

ZWMQ0014

Severity Override Guidance

Validate that the list of all Production WebSphere MQ Remotes exist, and contains approved Certified Name Filters and associated USERIDS.

If the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding.

If there is no Certificate Name Filter for WebSphere MQ Remotes this is a finding.

Note: Improper use of CNF filters for MQ Series will result in the following Message ID.

CSQX632I found in the following example:

CSQX632I csect-name SSL certificate has no
associated user ID, remote channel
channel-name - channel initiator user ID
used

Check Content Reference

M

Target Key

4211