STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

The IBM z/OS TCPIP.DATA configuration statement must contain the DOMAINORIGIN or DOMAIN specified for each TCP/IP defined.

DISA Rule

SV-245536r991589_rule

Vulnerability Number

V-245536

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

RACF-TC-000100

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the TCPIP.DATA file to include the DOMAINORIGIN/DOMAIN (the DOMAIN statement is functionally equivalent to the DOMAINORIGIN statement).

Note:
If GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.

If GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.

Check Contents

Refer to the Data configuration file specified on the SYSTCPD DD statement in the TCPIP started task JCL.

Note:
If GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.

If GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.

If the DOMAINORIGIN/DOMAIN (the DOMAIN statement is functionally equivalent to the DOMAINORIGIN statement) is specified in the TCP/IP Data configuration file, this is not a finding.

Vulnerability Number

V-245536

Documentable

False

Rule Version

RACF-TC-000100

Severity Override Guidance

Refer to the Data configuration file specified on the SYSTCPD DD statement in the TCPIP started task JCL.

Note:
If GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.

If GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.

If the DOMAINORIGIN/DOMAIN (the DOMAIN statement is functionally equivalent to the DOMAINORIGIN statement) is specified in the TCP/IP Data configuration file, this is not a finding.

Check Content Reference

M

Target Key

4101