STIGQter STIGQter: STIG Summary: CA IDMS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

IDMS must support the implementation of an external security manager (ESM) to handle account management and user accesses, etc.

DISA Rule

SV-251583r1043176_rule

Vulnerability Number

V-251583

Group Title

SRG-APP-000023-DB-000001

Rule Version

IDMS-DB-000020

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

The SRTT module must be coded to enable the desired security. When using an ESM, this could be done in the following manner:

#SECRTT TYPE=ENTRY, X
RESTYPE=SGON, X
SECBY=EXTERNAL , X
EXTNAME=(RESNAME), X
EXTCLS='CA@IDMS'

The RESNAME will be derived from the SYSTEM ID name in SYSGEN.

After making the above changes, ensure the ESM has the appropriate rules defined to give access to the desired users. For example, in a Top Secret environment where the SYSGEN SYSTEM ID is SYSO187:
TSS PER(user-id) CA@IDMS(SYSO187)

Also assemble and link RHDCSRTT to create a new SRTT. To implement the new SRTT, either recycle any CVs that use the SRTT or issue these commands:

DCMT VARY NUCLEUS MODULE RHDCSRTT NEW COPY
DCMT VARY NUCLEUS RELOAD

Check Contents

When securing IDMS user IDs with an ESM, some preparation must be done in IDMS itself. Identify CA IDMS security domains (a set of DC systems and local mode applications sharing a single user catalog and SRTT). For a given security domain, logon to one DC system.

Issue DCPROFIL. If there is nothing specified for "Security System" and therefore no external security system being used, this is a finding.

Examine load module RHDCSRTT by executing CA IDMS utility "IDMSSRTD", or by issuing command "DCMT DISPLAY SRTT" while signed onto the CV, and reviewing the output.

Note: This requires PTFs SO07995 and SO09476.

If no TYPE=ENTRY with RESTYPE=SGON is found, this is a finding.

If RESTYPE=SGON is secured internally, this is a finding.

Interrogate the security office and verify the ESM has the appropriate entries to secure the RESTYPE of SGON. If not, this is a finding.

Vulnerability Number

V-251583

Documentable

False

Rule Version

IDMS-DB-000020

Severity Override Guidance

When securing IDMS user IDs with an ESM, some preparation must be done in IDMS itself. Identify CA IDMS security domains (a set of DC systems and local mode applications sharing a single user catalog and SRTT). For a given security domain, logon to one DC system.

Issue DCPROFIL. If there is nothing specified for "Security System" and therefore no external security system being used, this is a finding.

Examine load module RHDCSRTT by executing CA IDMS utility "IDMSSRTD", or by issuing command "DCMT DISPLAY SRTT" while signed onto the CV, and reviewing the output.

Note: This requires PTFs SO07995 and SO09476.

If no TYPE=ENTRY with RESTYPE=SGON is found, this is a finding.

If RESTYPE=SGON is secured internally, this is a finding.

Interrogate the security office and verify the ESM has the appropriate entries to secure the RESTYPE of SGON. If not, this is a finding.

Check Content Reference

M

Target Key

5418