STIGQter STIGQter: STIG Summary: CA IDMS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

CA IDMS must prevent user code from issuing selected SVC privileged functions.

DISA Rule

SV-251644r1137659_rule

Vulnerability Number

V-251644

Group Title

SRG-APP-000431-DB-000388

Rule Version

IDMS-DB-000800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Set #SVCOPT parameters CVKEY to the chosen key for startup modules and AUTHREQ=YES to create a secured SVC. Assemble, relink and install SVC. Create an entry in the Z/OS PPT for the startup module in the chosen key.

All IDMS CV startup modules must reside in an authorized library and must be linked as authorized (SETCODE AC(1)).

The IBM Z/OS parameter AllowUserKeyCsa should also be checked since the setting may impact the CVKEY choice (see TEC574934 for details).

Check Contents

Log on to IDMS DC system. Issue DCMT D MEM SVC+6D0 to get address of SVC options (svcopt-addr). Issue DCMT D MEM svcopt-addr. With all lengths of 1, at offset 1 is the SVC number, offset 3 contains CVKEY number, offset x' D' contains a flag byte where a setting of X'20' indicates AUTHREQ=YES. If there is no valid number for CVKEY and the flag byte of X'20' is not set, this is a finding.

Note: Offsets are subject to change.

Vulnerability Number

V-251644

Documentable

False

Rule Version

IDMS-DB-000800

Severity Override Guidance

Log on to IDMS DC system. Issue DCMT D MEM SVC+6D0 to get address of SVC options (svcopt-addr). Issue DCMT D MEM svcopt-addr. With all lengths of 1, at offset 1 is the SVC number, offset 3 contains CVKEY number, offset x' D' contains a flag byte where a setting of X'20' indicates AUTHREQ=YES. If there is no valid number for CVKEY and the flag byte of X'20' is not set, this is a finding.

Note: Offsets are subject to change.

Check Content Reference

M

Target Key

5418