STIGQter: STIG Summary: z/OS CA 1 Tape Management for TSS STIG Version: 6 Release: 8 Benchmark Date: 25 Oct 2019:

CA 1 Tape Management user exits, when in use, must be reviewed and/or approved.

DISA Rule

SV-40108r2_rule

Vulnerability Number

V-17985

Group Title

ZB000060

Rule Version

ZCA10060

Severity

CAT II

CCI(s)

• CCI-000035 - The information system provides the capability for privileged administrators to configure the organization-defined security policy filters to support different security policies.

Weight

10

Fix Recommendation

Ensure that the site ISSO has reviewed, evaluated, and approved the usage of CA 1 user exits, TMSUXnA and TMSUXnS (for r11.5 and below) or TMSXITA and TMSXITS (for r12.0 and above). If one or both user exits are installed and the following requirements will be followed:

The usage and function of the user exit(s) is fully documented.

The use of the user exit(s) is approved.

All associated documentation is on file with the ISSO.

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- CA1RPT(TMSCKLVL)

Determine if CA 1 user exits, TMSUXnA and TMSUXnS (for r11.5 and below) or TMSXITA and TMSXITS (for r12.0 and above) are active.

If both CA 1 user exits are not found, this is not a finding.

If one or both user exits are installed and the following requirements are true, this is not a finding:

___ The usage and function of the user exit(s) is fully documented.
___ The use of the user exit(s) is approved.
___ All associated documentation is on file with the ISSO.

Vulnerability Number

V-17985

Documentable

False

Rule Version

ZCA10060

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- CA1RPT(TMSCKLVL)

Determine if CA 1 user exits, TMSUXnA and TMSUXnS (for r11.5 and below) or TMSXITA and TMSXITS (for r12.0 and above) are active.

If both CA 1 user exits are not found, this is not a finding.

If one or both user exits are installed and the following requirements are true, this is not a finding:

___ The usage and function of the user exit(s) is fully documented.
___ The use of the user exit(s) is approved.
___ All associated documentation is on file with the ISSO.

Check Content Reference

M

Responsibility

Systems Programmer

Target Key

2189

Comments