STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for ACF2 STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

ACF2/CICS parameter data sets are not protected in accordance with the proper security requirements.

DISA Rule

SV-7475r3_rule

Vulnerability Number

V-7091

Group Title

ZCICA011

Rule Version

ZCICA011

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

The IAO will ensure that update and allocate access to the ACF2/CICS parameter data set is limited to system programmers and security personnel.

Review the access authorizations for CICS system data sets.

UPDATE and/or ALLOCATE access to the ACF2/CICS parameter data set, specified on the ACF2PARM DD statement, is restricted to systems programming personnel and security personnel.

Example:

$KEY(S3C)
$PREFIX(SYS3)
CICSTS.SYSIN UID(syspaudt) R(A) W(L) A(L) E(A)
CICSTS.SYSIN UID(secaaudt) R(A) W(L) A(L) E(A)
CICSTS.SYSIN UID(*) PREVENT

SET RULE
COMPILE 'ACF2.MVA.DSNRULES(S3C)' STORE

Check Contents

a) Refer to the following report produced by the ACF2 Data Collection:

- SENSITVE.RPT(CICSRPT)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) UPDATE and/or ALLOCATE access to the ACF2/CICS parameter data set, specified on the ACF2PARM DD statement, is restricted to systems programming personnel and security personnel.

c) If all items in (b) are true, there is NO FINDING.

d) If any item in (b) is untrue, this is a FINDING.

Vulnerability Number

V-7091

Documentable

False

Rule Version

ZCICA011

Severity Override Guidance

a) Refer to the following report produced by the ACF2 Data Collection:

- SENSITVE.RPT(CICSRPT)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) UPDATE and/or ALLOCATE access to the ACF2/CICS parameter data set, specified on the ACF2PARM DD statement, is restricted to systems programming personnel and security personnel.

c) If all items in (b) are true, there is NO FINDING.

d) If any item in (b) is untrue, this is a FINDING.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

198

Comments