STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for TSS STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

CICS userids are not defined and/or controlled in accordance with proper security requirements.

DISA Rule

SV-7525r3_rule

Vulnerability Number

V-7121

Group Title

ZCICT041

Rule Version

ZCICT041

Severity

CAT II

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Ensure the CICS region is defined to the PROPCNTL resource class.

Example:

TSS ADDTO(owning acid) PROPCNTL(CICS region acid)

Check Contents

a) Refer to the following report produced by the TSS Data Collection:

- TSSCMDS.RPT(WHOOPROP)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the CICS region is defined to the PROPCNTL resource class.

c) If (b) are true, there is NO FINDING.

d) If (b) is untrue, this is a FINDING.

Vulnerability Number

V-7121

Documentable

False

Rule Version

ZCICT041

Severity Override Guidance

a) Refer to the following report produced by the TSS Data Collection:

- TSSCMDS.RPT(WHOOPROP)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the CICS region is defined to the PROPCNTL resource class.

c) If (b) are true, there is NO FINDING.

d) If (b) is untrue, this is a FINDING.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

199

Comments