STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for TSS STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

DISA Rule

SV-7533r4_rule

Vulnerability Number

V-44

Group Title

ZCIC0040

Rule Version

ZCIC0040

Severity

CAT II

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure the following items are in effect for each CICS region ACID:

A unique ACID is associated with the CICS region.

No access to interactive online facilities (e.g., TSO) other than CICS.

CICS region ACID does not have any BYPASS privilege.

CICS region ACID is associated with a TSS CICS facility (The IAO will determine the MASTFAC used)

CICS region is defined in the STC table.

For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

Check Contents

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACID)
- TSSCMDS.RPT(#STC)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for each CICS region ACID.

1) A unique ACID is associated with the CICS region.
2) No access to interactive online facilities (e.g., TSO) other than CICS.
3) CICS region ACID does not have any BYPASS privilege. EXCEPT: NOSUBCHK - REQUIRED FOR CICS REGIONS TO SUBMIT BATCH PROCESSING/JOBS OF THE USER WHO IS LOGGED INTO CICS.
4) Ensure that each CICS region ACID is associated with a TSS CICS facility. For example:

TSS ADD(CICS region ACID) MASTFAC(CICS facility)
5) CICS region is defined in the STC table. For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

c) If (b) are true, this is not a finding.

d) If (b) are untrue, this is a finding.

Vulnerability Number

V-44

Documentable

False

Rule Version

ZCIC0040

Severity Override Guidance

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACID)
- TSSCMDS.RPT(#STC)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for each CICS region ACID.

1) A unique ACID is associated with the CICS region.
2) No access to interactive online facilities (e.g., TSO) other than CICS.
3) CICS region ACID does not have any BYPASS privilege. EXCEPT: NOSUBCHK - REQUIRED FOR CICS REGIONS TO SUBMIT BATCH PROCESSING/JOBS OF THE USER WHO IS LOGGED INTO CICS.
4) Ensure that each CICS region ACID is associated with a TSS CICS facility. For example:

TSS ADD(CICS region ACID) MASTFAC(CICS facility)
5) CICS region is defined in the STC table. For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

c) If (b) are true, this is not a finding.

d) If (b) are untrue, this is a finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

199

Comments