STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for ACF2 STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

Key ACF2/CICS parameters must be properly coded.

DISA Rule

SV-8031r4_rule

Vulnerability Number

V-7554

Group Title

ZCICA023

Rule Version

ZCICA023

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Ensure the ACF2/CICS parameters are coded with values specified in the table entitled ACF2/CICS Parameters, in the zOS STIG Addendum.

Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

Ensure that all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters, in the zOS STIG Addendum.

Check Contents

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Refer to the CICS region SYSLOG – (Alternate source of SIT parameters)

b) Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

c) If all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters in the z/OS STIG Addendum, this is not a finding.

Note: The DEFAULT TERMINAL=parameter must be specified.
CICSKEY OPTION=VALIDATE,TYPE=resource type,RESOURCE=TRANS will specify a unique resource type for each CICS region.

d) If any key ACF2/CICS parameter is not coded as referenced in (c), this is a finding.

Vulnerability Number

V-7554

Documentable

False

Rule Version

ZCICA023

Severity Override Guidance

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Refer to the CICS region SYSLOG – (Alternate source of SIT parameters)

b) Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

c) If all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters in the z/OS STIG Addendum, this is not a finding.

Note: The DEFAULT TERMINAL=parameter must be specified.
CICSKEY OPTION=VALIDATE,TYPE=resource type,RESOURCE=TRANS will specify a unique resource type for each CICS region.

d) If any key ACF2/CICS parameter is not coded as referenced in (c), this is a finding.

Check Content Reference

M

Responsibility

Systems Programmer

Target Key

198

Comments