Mainframe Products requiring user access authentication must provide a logoff capability for a user-initiated communication session.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-205536 | SRG-APP-000296-MFP-000007 | SV-205536r961224_rule | CCI-002363 | medium |
| Description | ||||
| If a user cannot explicitly end an application session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Information resources to which users gain access via authentication include, for example, local workstations, databases, and password-protected websites/web-based services. However, for some types of interactive sessions including, for example, file transfer protocol (FTP) sessions, information systems typically send logoff messages as final messages prior to terminating sessions. | ||||
| STIG | Date | |||
| Mainframe Product Security Requirements Guide | 2026-05-23 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-002363
1.00
- DISA STIG Benchmark (XCCDF)V3R5intersects(normalised)
Details
Check Text (C-205536r961224_chk)
If the Mainframe Product has no logon capability, this requirement is not applicable.
If the Mainframe Product does not provide a logout capability for user initiated communication sessions, this is a finding.
Examine the Mainframe Product configuration settings to determine whether a user can logoff. If the configurations are not properly set, this is a finding.
Fix Text (F-5802r299842_fix)
Configure the Mainframe Product settings to provide capability of user-initiated logoff.