OpenControls Logo

STIG Viewer

STIGViewer Support

BMC CONTROL-O security exits are not installed or configured properly.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-224591ZCTO0060SV-224591r1145949_ruleCCI-001744medium
Description
The BMC CONTROL-O security exits enable access authorization checking to BMC CONTROL-O commands, features, and online functionality. If these exit(s) is (are) not in place, activities by unauthorized users may result. BMC CONTROL-O security exit(s) interface with the Access Control Program (ACP). If an unauthorized exit was introduced into the operating environment, system security could be weakened or bypassed. These exposures may result in the compromise of the operating system environment, ACP, and customer data.
STIGDate
z/OS BMC CONTROL-O for TSS Security Technical Implementation Guide2025-09-28

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-02.4Automated Security Response
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-5(2)Real-time Alerts
1.00
AU-8Time Stamps
1.00
CM-3(5)Automated Security Response
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
SI-11Error Handling
1.00
SI-6Security and Privacy Function Verification
1.00
CCI1 mapping
CCI-001744
1.00

Details

Check Text (C-224591r1145949_chk)

Interview the systems programmer responsible for the BMC CONTROL-O. Determine if the site has modified the following security exit(s): CTOSE01 CTOSE02 CTOSE03 CTOSE04 CTOSE08 CTOSE10 CTOSE15 Ensure the above security exit(s) has (have) not been modified. If the above security exit(s) has (have) been modified, ensure that the security exit(s) has (have) been approved by the site systems programmer and the approval is on file for examination.

Fix Text (F-26262r1145948_fix)

The systems programmer responsible for the BMC CONTROL-O will review the BMC CONTROL-O operating environment. Ensure that the following security exit(s) is (are) installed properly. Determine if the site has modified the following security exit(s): CTOSE01 CTOSE02 CTOSE03 CTOSE04 CTOSE08 CTOSE10 CTOSE15 Ensure that the security exit(s) has (have) not been modified. If the security exit(s) has (have) been modified, ensure the security exit(s) has (have) been checked as to not violate any security integrity within the system and approval documentation is on file.