OpenControls Logo

STIG Viewer

STIGViewer Support

CICS system data sets are not properly protected.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-224729ZCIC0010SV-224729r1145841_ruleCCI-001499medium
Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Unauthorized access to CICS system data sets (i.e., product, security, and application libraries) could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
STIGDate
z/OS IBM CICS Transaction Server for TSS Security Technical Implementation Guide2025-09-28

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.5Library Privileges
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (56) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+46 more (top 10 by confidence shown)

CCI1 mapping
CCI-001499
1.00

Details

Check Text (C-224729r1145841_chk)

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(CICSRPT). Because it is possible to have multiple CICS regions running on an LPAR, it is recommended to go into the z/OS STIG Addendum and fill out all the information in the "CICS System Programmers Worksheet" for each CICS region running on the LPAR. It is recommended to save this information for any other CICS vulnerabilities that will require it. If WRITE and/or greater access to CICS system data sets is restricted to systems programming personnel, this is not a finding.

Fix Text (F-26408r1145840_fix)

Review the access authorizations for CICS system data sets for each region. Ensure they conform to the specifications below: A CICS environment may include several data set types required for operation. Typically they are CICS product libraries, which are usually included in the STEPLIB concatenation but may be found in DD DFHRPL. CICS system data sets that can be identified with DFH DD statements, other product system data sets, and application program libraries. Restrict WRITE and/or greater access to CICS program libraries and all system data sets to systems programmers only. Other access must be documented and approved by the ISSO. The site may determine access to application data sets included in the DD DFHRPL and CICS region startup JCL according to need. Ensure that procedures are established; documented, and followed that prevents the introduction of unauthorized or untested application programs into production application systems.