CICS userids are not defined and/or controlled in accordance with proper security requirements.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-224736 | ZCICT041 | SV-224736r1145859_rule | CCI-000213 | medium |
| Description | ||||
| CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. | ||||
| STIG | Date | |||
| z/OS IBM CICS Transaction Server for TSS Security Technical Implementation Guide | 2025-09-28 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-3
1.00
- DISA · V7R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.1.1
1.00
- DISA · V7R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.1.2
1.00
- DISA · V7R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000213
1.00
- DISA · V7R2 · disa_xccdf · related
Details
Check Text (C-224736r1145859_chk)
Refer to the following report produced by the TSS Data Collection:
- TSSCMDS.RPT(WHOOPROP).
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
If the CICS region is defined to the PROPCNTL resource class, this is not a finding.
Fix Text (F-26415r520311_fix)
Ensure the CICS region is defined to the PROPCNTL resource class.
Example:
TSS ADDTO(owning acid) PROPCNTL(CICS region acid)