The ROSCOE's Resource Class is not defined or active in the ACP.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-224340	ZROSA038	SV-224340r1141634_rule	CCI-000336	medium
Description
Failure to use a robust ACP to control a product could potentially compromise the integrity and availability of the MVS operating system and user data.
STIG			Date
z/OS ROSCOE for ACF2 Security Technical Implementation Guide			2025-09-27

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAO-06Technical Verification

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-25Reference Monitor

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-4(2)Verification of Controls

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA STIG Benchmark (XCCDF)6our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-000336

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)

Details

Check Text (C-224340r1141634_chk)

Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFGSO). If the following GSO CLASMAP record entry(ies) is (are) defined, this is not a finding. CLASMAPqual RESOURCE(ROSRES) RSRCTYPE(rosid) ENTITYLN(nn) Note: The site determines the appropriate three letter RSRCTYPE that is unique for each Roscoe system. The ENTITYLN should be appropriate for the site's installation.

Fix Text (F-26005r868226_fix)

Use SAF security to define and protect the Products resource class(es). Ensure that the following GSO CLASMAP record entry(ies) is (are) defined: CLASMAP.ROSCOE ENTITYLN(nn) RESOURCE(ROSRES) RSRCTYPE(rosid) Note: The site determines the appropriate three letter RSRCTYPE that is unique for each Roscoe system. The ENTITYLN should be appropriate for the site's installation. Example: SET C(GSO) LIST CLASMAP.ROSCOE INSERT CLASMAP.ROSCOE ENTITYLN(39) RESOURCE(ROSRES) RSRCTYPE(ROS) F ACF2,REFRESH(CLASMAP)