Resource Class ROSRES is not defined or active in the Access Control Program (ACP).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-225604	ZROST038	SV-225604r1146143_rule	CCI-000336	medium
Description
Failure to use a robust ACP to control a product could potentially compromise the integrity and availability of the MVS operating system and user data.
STIG			Date
z/OS ROSCOE for TSS Security Technical Implementation Guide			2025-09-28

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAO-06Technical Verification

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-25Reference Monitor

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-4(2)Verification of Controls

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)
DISA STIG Benchmark (XCCDF)6our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-000336

1.00

DISA STIG Benchmark (XCCDF)V7R2intersects(normalised)

Details

Check Text (C-225604r1146143_chk)

Refer to the following report produced by the ACP Data Collection: - TSSCMDS.RPT(#RDT). If the ROSCOE Resource Class(es) is (are) defined in the Resource Definition Table (RDT) as follows, this is not a finding. RESOURCE CLASS = ROSRES RESOURCE CODE = X'hex code' ATTRIBUTE = MASK|NOMASK,MAXOWN(08),MAXPERMIT(044),ACCESS,DEFPROT ACCESS = NONE(0000),CONTROL(0400),UPDATE(6000),READ(4000) ACCESS = WRITE(2000),ALL(FFFF) DEFACC = READ

Fix Text (F-27292r1070310_fix)

The ISSO will ensure the Product resource class(es) is (are) defined in the TSS RDT. The ISSO will issue one of the following commands to define the Product resource class(es): TSS REPLACE(RDT) RESCLASS(ROSRES) - MAXLEN(044) - ATTR(MASK|NOMASK,DEFPROT) - ACLST(NONE(0000),CONTROL(0400),UPDATE(6000),READ(4000),WRITE(2000),ALL(FFFF)) - DEFACC(READ) TSS ADDTO(RDT) RESCLASS(ROSRES) - RESCODE(hex-code) - ATTR(MASK|NOMASK,DEFPROT) - ACLST(NONE(0000),CONTROL(0400),UPDATE(6000),READ(4000),WRITE(2000),ALL(FFFF)) - DEFACC(READ)