UCF STIG Viewer Logo

The Mainframe Product must provide an immediate real-time alert to the operations staff, system programmers, and/or security administrators, at a minimum, of all audit failure events requiring real-time alerts.


Overview

Finding ID Version Rule ID IA Controls Severity
V-205556 SRG-APP-000360-MFP-000152 SV-205556r851320_rule Medium
Description
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).
STIG Date
Mainframe Product Security Requirements Guide 2022-09-22

Details

Check Text ( C-5822r299895_chk )
If the Mainframe Product does not perform audit data management or storage function, this is not applicable.

Examine configuration settings.

If the Mainframe Product does not provide for immediate real-time alerts to operations staff, system programmers, and/or security administrators for audit failures requiring real-time alerts, this is a finding.
Fix Text (F-5822r299896_fix)
Configure the Mainframe Product to provide for immediate real-time alerts to operations staff, system programmers, and/or security administrators for audit failures requiring real-time alerts.