Userids found inactive for more than 35 days are not suspended.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-7558	ACP00310	SV-8036r2_rule	DCCS-1 DCCS-2 IAAC-1	Medium

Description
Userid maintenance is critical in a C2 level of trust environment. Userids left on the system for extended periods of time could be reassigned to a different user while retaining the access authorizations of the previous user. The improper management of userids could result in the compromise of the operating system environment, ACP, and customer data. Note: This vulnerability applies to interactive USERIDS assigned to individuals and not to BATCH, STC type USERIDS.

Description

Userid maintenance is critical in a C2 level of trust environment. Userids left on the system for extended periods of time could be reassigned to a different user while retaining the access authorizations of the previous user. The improper management of userids could result in the compromise of the operating system environment, ACP, and customer data. Note: This vulnerability applies to interactive USERIDS assigned to individuals and not to BATCH, STC type USERIDS.

STIG	Date
z/OS ACF2 STIG	2018-04-04

Details

Check Text ( C-24825r1_chk )
Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(UNUSD35A) - ACF2CMDS.RPT(UNUSD35C) - ACF2CMDS.RPT(UNUSD35S) Ensure that every interactive user shows an ACC-DATE=mm/dd/yy within the past 35 days. NOTE: Valid for interactive USERIDS, not valid for Started task USERIDS and Batch USERIDS.

Fix Text (F-175r1_fix)
The IAO must develop a procedure to check all userids for inactivity more than 35 days. If found, the IAO must suspend an account, but not delete it until it is verified by the local IAO that the user no longer requires access. If verification is not received within 60 days, the account may be deleted.