z/OS BMC CONTROL-M for ACF2 Security Technical Implementation Guide

z/OS BMC CONTROL-M for ACF2 Security Technical Implementation Guide

Overview

Version	Date	Finding Count (8)			Downloads
6	2022-10-06 2015-01-15 2015-01-15 2015-01-15 2015-09-28 2015-09-28 2015-09-28 2015-09-28 2015-09-28 2017-03-22 2017-03-22 2017-03-22 2017-03-22 2018-09-20 2019-09-26 2019-09-26 2019-09-26 2019-09-26 2019-09-26 2019-09-26 2019-09-26 2019-09-26 2019-09-26 2019-09-26	CAT I (High): 0	CAT II (Med): 8	CAT III (Low): 0	Excel	JSON	XML

STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Available Profiles

Classified	Public	Sensitive
I - Mission Critical Classified	I - Mission Critical Public	I - Mission Critical Sensitive	II - Mission Support Classified	II - Mission Support Public	II - Mission Support Sensitive	III - Administrative Classified	III - Administrative Public	III - Administrative Sensitive

Findings (MAC III - Administrative Sensitive)

Finding ID	Severity	Title	Description
V-224115	Medium	BMC CONTROL-M STC data sets will be properly protected.	BMC CONTROL-M STC data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the...
V-224114	Medium	BMC CONTROL-M installation data sets will be properly protected.	BMC CONTROL-M installation data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in...
V-224117	Medium	BMC CONTROL-M User/Application JCL data sets must be properly protected.	BMC CONTROL-M User/Application JCL data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result...
V-224116	Medium	BMC CONTROL-M User data sets will be properly protected.	BMC CONTROL-M User data sets, Repository, have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in...
V-224113	Medium	BMC CONTROL-M security exits are not installed or configured properly.	The BMC CONTROL-M security exits enable access authorization checking to BMC CONTROL-M commands, features, and online functionality. If these exit(s) is (are) not in place, activities by...
V-224119	Medium	BMC CONTROL-M Started Task name is not properly identified / defined to the system ACP.	BMC CONTROL-M requires a started task that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the...
V-224120	Medium	BMC CONTROL-M configuration/parameter values must be specified properly.	BMC CONTROL-M configuration/parameters control the security and operational characteristics of products. If these parameter values are improperly specified, security and operational controls may...
V-224118	Medium	BMC C0NTROL-M resources must be properly defined and protected.	BMC CONTROL-M can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resources could result in the compromise of...