UCF STIG Viewer Logo

NCP (Net Work Control Program) Data set access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel.


Finding ID Version Rule ID IA Controls Severity
V-6904 ZFEP0015 SV-7199r3_rule Medium
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.
zOS FEP for ACF2 STIG 2020-01-23


Check Text ( C-20297r1_chk )
a) Refer to the following report produced by the Data Set and Resource Data Collection:


___ The ACP data set rules for NCP data sets allow inappropriate access.

___ The ACP data set rules for NCP data sets does not restrict UPDATE and/or ALL access to authorized personnel (e.g., systems programming personnel).

b) If both of the above are untrue, there is NO FINDING.

c) If either of the above is true, this is a FINDING.
Fix Text (F-18253r1_fix)
Identify Names of the following data sets used for installation and in development/production environments:

- NCP system data sets
- NCP source definition data sets
- NCP load modules
- NCP host dump data sets
- NCP utility programs
Have the IAO validate that they are properly protected by the ACP. And that only authorized personnel are permitted UPDATE and/or ALLOCATE access (e.g., z/OS systems programming personnel).