ACP database is not on a separate physical volume from its backup and recovery datasets.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-104	AAMV0410	SV-104r2_rule	CODB-2 DCCS-1 DCCS-2	Medium

Description
The ACP backup and recovery data files provide the only means of recovering the ACP database in the event of its damage. In the case where this damage is to the physical volume on which it resides, and any of these recovery data files exist on this volume as well, then complete recovery of the ACP database would be extremely difficult, if even possible.

STIG	Date
z/OS RACF STIG	2019-09-27

Details

Check Text ( C-21014r1_chk )
a) Refer to the following item gathered from the z/OS Data Collection: - Step 8 (c) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(AAMV0410) For RACF sites only, refer to the following report produced by the RACF Data Collection: - DSMON.RPT(RACDST) For ACF2 sites only, refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFBKUP) For TSS sites only, refer to the following report produced by the z/OS Data Collection, review procedure library member TSS for information: - EXAM.RPT(PROCLIBS) b) If the Access Control Product (ACP) database is not located on the same volume as either its alternate or backup file, there is NO FINDING. c) If the ACP database is collocated with either it’s alternate or backup, this is a FINDING.

Check Text ( C-21014r1_chk )

a) Refer to the following item gathered from the z/OS Data Collection:

- Step 8 (c)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(AAMV0410)

For RACF sites only, refer to the following report produced by the RACF Data Collection:

- DSMON.RPT(RACDST)

For ACF2 sites only, refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFBKUP)

For TSS sites only, refer to the following report produced by the z/OS Data Collection, review procedure library member TSS for information:

- EXAM.RPT(PROCLIBS)

b) If the Access Control Product (ACP) database is not located on the same volume as either its alternate or backup file, there is NO FINDING.

c) If the ACP database is collocated with either it’s alternate or backup, this is a FINDING.

Fix Text (F-17026r1_fix)
The systems programmer will ensure that placement of ACP files are on a separate volume from its backup and recovery data sets to provide backup and recovery in the event of physical damage to a volume. Identify the ACP database(s), backup database(s), and recovery data set(s). Develop a plan to keep these data sets on different physical volumes. Implement the movement of these critical ACP files. File location is an often overlooked factor in system integrity. It is important to ensure that the effects of hardware failures on system integrity and availability are minimized. Avoid collocation of files such as primary and alternate databases. For example, the loss of the physical volume containing the ACP database should not also cause the loss of the ACP backup database as a result of their collocation. Files that will be segregated from each other on separate physical volumes include, but are not limited to, the ACP database and its alternate or backup file.

Fix Text (F-17026r1_fix)

The systems programmer will ensure that placement of ACP files are on a separate volume from its backup and recovery data sets to provide backup and recovery in the event of physical damage to a volume.

Identify the ACP database(s), backup database(s), and recovery data set(s). Develop a plan to keep these data sets on different physical volumes. Implement the movement of these critical ACP files.

File location is an often overlooked factor in system integrity. It is important to ensure that the effects of hardware failures on system integrity and availability are minimized. Avoid collocation of files such as primary and alternate databases. For example, the loss of the physical volume containing the ACP database should not also cause the loss of the ACP backup database as a result of their collocation. Files that will be segregated from each other on separate physical volumes include, but are not limited to, the ACP database and its alternate or backup file.