User ACIDs and Control ACIDs do not have the NAME field completed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-224	TSS0740	SV-224r2_rule	DCCS-1 DCCS-2	Low

Description
Every User ACID should be assigned to an individual using the name field. Within the ACID record, the users NAME field should be completed. If this field is not completed for each user, user accountability will become lost. A completed NAME field must be either traced back to a current DD2875 or a Vendor Requirement (example: A Started Task). A user may be required to have more than one logonid but users must not share userids.

Description

Every User ACID should be assigned to an individual using the name field. Within the ACID record, the users NAME field should be completed. If this field is not completed for each user, user accountability will become lost. A completed NAME field must be either traced back to a current DD2875 or a Vendor Requirement (example: A Started Task). A user may be required to have more than one logonid but users must not share userids.

STIG	Date
z/OS TSS STIG	2018-12-20

Details

Check Text ( C-521r1_chk )
a) Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS) - TSSCMDS.RPT(@ALL) Automated Analysis Refer to the following report produced by the TSS Data Collection: - PDI(TSS0740) Note: An interactive user may have more than one ACID as long as it has a matching DD2875 form. Users may not share any type of ACID. b) If all ACIDs have the NAME field completed, there is NO FINDING. c) If any ACID does not have the NAME field completed, this is a FINDING.

Check Text ( C-521r1_chk )

a) Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACIDS)
- TSSCMDS.RPT(@ALL)

Automated Analysis
Refer to the following report produced by the TSS Data Collection:

- PDI(TSS0740)

Note: An interactive user may have more than one ACID as long as it has a matching DD2875 form. Users may not share any type of ACID.

b) If all ACIDs have the NAME field completed, there is NO FINDING.

c) If any ACID does not have the NAME field completed, this is a FINDING.

Fix Text (F-27392r1_fix)
The IAO will review all ACID definitions and ensure the NAME field is completed. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement. NOTE: An interactive user may have more than one ACID as long as it has a matching DD2875 form. Users may not share any type of ACID.