Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Password changes to the MSCA ACID will be documented in the change log.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-236 | TSS0880 | SV-236r2_rule | DCCS-1 DCCS-2 | Medium |
| Description |
|---|
| The system MSCA will be a limited use ACID, which is not available to any individual for day to day processing. Limit its use only to performing required security administration functions. The Primary SCA will assume the use of, and the responsibility for, the MSCA by changing the MSCA password. The password change command will include a comment indicating the reason. |
| STIG | Date |
|---|---|
| z/OS TSS STIG | 2019-03-26 |
Details
| Check Text ( C-20039r1_chk ) |
|---|
| Refer to the following report produced by the TSS Data Collection: - TSSCHNGS.RPT Note: If running Quest NC-Pass, validate in ZNCP0020 that the MSCA ACID has the FACILITY of NCPASS and SECURID resource in the ABSTRACT resource class. If the MSCA password changes are documented in the change log, this is not a finding. |
| Fix Text (F-400r1_fix) |
|---|
| The IAO will ensure that the MSCA password changes are documented with comments in the the TSS Recovery file. The TSS Recovery file will be of sufficient size to ensure that the change is documented. |