Password changes to the MSCA ACID will be documented in the change log.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-236	TSS0880	SV-236r2_rule	DCCS-1 DCCS-2	Medium

Description
The system MSCA will be a limited use ACID, which is not available to any individual for day to day processing. Limit its use only to performing required security administration functions. The Primary SCA will assume the use of, and the responsibility for, the MSCA by changing the MSCA password. The password change command will include a comment indicating the reason.

STIG	Date
z/OS TSS STIG	2019-12-12

Details

Check Text ( C-20039r1_chk )
Refer to the following report produced by the TSS Data Collection: - TSSCHNGS.RPT Note: If running Quest NC-Pass, validate in ZNCP0020 that the MSCA ACID has the FACILITY of NCPASS and SECURID resource in the ABSTRACT resource class. If the MSCA password changes are documented in the change log, this is not a finding.

Fix Text (F-400r1_fix)
The IAO will ensure that the MSCA password changes are documented with comments in the the TSS Recovery file. The TSS Recovery file will be of sufficient size to ensure that the change is documented.