CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.
An XCCDF Rule
Description
<VulnDiscussion>CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-224732r520300_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.
Ensure the following items are in effect for each CICS region ACID:
A unique ACID is associated with the CICS region.