CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

An XCCDF Rule

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

ID: SV-224305r958482_rule
Version: ZCIC0040
Severity: Medium
References: CCI-000764
Updated: about 2 months ago

Remediation Templates

The IAO will ensure that each CICS region is associated with a unique userid and that userid is properly defined.

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure that the following is defined for each CICS region:
1)	A unique userid is defined.

Use the ACF2 insert command to accomplish this.  A sample command is provided here:

INSERT <cicsregionid> NAME('STC, CICS Region') JOBFROM MUSASS NO-SMC STC ACF2CICS

CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

Description

Remediation Templates

A Manual Procedure