CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

An XCCDF Rule

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

ID: SV-224732r958482_rule
Version: ZCIC0040
Severity: Medium
References: CCI-000764
Updated: 7 days ago

Remediation Templates

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure the following items are in effect for each CICS region ACID: 

      A unique ACID is associated with the CICS region.
      No access to interactive online facilities (e.g., TSO) other than CICS.

      CICS region ACID does not have any BYPASS privilege.

      CICS region ACID is associated with a TSS CICS facility (The IAO will determine the MASTFAC used)

      CICS region is defined in the STC table.

For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

Description

Remediation Templates

A Manual Procedure