IBM z/OS ACF2 Security Technical Implementation Guide

The IBM z/OS ACF2 Security Technical Implementation Guide (V9 R10) has 226 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

226STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V9 · R10

CurrentPublished Wed Sep 30 2026

The CA-ACF2 PSWD GSO record values for MAXTRY and PASSLMT must be properly set.

IBM z/OS ACF2 Security Technical Implementation Guide

Assessment Title

Rule Text

The CA-ACF2 PSWD GSO record values for MAXTRY and PASSLMT must be properly set.

Description

Discussion Text

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223462

Rule

SV-223462r1225926_rule

Severity

medium

Rule Version

ACF2-ES-000430

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From an ACF command screen enter:
SET CONTROL(GSO)
SHOW PSwdopts

If "MAXTRY" is set to "3", this is not a finding.

If "PASSLMT" is set to "3", this is not a finding.

Implementation Procedure

Fix Text

Configure the GSO option "MAXTRY" to equal "3".
Configure the GSO option "PASSLMT" to equal "3".

STIG check 41 of 226 in the IBM z/OS ACF2 STIG checklist

← Previous · V-223459ACF2 PPGM GSO record value must specify protected programs that are only executed by privileged users.Next · V-223463 →IBM z/OS SYS1.PARMLIB must be properly protected.