IBM z/OS ACF2 Security Technical Implementation Guide

The IBM z/OS ACF2 Security Technical Implementation Guide (V9 R10) has 226 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

226STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V9 · R10

CurrentPublished Wed Sep 30 2026

ACF2 TSO2741 GSO record values must be set to obliterate the logon password on 2741 devices.

IBM z/OS ACF2 Security Technical Implementation Guide

Assessment Title

Rule Text

ACF2 TSO2741 GSO record values must be set to obliterate the logon password on 2741 devices.

Description

Discussion Text

To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the operating system must not provide any information allowing an unauthorized user to compromise the authentication mechanism.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223511

Rule

SV-223511r1225975_rule

Severity

medium

Rule Version

ACF2-ES-000940

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the ISPF Command Shell enter:
ACF <enter>
SET CONTROL(GSO)
LIST TSO2741

If the GSO TSO2741 record values conform to the following requirements, this is not a finding.

BS(16)
LENGTH(8)
M1(X)
M2(N)
M3(Z)
M4(M)
STRING()

Implementation Procedure

Fix Text

Define a cross out string used to obliterate the logon password on 2741 devices.

Ensure the GSO TSO2741 record values conform to the following requirements.

BS(16)
LENGTH(8)
M1(X)
M2(N)
M3(Z)
M4(M)
STRING()

Example:
SET C(GSO)
INSERT TSO2741 BS(16) LENGTH(8) M1(X) M2(N) M3(Z) M4(M) STRING()

F ACF2,REFRESH(TSO2741)

STIG check 90 of 226 in the IBM z/OS ACF2 STIG checklist

← Previous · V-223510ACF2 TSOCRT GSO record values must be set to obliterate the logon to ASCII CRT devices.Next · V-223512 →ACF2 SECVOLS GSO record value must be set to VOLMASK(). Any local changes are justified and documented with the ISSO.