IBM z/OS RACF Security Technical Implementation Guide

The IBM z/OS RACF Security Technical Implementation Guide (V9 R10) has 224 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

224STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V9 · R10

CurrentPublished Wed Sep 30 2026

IBM z/OS, for PKI-based authentication, must use the ICSF or ESM for key management.

IBM z/OS RACF Security Technical Implementation Guide

Assessment Title

Rule Text

IBM z/OS, for PKI-based authentication, must use the ICSF or ESM for key management.

Description

Discussion Text

Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223811

Rule

SV-223811r998380_rule

Severity

medium

Rule Version

RACF-SH-000060

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Any keys or Certificates must be managed in ICSF or the external security manager and not in UNIX files.

From the ISPF Command Shell enter:
OMVS
enter
find / -name *.kdb
and
find / -name *.jks

If any files are present, this is a finding.

Implementation Procedure

Fix Text

Define all Keys/Certificates to ICSF or the security database.

Remove all .kdb and .jks key files.

STIG check 151 of 224 in the IBM z/OS RACF STIG checklist

← Previous · V-223810IBM z/OS SSH daemon must be configured to only use the SSHv2 protocol.Next · V-223812 →IBM z/OS permission bits and user audit bits for HFS objects that are part of the Syslog daemon component must be properly configured.