IBM zSecure Suite Security Technical Implementation Guide

The IBM zSecure Suite Security Technical Implementation Guide (V1 R3) has 11 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

11STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Apr 02 2025

XFACILIT class, or alternate class if specified in module CKRSITE, must be active.

IBM zSecure Suite Security Technical Implementation Guide

Assessment Title

Rule Text

XFACILIT class, or alternate class if specified in module CKRSITE, must be active.

Description

Discussion Text

The zSecure resource class that is configured for the zSecure access checks must be active to receive valid Allow/Deny responses from external security manager (ESM) resource checks. Activation is outside of zSecure, in the ESM.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-259738

Rule

SV-259738r961863_rule

Severity

medium

Rule Version

ZSEC-00-000260

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Run the CARLa command SHOW CKRSITE. The output of this command reveals which resource class is configured for handling the zSecure security checks. The default resource class is XFACILIT.

Verify in the class descriptor table that the configured zSecure resource class is active. 

If the configured zSecure resource class is not active, this is a finding.

Implementation Procedure

Fix Text

Ensure the resource class that is configured in CKRSITE for zSecure security checks is active in the RACF class descriptor table. The default class is XFACILIT. IBM Security zSecure recommends the generic be activated.

Following is a sample command:

SETROPTS CLASSACT(XFACILIT) or SETROPTS CLASSACT(<configured resource class for access checks>)

STIG check 11 of 11 in the IBM zSecure Suite STIG checklist

← Previous · V-259737IBM Security zSecure system administrators must install security-relevant zSecure software updates within the time period directed by an authoritative source (e.g., IAVMs, CTOs, DTMs, and STIGs).