z/OS CA 1 Tape Management for ACF2 STIG

z/OS CA 1 Tape Management for ACF2 Security Technical Implementation Guide

The z/OS CA 1 Tape Management for ACF2 Security Technical Implementation Guide (V7 R2) has 9 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

9STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V7 · R2

CurrentPublished Wed Oct 01 2025 What changed in V7R2

CA 1 Tape Management external security options must be specified properly.

z/OS CA 1 Tape Management for ACF2 Security Technical Implementation Guide

Assessment Title

Rule Text

CA 1 Tape Management external security options must be specified properly.

Description

Discussion Text

CA 1 Tape Management offers multiple external security interfaces that are controlled by parameters specified in TMOOPT00. These interfaces provide security controls for several CA 1 system and user functions. Without proper controls of these sensitive functions, the integrity of the CA 1 Tape Management System and the confidentiality of data stored on tape volumes may be compromised.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-224264

Rule

SV-224264r1141366_rule

Severity

medium

Rule Version

ZCA1A040

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Refer to the following report produced by the z/OS Data Collection:

- CA1RPT(TMSSTATS).

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZCA10040).

CA 1 external security utilizing ACF2 is accomplished in the manner described in this section.

Note: The TMOOPTxx member is specified in the TMOSYSxx member in the dataset allocated by the TMSPARM DD statement in the TMSINIT STC. By default, the suffix 00 is used for these members. However, overrides can be specified by PARM value(s) on the EXEC statement in the TMSINIT STC and/or in the TMOSYSxx member.

Review the options and values of the below CA 1 parameters. If the options are set to the specified value, this is not a finding.

CA 1 SECURITY OPTIONS - ACF2
Option Value
BATCH YES obsolete as of r12.0
CATSEC NO obsolete as of r12.0
CMD YES
CREATE see Note 1
DSNB YES
FUNC YES see Note 2
OCEOV NO see Note 3
PMASK Do not specify or change
PSWD YES
SCRTCH NO
SECWTO YES
UNDEF FAIL
UX0AUPD NO see Note 4
YSVC YES

Note 1: The CREATE parameter defines the level of access that is required to create a dataset on tape. The default value is UPDATE. However, the vendor recommends the value be set to CREATE if running CA Top Secret or ACF2 and ALTER if running RACF.

Note 2: The FUNC option provides supplementary security for BLP access. The tape label bypass privilege must still be specified in the ACF2 user LID record to allow access to BLP processing.

Note 3: The CA 1 security option, OCEOV, is set to NO because ACF2 obtains control of dataset OPEN/CLOSE processing before the CA 1 intercept. The vendor recommends that the first security call be used and that this CA 1 control option be turned OFF. Therefore, TAPEDSN must be specified in the OPTS option in the ACF2 GSO record.

Note 4: The UX0AUPD will specify YES only if the fields are altered in the TMC and the TMSUXxA (for r11.5 and below) or TMSXITA (for r12.0 and above) is changed.

Implementation Procedure

Fix Text

The systems programmer/ISSO will ensure that the CA 1 external security options are specified in accordance with the ACP being used. CA 1 Tape Management ACP security interfaces are controlled by options coded in the TMOOPTxx member identified in the TMOSYSxx member of the dataset allocated by the TMSPARM DD statement in the TMSINIT STC. The specific required option settings are dependent on the ACP in use on the system.

Note 2: The FUNC option provides supplementary security for BLP access. The tape label bypass privilege must still be specified in the ACF2 user LID record to allow access to BLP processing.

Note 4: The UX0AUPD will specify YES only if fields are altered in the TMC and the TMSUXxA (for r11.5 and below) or TMSXITA (for r12.0 and above) is changed.

STIG check 9 of 9 in the z/OS CA 1 Tape Management for ACF2 STIG checklist

← Previous · V-224263CA 1 Tape Management Started Task name will be properly identified and/or defined to the system ACP.