z/OS IBM CICS Transaction Server for ACF2 STIG

z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide

The z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide (V7 R2) has 12 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

12STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V7 · R2

CurrentPublished Wed Oct 01 2025 What changed in V7R2

CICS System Initialization Table (SIT) parameter values must be specified in accordance with proper security requirements.

z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide

Assessment Title

Rule Text

CICS System Initialization Table (SIT) parameter values must be specified in accordance with proper security requirements.

Description

Discussion Text

The CICS SIT is used to define system operation and configuration parameters of a CICS system. Several of these parameters control the security within a CICS region. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-224304

Rule

SV-224304r1141381_rule

Severity

medium

Rule Version

ZCIC0030

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the following report produced by the CICS Data Collection:

- CICS.RPT(DFHSITxx).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Refer to the CICS region SYSLOG - (Alternate source of SIT parameters) Be sure to process DFHSIT based on the order specified. The system initialization parameters are processed in the following order, with later system initialization parameter values overriding those specified earlier. CICS system initialization parameters are specified in the following ways:

- In the system initialization table, loaded from a library in the STEPLIB concatenation of the CICS startup procedure.
- In the PARM parameter of the EXEC PGM=DFHSIP statement of the CICS startup procedure.
- In the SYSIN dataset defined in the startup procedure (but only if SYSIN is coded in the PARM parameter).
- In the ACF2PARM dataset defined in the startup procedure.

Verify the following CICS System Initialization Table (SIT) parameter settings are specified for each CICS region. If the following guidance is true, this is not a finding.

SEC=YES - If SEC is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below are the hex and bit settings for this flag.

X'80' EQU B'10000000' External Security Requested

DFLTUSER=<parameter> - If DFLTUSER is not coded in the CICS region startup JCL, go to offset x'118' from the beginning on the SIT dump (record sequence number - 6) for a length of 8 bytes. The value will be the CICS default userid. ACF2PARM overrides the CICS SIT DFLTUSER parameter value with the logonid supplied in the ACF2PARM DEFAULT TERMINAL= parameter.

XUSER=YES - If XUSER is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below is the hex and bit settings for this flag.

X'04' EQU B'00000100' Surrogate User Checking required

The CICS interface now controls this DFHSIT keyword via the INITIAL XUSER= initialization parameter. The CICS interface dynamically sets this DFHSIT setting during initialization processing using the value specified via the ACF2PARM parameter file. This overrides any value specified by the CICS systems programmer via the CICS SYSIN file, execution parameter overrides, or the DFHSIT table so the security administrator and not the CICS systems programmer controls surrogate userid checking

SNSCOPE=NONE|CICS|MVSIMAGE|SYSPLEX - If SNSCOPE is not coded in the CICS region startup JCL, go to offset x'124' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the signon scope byte flag. Verify that users cannot sign on to more than one CICS production region within the scope of a single CICS region, a single z/OS image, or a sysplex. Below are listed the hex and bit settings for this flag:

X'01' EQU 1 SIGNON SCOPE = NONE
X'02' EQU 2 SIGNON SCOPE = CICS
X'03' EQU 3 SIGNON SCOPE = MVSIMAGE
X'04' EQU 4 SIGNON SCOPE = SYSPLEX

Note: SNSCOPE=NONE is only allowed with test/development regions.

Implementation Procedure

Fix Text

Ensure that CICS System Initialization Table (SIT) parameter values are specified using the following guidance.

The system initialization parameters are processed in the following order, with later system initialization parameter values overriding those specified earlier. CICS system initialization parameters are specified in the following ways:

Ensure the following CICS System Initialization Table (SIT) parameter settings are specified for each CICS region:

X'80' EQU B'10000000' External Security Requested <<===
X'40' EQU B'01000000' Resource Prefix Required
X'10' EQU B'00010000' RACLIST class APPCLU required
X'08' EQU B'00001000' ESM INSTLN data is required
X'04' EQU B'00000100' Surrogate User Checking required
X'02' EQU B'00000010' Always enact resource check
X'01' EQU B'00000001' Always enact command check

X'80' EQU B'10000000' External Security Requested
X'40' EQU B'01000000' Resource Prefix Required
X'10' EQU B'00010000' RACLIST class APPCLU required
X'08' EQU B'00001000' ESM INSTLN data is required
X'04' EQU B'00000100' Surrogate User Checking required <<===
X'02' EQU B'00000010' Always enact resource check
X'01' EQU B'00000001' Always enact command check

SNSCOPE=NONE|CICS|MVSIMAGE|SYSPLEX - If SNSCOPE is not coded in the CICS region startup JCL, go to offset x'124' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the signon scope byte flag. Ensure that users cannot sign on to more than one CICS production region within the scope of a single CICS region, a single z/OS image, or a sysplex. Below are listed the hex and bit settings for this flag:

X'01' EQU 1 SIGNON SCOPE = NONE
X'02' EQU 2 SIGNON SCOPE = CICS
X'03' EQU 3 SIGNON SCOPE = MVSIMAGE
X'04' EQU 4 SIGNON SCOPE = SYSPLEX

Note: SNSCOPE=NONE is only allowed with test/development regions.

STIG check 3 of 12 in the z/OS IBM CICS Transaction Server for ACF2 STIG checklist

← Previous · V-224303Sensitive CICS transactions are not protected in accordance with security requirements.Next · V-224305 →CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.