The ISSO will ensure WRITE and/or greater access to SRRAUDIT installation datasets is limited to systems programmers only, and all WRITE and/or greater access is logged. READ access can be given to security personnel, production control and scheduling personnel, and auditors. All failures and successful WRITE and/or greater accesses are logged.
The installing systems programmer will identify and document the product datasets, categorize them according to who will have WRITE and/or greater access, and if required, ensure that all WRITE and/or greater accesses are logged. The installing systems programmer will identify if any additional groups have WRITE and/or greater access for specific datasets, and once documented, will work with the ISSO to ensure they are properly restricted to the Access Control Program (ACP) active on the system.
(Note: The datasets and/or dataset prefixes identified below are examples of a possible installation. The actual datasets and/or prefixes are determined when the product is installed on a system through the product's installation guide and can be site specific.)
Datasets to be protected will be:
SYS2.SRRAUDIT
The following commands are provided as a sample for implementing dataset controls:
$KEY(SYS2)
SET RULE
$KEY(S2S)
$PREFIX(SYS2)
SRRAUDIT.- UID(audtaudt) R(A) E(A) DATA(DEFAULT Auditor)
SRRAUDIT.- UID(pcspaudt) R(A) E(A) DATA(DEFAULT Production control and Scheduling)
SRRAUDIT.- UID(secaaudt) R(A) E(A) DATA(DEFAULT Security)
SRRAUDIT.- UID(syspaudt) R(A) W(L) A(L) E(A) DATA(DEFAULT SYSPROG)
SRRAUDIT.- UID(tstcaudt) R(A) W(L) A(L) E(A) DATA(DEFAULT Trusted STCs)