zOS WebSphere MQ for RACF STIG

zOS WebSphere MQ for RACF Security Technical Implementation Guide

The zOS WebSphere MQ for RACF Security Technical Implementation Guide (V7 R3) has 17 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

17STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V7 · R3

CurrentPublished Wed Jul 01 2026 What changed in V7R3

WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted.

zOS WebSphere MQ for RACF Security Technical Implementation Guide

Assessment Title

Rule Text

WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted.

Description

Discussion Text

MVS data sets provide the configuration, operational, and executable properties of WebSphere MQ. Some data sets are responsible for the security implementation of WebSphere MQ. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-224556

Rule

SV-224556r1145053_rule

Severity

medium

Rule Version

ZWMQ0040

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Refer to the following report produced by the ACP Data Collection:

- SENSITVE.RPT(MQSRPT)

Verify ACP data sets rules for WebSphere MQ system data sets (e.g., SYS2.MQM.) restrict access as follows. If the following guidance is true, this is not a finding.

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

If the following guidance is true, this is not a finding.

The ACP data set rules for the data sets restricts READ access to data sets referenced by the following DDnames is restricted to WebSphere MQ STCs, WebSphere MQ administrators, and systems programming personnel. All access to these data sets is logged.

DDname Procedure Description
CSQINP1 ssidMSTR Input parameters
CSQINP2 ssidMSTR Input parameters
CSQXLIB ssidCHIN User exit library

The ACP data set rules for the data sets restricts WRITE and/or greater access to the above data sets is restricted to WebSphere MQ administrators and systems programming personnel.

The ACP data set rules for the data sets restricts WRITE and/or greater access to data sets referenced by the following DDnames, restricted to WebSphere MQ STCs, WebSphere MQ administrators, and systems programming personnel. All WRITE and/or greater access to these data sets is logged.

DDname Procedure Description
CSQPxxxx ssidMSTR Page data sets
BSDSx ssidMSTR Bootstrap data sets
CSQOUTx ssidMSTR SYSOUT data sets
CSQSNAP ssidMSTR DUMP data set
(See note) ssidMSTR Log data sets

Note: To determine the log data set names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain data set names.

The ACP data set rules for the data sets restricts ALTER access to archive data sets is restricted to WebSphere MQ STCs, WebSphere MQ administrator, and systems programming personnel. All ALTER access to these data sets is logged.

Note: To determine the archive data sets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 data set high level qualifiers.

Except for the specific data set requirements just mentioned, WRITE and/or greater access to all other WebSphere MQ system data sets is restricted to the WebSphere MQ administrator and systems programming personnel.

Implementation Procedure

Fix Text

The systems programmer will have the ISSO ensure that all WRITE and/or greater access to WebSphere MQ product and system data sets is restricted to WebSphere MQ administrators, systems programmers, and WebSphere MQ started tasks.

The installation requires that the following data sets be APF authorized. 

hlqual.SCSQAUTH
hlqual.SCSQLINK
hlqual.SCSQANLx
hlqual.SCSQSNL
hlqual.SCSQMVR1
hlqual.SCSQMVR2

READ access to data sets referenced by the CSQINP1, CSQINP2, and CSQXLIB DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all access to these data sets.

WRITE and/or greater access to data set profiles protecting all page sets, logs, bootstrap data sets (BSDS), and data sets referenced by the CSQOUTX and CSQSNAP DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all WRITE and/or greater access to these data sets.

ALTER access to all archive data sets in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all ALTER access to these data sets.

STIG check 6 of 17 in the zOS WebSphere MQ for RACF STIG checklist

← Previous · V-224555WebSphere MQ started tasks are not defined in accordance with the proper security requirements.Next · V-224557 →WebSphere MQ resource classes must be properly activated for security checking by the ESM.