STIGhub
STIGs
RMF Controls
Compare
← CM-5 (6) — Access Restrictions for Change
CCI-001499
Definition
Limit privileges to change software resident within software libraries.
Parent Control
CM-5 (6)
Access Restrictions for Change
Configuration Management
Linked STIG Checks (200)
V-213130
CAT III
Adobe Acrobat Pro DC Continuous Default Handler changes must be disabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-213176
CAT III
Adobe Reader DC must disable the ability to change the Default Handler.
Adobe Acrobat Reader DC Continuous Track Security Technical Implementation Guide
V-279039
CAT II
Critical ColdFusion directories must have secure file system permissions and ownership.
Adobe ColdFusion Security Technical Implementation Guide
V-279055
CAT I
ColdFusion must be using an enterprise solution for authentication.
Adobe ColdFusion Security Technical Implementation Guide
V-274119
CAT II
Amazon Linux 2023 library directories must be group-owned by root or a system account.
Amazon Linux 2023 Security Technical Implementation Guide
V-274120
CAT II
Amazon Linux 2023 library directories must have mode "755" or less permissive.
Amazon Linux 2023 Security Technical Implementation Guide
V-274121
CAT II
Amazon Linux 2023 library files must have mode "755" or less permissive.
Amazon Linux 2023 Security Technical Implementation Guide
V-274122
CAT II
Amazon Linux 2023 library files must be owned by root.
Amazon Linux 2023 Security Technical Implementation Guide
V-274123
CAT II
Amazon Linux 2023 library files must be group-owned by root or a system account.
Amazon Linux 2023 Security Technical Implementation Guide
V-274124
CAT II
Amazon Linux 2023 library directories must be owned by root.
Amazon Linux 2023 Security Technical Implementation Guide
V-274131
CAT II
Amazon Linux 2023 system commands must be owned by root.
Amazon Linux 2023 Security Technical Implementation Guide
V-274132
CAT II
Amazon Linux 2023 system commands must be group-owned by root or a system account.
Amazon Linux 2023 Security Technical Implementation Guide
V-222949
CAT II
Tomcat user UMASK must be set to 0027.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252534
CAT II
The macOS system must enable System Integrity Protection.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257240
CAT I
The macOS system must enable System Integrity Protection.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268555
CAT I
The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277165
CAT I
The macOS system must ensure System Integrity Protection (SIP) is enabled.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-222514
CAT II
The applications must limit privileges to change the software resident within software libraries.
Application Security and Development Security Technical Implementation Guide
V-204741
CAT II
The application server must limit privileges to change the software resident within software libraries.
Application Server Security Requirements Guide
V-251601
CAT II
Database objects in an IDMS environment must be secured to prevent privileged actions from being performed by unauthorized users.
CA IDMS Security Technical Implementation Guide
V-251602
CAT II
The programs that can be run through a CA IDMS CV must be defined to the CV to prevent installation of unauthorized programs; must have the ability to dynamically register new programs; and must have the ability to secure tasks.
CA IDMS Security Technical Implementation Guide
V-251603
CAT II
The commands that allow dynamic definitions of PROGRAM/TASK and the dynamic varying of memory must be secured.
CA IDMS Security Technical Implementation Guide
V-251604
CAT II
Databases must be secured to protect from structural changes.
CA IDMS Security Technical Implementation Guide
V-251605
CAT II
Database utilities must be secured in CA IDMS and permissions given to appropriate role(s)/groups(s) in the external security manager (ESM).
CA IDMS Security Technical Implementation Guide
V-251606
CAT II
The online debugger which can change programs and storage in the CA IDMS address space must be secured.
CA IDMS Security Technical Implementation Guide
V-251607
CAT II
CA IDMS must secure the ability to create, alter, drop, grant, and revoke user and/or system profiles to users or groups.
CA IDMS Security Technical Implementation Guide
V-219198
CAT II
The Ubuntu operating system library files must have mode 0755 or less permissive.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219199
CAT II
The Ubuntu operating system library directories must have mode 0755 or less permissive.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219200
CAT II
The Ubuntu operating system library files must be owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219201
CAT II
The Ubuntu operating system library directories must be owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219202
CAT II
The Ubuntu operating system library files must be group-owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219203
CAT II
The Ubuntu operating system library directories must be group-owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219204
CAT II
The Ubuntu operating system must have system commands set to a mode of 0755 or less permissive.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219205
CAT II
The Ubuntu operating system must have directories that contain system commands set to a mode of 0755 or less permissive.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219206
CAT II
The Ubuntu operating system must have system commands owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219207
CAT II
The Ubuntu operating system must have directories that contain system commands owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219208
CAT II
The Ubuntu operating system must have system commands group-owned by root or a system account.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219209
CAT II
The Ubuntu operating system must have directories that contain system commands group-owned by root.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238347
CAT II
The Ubuntu operating system library files must have mode 0755 or less permissive.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238348
CAT II
The Ubuntu operating system library directories must have mode 0755 or less permissive.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238349
CAT II
The Ubuntu operating system library files must be owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238350
CAT II
The Ubuntu operating system library directories must be owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238351
CAT II
The Ubuntu operating system library files must be group-owned by root or a system account.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238352
CAT II
The Ubuntu operating system library directories must be group-owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238376
CAT II
The Ubuntu operating system must have system commands set to a mode of 0755 or less permissive.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238377
CAT II
The Ubuntu operating system must have system commands owned by root or a system account.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238378
CAT II
The Ubuntu operating system must have system commands group-owned by root or a system account.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260486
CAT II
Ubuntu 22.04 LTS must have system commands set to a mode of "755" or less permissive.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260487
CAT II
Ubuntu 22.04 LTS library files must have mode "755" or less permissive.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260495
CAT II
Ubuntu 22.04 LTS must have system commands owned by "root" or a system account.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260496
CAT II
Ubuntu 22.04 LTS must have system commands group-owned by "root" or a system account.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260497
CAT II
Ubuntu 22.04 LTS library directories must be owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260498
CAT II
Ubuntu 22.04 LTS library directories must be group-owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260499
CAT II
Ubuntu 22.04 LTS library files must be owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260500
CAT II
Ubuntu 22.04 LTS library files must be group-owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270696
CAT II
Ubuntu 24.04 LTS library files must have mode 0755 or less permissive.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270697
CAT II
Ubuntu 24.04 LTS library files must be owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270698
CAT II
Ubuntu 24.04 LTS library directories must be owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270699
CAT II
Ubuntu 24.04 LTS library files must be group-owned by root or a system account.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270700
CAT II
Ubuntu 24.04 LTS library directories must be group-owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270701
CAT II
Ubuntu 24.04 LTS must have system commands set to a mode of 0755 or less permissive.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270702
CAT II
Ubuntu 24.04 LTS must have system commands owned by root or a system account.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270703
CAT II
Ubuntu 24.04 LTS must have system commands group-owned by root or a system account.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-215677
CAT II
The Cisco router must be configured to limit privileges to change the software resident within software libraries.
Cisco IOS Router NDM Security Technical Implementation Guide
V-220585
CAT II
The Cisco switch must be configured to limit privileges to change the software resident within software libraries.
Cisco IOS Switch NDM Security Technical Implementation Guide
V-215822
CAT II
The Cisco router must be configured to limit privileges to change the software resident within software libraries.
Cisco IOS XE Router NDM Security Technical Implementation Guide
V-220533
CAT II
The Cisco switch must be configured to limit privileges to change the software resident within software libraries.
Cisco IOS XE Switch NDM Security Technical Implementation Guide
V-269169
CAT II
AlmaLinux OS 9 system commands must be group-owned by root or a system account.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269170
CAT II
AlmaLinux OS 9 system commands must be owned by root.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269171
CAT II
AlmaLinux OS 9 system commands must have mode 755 or less permissive.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269172
CAT II
AlmaLinux OS 9 library directories must be group-owned by root or a system account.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269173
CAT II
AlmaLinux OS 9 library directories must be owned by root.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269174
CAT II
AlmaLinux OS 9 library directories must have mode 755 or less permissive.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269175
CAT II
AlmaLinux OS 9 library files must be group-owned by root or a system account.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269176
CAT II
AlmaLinux OS 9 library files must be owned by root.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269177
CAT II
AlmaLinux OS 9 library files must have mode 755 or less permissive.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233066
CAT II
The container platform must limit privileges to the container platform registry.
Container Platform Security Requirements Guide
V-233067
CAT II
The container platform must limit privileges to the container platform runtime.
Container Platform Security Requirements Guide
V-233068
CAT II
The container platform must limit privileges to the container platform keystore.
Container Platform Security Requirements Guide
V-233069
CAT II
Configuration files for the container platform must be protected.
Container Platform Security Requirements Guide
V-233070
CAT II
Authentication files for the container platform must be protected.
Container Platform Security Requirements Guide
V-233517
CAT II
Privileges to change PostgreSQL software modules must be limited.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-233518
CAT II
PostgreSQL must limit privileges to change functions and triggers, and links to software external to PostgreSQL.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-233523
CAT II
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (functions, trigger procedures, links to software external to PostgreSQL, etc.) must be restricted to authorized users.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-233539
CAT II
Database objects (including but not limited to tables, indexes, storage, trigger procedures, functions, links to software external to PostgreSQL, etc.) must be owned by database/DBMS principals authorized for ownership.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-233540
CAT I
The PostgreSQL software installation account must be restricted to authorized users.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-233541
CAT II
Database software, including PostgreSQL configuration files, must be stored in dedicated directories separate from the host OS and other applications.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261881
CAT II
PostgreSQL must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to PostgreSQL.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-261882
CAT I
The PostgreSQL software installation account must be restricted to authorized users.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-261883
CAT II
Database software, including PostgreSQL configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-261884
CAT II
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be owned by database/PostgreSQL principals authorized for ownership.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-261885
CAT II
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to PostgreSQL, etc.) must be restricted to authorized users.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206544
CAT II
The DBMS must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the DBMS.
Database Security Requirements Guide
V-206545
CAT I
The DBMS software installation account must be restricted to authorized users.
Database Security Requirements Guide
V-206546
CAT II
Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.
Database Security Requirements Guide
V-206547
CAT II
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be owned by database/DBMS principals authorized for ownership.
Database Security Requirements Guide
V-206548
CAT II
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be restricted to authorized users.
Database Security Requirements Guide
V-270947
CAT I
Dragos Platforms must limit privileges and not allow the ability to run shell.
Dragos Platform 2.x Security Technical Implementation Guide
V-224154
CAT II
Software, applications, and configuration files that are part of, or related to, the Postgres Plus Advanced Server installation must be monitored to discover unauthorized changes.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-224155
CAT II
EDB Postgres Advanced Server software modules, to include stored procedures, functions, and triggers must be monitored to discover unauthorized changes.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-224156
CAT I
The EDB Postgres Advanced Server software installation account must be restricted to authorized users.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-224157
CAT II
Database software, including EDB Postgres Advanced Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-224158
CAT II
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the EDB Postgres Advanced Server, etc.) must be owned by database/EDB Postgres Advanced Server principals authorized for ownership.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-224159
CAT II
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the EDB Postgres Advanced Server, etc.) must be restricted to authorized users.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213585
CAT II
Software, applications, and configuration files that are part of, or related to, the Postgres Plus Advanced Server installation must be monitored to discover unauthorized changes.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-213586
CAT II
EDB Postgres Advanced Server software modules, to include stored procedures, functions and triggers must be monitored to discover unauthorized changes.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-213587
CAT I
The EDB Postgres Advanced Server software installation account must be restricted to authorized users.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-213588
CAT II
Database software, including EDB Postgres Advanced Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-213589
CAT II
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the EDB Postgres Advanced Server, etc.) must be owned by database/EDB Postgres Advanced Server principals authorized for ownership.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-213590
CAT II
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the EDB Postgres Advanced Server, etc.) must be restricted to authorized users.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259234
CAT II
Software, applications, and configuration files that are part of, or related to, the EDB Postgres Advanced Server installation must be monitored to discover unauthorized changes.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-259235
CAT II
EDB Postgres Advanced Server software modules, to include stored procedures, functions, and triggers must be monitored to discover unauthorized changes.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-259236
CAT I
The EDB Postgres Advanced Server software installation account must be restricted to authorized users.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-259237
CAT II
Database software, including EDB Postgres Advanced Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-259238
CAT II
Database objects must be owned by database/EDB Postgres Advanced Server principals authorized for ownership.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-259239
CAT II
The role(s)/group(s) used to modify database structure and logic modules must be restricted to authorized users.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-255641
CAT II
CounterACT must limit privileges to change the software resident within software libraries.
ForeScout CounterACT NDM Security Technical Implementation Guide
V-230950
CAT II
Forescout must limit privileges to change the modules and OSs resident within software libraries.
Forescout Network Device Management Security Technical Implementation Guide
V-234190
CAT II
The FortiGate device must limit privileges to change the software resident within software libraries.
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide
V-203675
CAT II
The operating system must limit privileges to change software resident within software libraries.
General Purpose Operating System Security Requirements Guide
V-215183
CAT II
All system files, programs, and directories must be owned by a system account.
IBM AIX 7.x Security Technical Implementation Guide
V-215184
CAT II
AIX device files and directories must only be writable by users with a system account or as configured by the vendor.
IBM AIX 7.x Security Technical Implementation Guide
V-215268
CAT II
AIX system files, programs, and directories must be group-owned by a system group.
IBM AIX 7.x Security Technical Implementation Guide
V-215279
CAT II
AIX library files must have mode 0755 or less permissive.
IBM AIX 7.x Security Technical Implementation Guide
V-215325
CAT II
All system command files must not have extended ACLs.
IBM AIX 7.x Security Technical Implementation Guide
V-215326
CAT II
All library files must not have extended ACLs.
IBM AIX 7.x Security Technical Implementation Guide
V-213688
CAT II
DB2 must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to DB2.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-213689
CAT II
The OS must limit privileges to change the DB2 software resident within software libraries (including privileged programs).
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-213690
CAT II
The DB2 software installation account must be restricted to authorized users.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-213691
CAT II
Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-213692
CAT II
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to DB2, etc.) must be owned by database/DBMS principals authorized for ownership.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-213693
CAT II
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to DB2, etc.) must be restricted to authorized users.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-65087
CAT II
The DataPower Gateway must limit privileges to change the software resident within software libraries.
IBM DataPower Network Device Management Security Technical Implementation Guide
V-250331
CAT II
The WebSphere Liberty Server must protect software libraries from unauthorized access.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255828
CAT II
The WebSphere Application Server users in a local user registry group must be authorized for that group.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223445
CAT I
CA-ACF2 must limit Write or greater access to SYS1.NUCLEUS to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223446
CAT I
CA-ACF2 must limit Write or greater access to SYS1.LPALIB to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223447
CAT I
CA-ACF2 must limit Write or greater access to SYS1.IMAGELIB to system programmers.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223448
CAT I
CA-ACF2 must limit Write or greater access to Libraries containing EXIT modules to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223449
CAT I
CA-ACF2 must limit Write and Allocate access to all APF-authorized libraries to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223450
CAT I
CA-ACF2 must limit Write or greater access to all LPA libraries to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223451
CAT II
CA-ACF2 must limit Write and Allocate access to LINKLIST libraries to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223452
CAT II
CA-ACF2 must limit Write and allocate access to all system-level product installation libraries to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223453
CAT I
CA-ACF2 must limit Write or greater access to SYS1.SVCLIB to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223454
CAT II
CA-ACF2 Access to SYS1.LINKLIB must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223463
CAT I
IBM z/OS SYS1.PARMLIB must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223465
CAT II
CA-ACF2 must limit Write and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223466
CAT III
CA-ACF2 must limit Write or greater access to libraries that contain PPT modules to system programmers only.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223514
CAT I
ACF2 security data sets and/or databases must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223603
CAT II
IBM z/OS data sets for the Base TCP/IP component must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223622
CAT II
IBM z/OS UNIX SYSTEM FILE SECURITY SETTINGS must be properly protected or specified.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223623
CAT II
IBM z/OS UNIX MVS data sets with z/OS UNIX components must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223624
CAT II
IBM z/OS UNIX MVS data sets or HFS objects must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223625
CAT II
IBM z/OS UNIX HFS permission bits and audit bits for each directory must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223626
CAT II
IBM z/OS UNIX MVS data sets used as step libraries in /etc/steplib must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223640
CAT II
IBM z/OS HFS objects for the z/OS UNIX Telnet Server must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223644
CAT II
IBM z/OS System data sets used to support the VTAM network must be properly secured.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223645
CAT II
IBM z/OS VTAM USSTAB definitions must not be used for unsecured terminals.
IBM z/OS ACF2 Security Technical Implementation Guide
V-255945
CAT II
IBM Integrated Crypto Service Facility (ICSF) STC data sets must be properly protected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223649
CAT I
IBM RACF must limit Write or greater access to SYS1.NUCLEUS to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223650
CAT III
IBM RACF must limit Write or greater access to libraries that contain PPT modules to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223674
CAT I
IBM RACF must limit Write or greater access to SYS1.IMAGELIB to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223675
CAT I
IBM RACF must limit Write or greater access to SYS1.SVCLIB to appropriate authorized users.
IBM z/OS RACF Security Technical Implementation Guide
V-223676
CAT I
IBM RACF must limit Write or greater access to SYS1.LPALIB to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223677
CAT I
IBM z/OS libraries included in the system REXXLIB concatenation must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223678
CAT I
IBM RACF must limit write or greater access to all LPA libraries to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223679
CAT I
IBM RACF must limit Write or greater access to libraries containing EXIT modules to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223680
CAT II
IBM RACF must limit WRITE or greater access to all system-level product installation libraries to system programmers.
IBM z/OS RACF Security Technical Implementation Guide
V-223681
CAT II
IBM RACF must limit access to SYSTEM DUMP data sets to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223682
CAT I
IBM RACF must limit WRITE or greater access to all APF-authorized libraries to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223683
CAT II
IBM RACF access to SYS1.LINKLIB must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223684
CAT I
The IBM RACF System REXX IRRPWREX security data set must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223685
CAT I
IBM RACF security data sets and/or databases must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223690
CAT II
IBM RACF must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-223697
CAT I
IBM z/OS SYS1.PARMLIB must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223826
CAT II
IBM z/OS data sets for the Base TCP/IP component must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223845
CAT II
IBM z/OS UNIX MVS data sets or HFS objects must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223846
CAT II
IBM z/OS UNIX MVS data sets WITH z/OS UNIX COMPONENTS must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223847
CAT II
IBM z/OS UNIX HFS permission bits and audit bits for each directory must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223848
CAT II
IBM z/OS UNIX SYSTEM FILE SECURITY SETTINGS must be properly protected or specified.
IBM z/OS RACF Security Technical Implementation Guide
V-223849
CAT II
IBM z/OS UNIX MVS data sets used as step libraries in /etc/steplib must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223865
CAT II
IBM z/OS HFS objects for the z/OS UNIX Telnet Server must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223869
CAT II
IBM z/OS System datasets used to support the VTAM network must be properly secured.
IBM z/OS RACF Security Technical Implementation Guide
V-223870
CAT II
IBM z/OS VTAM USSTAB definitions must not be used for unsecured terminals.
IBM z/OS RACF Security Technical Implementation Guide
V-235033
CAT II
IBM RACF must limit WRITE or greater access to LINKLIST libraries to system programmers only.
IBM z/OS RACF Security Technical Implementation Guide
V-255939
CAT II
IBM Integrated Crypto Service Facility (ICSF) STC data sets must be properly protected.
IBM z/OS RACF Security Technical Implementation Guide
V-223882
CAT I
IBM z/OS SYS1.PARMLIB must be properly protected.
IBM z/OS TSS Security Technical Implementation Guide
V-223893
CAT II
CA-TSS access to SYS1.LINKLIB must be properly protected.
IBM z/OS TSS Security Technical Implementation Guide
V-223894
CAT I
CA-TSS must limit Write or greater access to SYS1.SVCLIB to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223895
CAT I
CA-TSS must limit Write or greater access to SYS1.IMAGELIB to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223896
CAT I
CA-TSS must limit Write or greater access to SYS1.LPALIB to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223897
CAT I
CA-TSS must limit WRITE or greater access to all APF-authorized libraries to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223898
CAT I
IBM z/OS libraries included in the system REXXLIB concatenation must be properly protected.
IBM z/OS TSS Security Technical Implementation Guide
V-223899
CAT I
CA-TSS must limit Write or greater access to all LPA libraries to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223900
CAT I
CA-TSS must limit Write or greater access to SYS1.NUCLEUS to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223901
CAT III
CA-TSS must limit Write or greater access to libraries that contain PPT modules to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223902
CAT II
CA-TSS must limit WRITE or greater access to LINKLIST libraries to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223903
CAT I
CA-TSS security data sets and/or databases must be properly protected.
IBM z/OS TSS Security Technical Implementation Guide
V-223906
CAT II
CA-TSS must limit WRITE or greater access to all system-level product installation libraries to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide
V-223907
CAT II
CA-TSS must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
IBM z/OS TSS Security Technical Implementation Guide