STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 2 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM Hardware Management Console (HMC) STIG

Archived

Version

V1R5

Release Date

Jan 20, 2015

SCAP Benchmark ID

S-6716b96cd48327612716d82ef6931fd3e39ea519

Total Checks

35

Tags

other
CAT I: 10CAT II: 24CAT III: 1

IBM Hardware Management Console is used to perform Initial Program Loads (IPLs), power on resets, shutdowns, and configuring of hardware components for system logical partitions.

Export CKLExport CSVExport JSON

Checks (35)

V-24340HIGHThe Enterprise System Connection (ESCON) Director (ESCD) Application Console must be located in a secure locationV-24342MEDIUMSign-on to the ESCD Application Console must be restricted to only authorized personnel.V-24343HIGHThe ESCON Director Application Console Event log must be enabled.V-24344MEDIUMThe Distributed Console Access Facility (DCAF) Console must be restricted to only authorized personnel.V-24345HIGHThe Hardware Management Console must be located in a secure location.V-24348MEDIUMDial-out access from the Hardware Management Console Remote Support Facility (RSF) must be restricted to an authorized vendor site.V-24349MEDIUMAccess to the Hardware Management Console must be restricted to only authorized personnel. V-24350MEDIUMAutomatic Call Answering to the Hardware Management Console must be disabled.V-24352MEDIUMThe Hardware Management Console Event log must be active.V-24353HIGHThe manufacturer’s default passwords must be changed for all Hardware Management Console (HMC) Management software.V-24354MEDIUMPredefined task roles to the Hardware Management Console (HMC) must be specified to limit capabilities of individual users.V-24355MEDIUMIndividual user accounts with passwords must be maintained for the Hardware Management Console operating system and application.V-24356MEDIUMThe PASSWORD History Count value must be set to 10 or greater.V-24358MEDIUMThe PASSWORD expiration day(s) value must be set to equal or less then 60 days.V-24359MEDIUMMaximum failed password attempts before disable delay must be set to 3 or less.V-24360MEDIUMThe password values must be set to meet the requirements in accordance with DoDI 8500.2 for DoD information systems processing sensitive information and above, and CJCSI 6510.01E (INFORMATION ASSURANCE (IA) AND COMPUTER NETWORK DEFENSE (CND)).V-24361MEDIUMThe terminal or workstation must lock out after a maximum of 15 minutes of inactivity, requiring the account password to resume.V-24362MEDIUMThe Department of Defense (DoD) logon banner must be displayed prior to any login attempt.V-24363MEDIUMA private web server must subscribe to certificates, issued from any DoD-authorized Certificate Authority, as an access control mechanism for web users. V-24364MEDIUMHardware Management Console audit record content data must be backed up.V-24373MEDIUMHardware Management Console management must be accomplished by using the out-of-band or direct connection method.V-24378MEDIUMUnauthorized partitions must not exist on the system complex.V-24379MEDIUMOn Classified Systems, Logical Partition must be restricted with read/write access to only its own IOCDS.V-24380MEDIUMProcessor Resource/Systems Manager (PR/SM) must not allow unrestricted issuing of control program commands.V-24381HIGHClassified Logical Partition (LPAR) channel paths must be restricted.V-24382MEDIUMOn Classified Systems the Processor Resource/Systems Manager (PR/SM) must not allow access to system complex data. V-24383HIGHCentral processors must be restricted for classified/restricted Logical Partitions (LPARs).V-24398HIGHDial-out access from the Hardware Management Console Remote Support Facility (RSF) must be disabled for all classified systems. V-25247MEDIUMDCAF Console access must require a password to be entered by each user. V-25386MEDIUMAccess to the Hardware Management Console (HMC) must be restricted by assigning users proper roles and responsibilities.V-25387MEDIUMAudit records content must contain valid information to allow for proper incident reporting.V-25388HIGHProduct engineering access to the Hardware Management Console must be disabled.V-25400HIGHConnection to the Internet for IBM remote support must be in compliance with the Remote Access STIGs.V-25404LOWA maximum of 60-minute delay must be specified for the password retry after 3 failed attempts to enter your passwordV-25405HIGHConnection to the Internet for IBM remote support must be in compliance with mitigations specified in the Ports and Protocols and Services Management (PPSM) requirements.