STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM z/OS ACF2 Security Technical Implementation Guide

Version

V9R8

Release Date

Mar 9, 2026

SCAP Benchmark ID

IBM_zOS_ACF2_STIG

Total Checks

225

Tags

other
CAT I: 24CAT II: 197CAT III: 4

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (225)

V-223419MEDIUMIBM z/OS Certificate Name Filtering must be implemented with appropriate authorization and documentation.V-223420MEDIUMIBM z/OS must not use Expired Digital Certificates.V-223421MEDIUMAll IBM z/OS digital certificates in use must have a valid path to a trusted Certification authority.V-223422HIGHCA-ACF2 OPTS GSO record must be set to ABORT mode.V-223423MEDIUMThe number of ACF2 users granted the special privilege PPGM must be justified.V-223424LOWThe number of ACF2 users granted the special privilege OPERATOR must be kept to a strictly controlled minimum.V-223425LOWThe number of ACF2 users granted the special privilege CONSOLE must be justified.V-223426MEDIUMThe number of ACF2 users granted the special privilege ALLCMDS must be justified.V-223427MEDIUMIBM z/OS system commands must be properly protected.V-223428MEDIUMIBM z/OS Sensitive Utility Controls must be properly defined and protected.V-223429MEDIUMCA-ACF2 NJE GSO record value must indicate validation options that apply to jobs submitted through a network job entry subsystem (JES2, JES3, RSCS).V-223430MEDIUMCA-ACF2 must protect Memory and privileged program dumps in accordance with proper security requirements.V-223431MEDIUMCA-ACF2 must properly define users that have access to the CONSOLE resource in the TSOAUTH resource class.V-223433MEDIUMCA-ACF2 must limit access to SYSTEM DUMP data sets to appropriate authorized users.V-223434MEDIUMCA-ACF2 must limit access to SYS(x).TRACE to system programmers only.V-223435MEDIUMCA-ACF2 allocate access to system user catalogs must be properly protected.V-223436MEDIUMACF2 Classes required to properly security the z/OS UNIX environment must be ACTIVE.V-223437MEDIUMAccess to IBM z/OS special privilege TAPE-LBL or TAPE-BLP must be limited and/or justified.V-223438MEDIUMCA-ACF2 must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers.V-223439HIGHIBM z/OS must protect dynamic lists in accordance with proper security requirements.V-223440HIGHIBM z/OS Libraries included in the system REXXLIB concatenation must be properly protected.V-223441HIGHCA-ACF2 must limit Write or greater access to SYS1.UADS To system programmers only and read and update access must be limited to system programmer personnel and/or security personnel.V-223442HIGHCA-ACF2 must limit all system PROCLIB data sets to appropriate authorized users.V-223443HIGHCA-ACF2 access to the System Master Catalog must be properly protected.V-223444MEDIUMIBM z/OS MCS consoles access authorization(s) for CONSOLE resource(s) must be properly protected.V-223445HIGHCA-ACF2 must limit Write or greater access to SYS1.NUCLEUS to system programmers only.V-223446HIGHCA-ACF2 must limit Write or greater access to SYS1.LPALIB to system programmers only.V-223447HIGHCA-ACF2 must limit Write or greater access to SYS1.IMAGELIB to system programmers.V-223448HIGHCA-ACF2 must limit Write or greater access to Libraries containing EXIT modules to system programmers only.V-223449HIGHCA-ACF2 must limit Write and Allocate access to all APF-authorized libraries to system programmers only.V-223450HIGHCA-ACF2 must limit Write or greater access to all LPA libraries to system programmers only.V-223451MEDIUMCA-ACF2 must limit Write and Allocate access to LINKLIST libraries to system programmers only.V-223452MEDIUMCA-ACF2 must limit Write and allocate access to all system-level product installation libraries to system programmers only.V-223453HIGHCA-ACF2 must limit Write or greater access to SYS1.SVCLIB to system programmers only.V-223454MEDIUMCA-ACF2 Access to SYS1.LINKLIB must be properly protected.V-223455MEDIUMCA-ACF2 must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.V-223456HIGHCA-ACF2 LOGONIDs must not be defined to SYS1.UADS for non-emergency use.V-223457MEDIUMIBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.V-223458MEDIUMCA-ACF2 must limit Update and Allocate access to system backup files to system programmers and/or batch jobs that perform DASD backups.V-223459MEDIUMACF2 PPGM GSO record value must specify protected programs that are only executed by privileged users.V-223462MEDIUMThe CA-ACF2 PSWD GSO record values for MAXTRY and PASSLMT must be properly set.V-223463HIGHIBM z/OS SYS1.PARMLIB must be properly protected.V-223464HIGHCA-ACF2 must be installed, functional, and properly configured.V-223465MEDIUMCA-ACF2 must limit Write and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.V-223466LOWCA-ACF2 must limit Write or greater access to libraries that contain PPT modules to system programmers only.V-223467MEDIUMThe EXITS GSO record value must specify the module names of site written ACF2 exit routines.V-223468MEDIUMThe CA-ACF2 LOGONID with the REFRESH attribute must have procedures for utilization.V-223469MEDIUMIBM z/OS TSO GSO record values must be set to the values specified.V-223470MEDIUMIBM z/OS procedures must restrict ACF2 LOGONIDs with the READALL attribute to auditors and/or authorized users.V-223471MEDIUMIBM z/OS must have the RULEVLD and RSRCVLD attributes specified for LOGONIDs with the SECURITY attribute.V-223472MEDIUMIBM z/OS LOGONIDs with the AUDIT or CONSULT attribute must be properly scoped.V-223473MEDIUMIBM z/OS LOGONID with the ACCTPRIV attribute must be restricted to the ISSO.V-223474MEDIUMIBM z/OS batch jobs with restricted ACF2 LOGONIDs must have the PGM(xxxxxxxx) and SUBAUTH attributes or the SOURCE(xxxxxxxx) attribute assigned to the corresponding LOGONIDs.V-223475MEDIUMCA-ACF2 RULEOPTS GSO record values must be set to the values specified.V-223476MEDIUMThe CA-ACF2 GSO OPTS record value must be properly specified.V-223477MEDIUMCA-ACF2 must prevent the use of dictionary words for passwords.V-223478MEDIUMCA-ACF2 database must be on a separate physical volume from its backup and recovery data sets.V-223479MEDIUMCA-ACF2 database must be backed up on a scheduled basis.V-223480MEDIUMACF2 REFRESH attribute must be restricted to security administrators' LOGON ID only.V-223481MEDIUMACF2 maintenance LOGONIDs must have corresponding GSO MAINT records.V-223482MEDIUMACF2 LOGONIDs with the NON-CNCL attribute specified in the associated LOGONID record must be listed as trusted and must be specifically approved.V-223483MEDIUMACF2 LOGONIDs with the ACCOUNT, LEADER, or SECURITY attribute must be properly scoped.V-223484MEDIUMACF2 LOGONIDs associated with started tasks that have the MUSASS attribute and the requirement to submit jobs on behalf of its users must have the JOBFROM attribute as required.V-223485MEDIUMIBM z/OS Started Tasks must be properly identified and defined to ACF2.V-223486MEDIUMACF2 emergency LOGONIDS with the REFRESH attribute must have the SUSPEND attribute specified.V-223487MEDIUMACF2 BACKUP GSO record must be defined with a TIME value specifies greater than 00 unless the database is shared and backed up on another system.V-223488LOWACF2 APPLDEF GSO record if used must have supporting documentation indicating the reason it was used.V-223489MEDIUMACF2 MAINT GSO record value if specified must be restricted to production storage management user.V-223490MEDIUMACF2 LINKLST GSO record if specified must only contains trusted system data sets.V-223491MEDIUMIBM z/OS must properly protect MCS console userid(s).V-223492MEDIUMACF2 BLPPGM GSO record must not be defined.V-223493HIGHIBM z/OS UID(0) must be properly assigned.V-223494MEDIUMIBM z/OS user account for the UNIX kernel (OMVS) must be properly defined to the security database.V-223495MEDIUMIBM z/OS user account for the UNIX (RMFGAT) must be properly defined.V-223496MEDIUMACF2 LOGONIDs must be defined with the required fields completed.V-223497MEDIUMCA-ACF2 defined user accounts must uniquely identify system users.V-223498MEDIUMCA-ACF2 userids found inactive for more than 35 days must be suspended.V-223499MEDIUMCA-ACF2 PWPHRASE GSO record must be properly defined.V-223500MEDIUMCA-ACF2 must enforce password complexity by requiring that at least one special character be used.V-223501MEDIUMACF2 PSWD GSO record value must be set to require at least one uppercase character be used.V-223502MEDIUMACF2 PSWD GSO record value must be set to require at least one numeric character be used.V-223503MEDIUMACF2 PSWD GSO record value must be set to require at least one lowercase character be used.V-223504MEDIUMACF2 PSWD GSO record value must be set to require the change of at least 50 percent of the total number of characters when passwords are changed.V-223505HIGHACF2 must use NIST FIPS-validated cryptography to protect passwords in the security database.V-223506MEDIUMACF2 PSWD GSO record value must be set to require a 60-day maximum password lifetime restriction.V-223507MEDIUMACF2 PSWD GSO record value must be set to require 24 hours/one day as the minimum password lifetime.V-223508MEDIUMACF2 PSWD GSO record value must be set to prohibit password reuse for a minimum of five generations or more.V-223509MEDIUMACF2 TSOTWX GSO record values must be set to obliterate the logon password on TWX devices.V-223510MEDIUMACF2 TSOCRT GSO record values must be set to obliterate the logon to ASCII CRT devices.V-223511MEDIUMACF2 TSO2741 GSO record values must be set to obliterate the logon password on 2741 devices.V-223512MEDIUMACF2 SECVOLS GSO record value must be set to VOLMASK(). Any local changes are justified and documented with the ISSO.V-223513MEDIUMACF2 RESVOLS GSO record value must be set to Volmask(-). Any other setting requires documentation justifying the change.V-223514HIGHACF2 security data sets and/or databases must be properly protected.V-223515MEDIUMACF2 AUTOERAS GSO record value must be set to indicate that ACF2 is controlling the automatic physical erasure of VSAM or non VSAM data sets.V-223517MEDIUMIBM z/OS SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.V-223518MEDIUMIBM z/OS data sets for the FTP Server must be properly protected.V-223519MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the FTP Server component must be properly configured.V-223520MEDIUMIBM z/OS FTP.DATA configuration statements must have a proper BANNER statement with the Standard Mandatory DoD Notice and Consent Banner.V-223522MEDIUMIBM z/OS FTP.DATA configuration statements for the FTP Server must specify the BANNER statement.V-223523MEDIUMIBM z/OS FTP Control cards must be properly stored in a secure PDS file.V-223525MEDIUMIBM z/OS FTP Server daemon must be defined with proper security parameters.V-223526MEDIUMIBM z/OS startup parameters for the FTP Server must be defined in the SYSTCPD and SYSFTPD DD statements for configuration files.V-223527MEDIUMIBM z/OS FTP.DATA configuration for the FTP Server must have INACTIVE statement properly set.V-223528MEDIUMIBM z/OS JESTRACE and/or SYSLOG resources must be protected in accordance with security requirements.V-223529MEDIUMIBM z/OS JESSPOOL resources must be protected in accordance with security requirements.V-223530MEDIUMIBM z/OS JESNEWS resources must be protected in accordance with security requirements.V-223531MEDIUMIBM z/OS JES2 system commands must be protected in accordance with security requirements.V-223532MEDIUMIBM z/OS JES2 spool resources must be controlled in accordance with security requirements.V-223533MEDIUMIBM z/OS JES2 output devices must be properly controlled for Classified Systems.V-223534MEDIUMIBM z/OS JES2 output devices must be controlled in accordance with the proper security requirements.V-223535MEDIUMIBM z/OS JES2 input sources must be controlled in accordance with the proper security requirements.V-223536MEDIUMIBM z/OS Surrogate users must be controlled in accordance with proper security requirements.V-223537MEDIUMThe IBM z/OS BPX.SMF resource must be properly configured.V-223539MEDIUMIBM z/OS Inapplicable PPT entries must be invalidated.V-223540MEDIUMThe IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are removed.V-223541MEDIUMThe IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are modified.V-223542MEDIUMThe IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are deleted.V-223543MEDIUMThe IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are created.V-223544MEDIUMIBM z/OS Required SMF data record types must be collected.V-223545MEDIUMIBM z/OS special privileges must be assigned on an as-needed basis to LOGONIDs associated with STCs and LOGONIDs that need to execute TSO in batch.V-223546MEDIUMIBM z/OS must specify SMF data options to assure appropriate activation.V-223547MEDIUMIBM z/OS SMF collection files (system MANx data sets or LOGSTREAM DASD) must have storage capacity to store at least one weeks worth of audit data.V-223548MEDIUMIBM z/OS system administrators must develop an automated process to collect and retain SMF data.V-223549MEDIUMIBM z/OS BUFUSEWARN in the SMFPRMxx must be properly set.V-223550MEDIUMIBM z/OS NOBUFFS in SMFPRMxx must be properly set (Default is MSG).V-223551MEDIUMIBM z/OS Time Protocol must be properly configured.V-223552MEDIUMThe IBM z/OS system must use a time protocol that syncs with an authoritative external time source.V-223553MEDIUMIBM z/OS PARMLIB CLOCKxx must have the Accuracy PARM coded properly.V-223554MEDIUMIBM z/OS SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing.V-223556MEDIUMIBM z/OS PASSWORD data set and OS passwords must not be used.V-223557MEDIUMIBM z/OS must configure system waittimes to protect resource availability based on site priorities.V-223558MEDIUMIBM z/OS Emergency LOGONIDs must be properly defined.V-223560MEDIUMIBM z/OS Policy Agent must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.V-223561HIGHUnsupported IBM z/OS system software must not be installed and/or active on the system.V-223562MEDIUMIBM z/OS must not allow non-existent or inaccessible LINKLIST libraries.V-223563MEDIUMIBM z/OS must not allow non-existent or inaccessible Link Pack Area (LPA) libraries.V-223564MEDIUMIBM z/OS must not have inaccessible APF libraries defined.V-223565MEDIUMIBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s).V-223566MEDIUMDuplicated IBM z/OS sensitive utilities and/or programs must not exist in APF libraries.V-223567MEDIUMIBM z/OS must properly configure CONSOLxx members.V-223568MEDIUMIBM z/OS must use ICSF or SAF Key Rings for key management.V-223569HIGHThe IBM z/OS systems requiring data at rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.V-223570MEDIUMIBM z/OS sensitive and critical system data sets must not exist on shared DASD.V-223571MEDIUMIBM z/OS Policy agent must contain a policy that protects against or limits the effects of Denial of Service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.V-223572MEDIUMIBM z/OS Policy agent must contain a policy that manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.V-223573MEDIUMIBM z/OS must employ a session manager to manage retaining a users session lock until that user reestablishes access using established identification and authentication procedures.V-223574MEDIUMIBM z/OS system administrator must develop a procedure to notify designated personnel if baseline configurations are changed in an unauthorized manner.V-223575MEDIUMIBM z/OS must employ a session manager that conceal, via the session lock, information previously visible on the display with a publicly viewable image.V-223576MEDIUMIBM z/OS must employ a session manager to manage session lock after a 15-minute period of inactivity.V-223577MEDIUMThe IBM z/OS system administrator (SA) must develop a procedure to automatically remove or disable temporary user accounts after 72 hours.V-223578MEDIUMIBM z/OS system administrator must develop a procedure to automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.V-223579MEDIUMIBM z/OS system administrator must develop a procedure to notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.V-223581MEDIUMIBM z/OS system administrator must develop a procedure to remove all software components after updated versions have been installed.V-223582MEDIUMIBM z/OS system administrator must develop a procedure to shut down the information system, restart the information system, and/or notify the system administrator when anomalies in the operation of any security functions are discovered.V-223583MEDIUMIBM z/OS must employ a session manager configured for users to directly initiate a session lock for all connection types.V-223584MEDIUMACF2 system administrator must develop a procedure to disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.V-223585MEDIUMIBM z/OS system administrator must develop a procedure to offload SMF files to a different system or media than the system being audited.V-223586MEDIUMIBM z/OS SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events.V-223587MEDIUMIBM z/OS SSH daemon must be configured with the Department of Defense (DoD) logon banner.V-223588HIGHIBM z/OS SSH daemon must be configured to only use the SSHv2 protocol.V-223589HIGHIBM z/OS SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm.V-223590MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the Syslog daemon component must be configured properly.V-223591MEDIUMIBM z/OS Syslog daemon must be started at z/OS initialization.V-223592MEDIUMIBM z/OS Syslog daemon must be properly defined and secured.V-223593MEDIUMIBM z/OS DFSMS resource class(es) must be defined to the GSO CLASMAP record in accordance with security requirements.V-223594MEDIUMIBM z/OS DFSMS Program Resources must be properly defined and protected.V-223595MEDIUMIBM z/OS DFSMS control data sets must be protected in accordance with security requirements.V-223596MEDIUMIBM z/OS DFMSM resource class(es)must be defined to the GSO SAFDEF record in accordance with security requirements.V-223597MEDIUMIBM z/OS DFSMS resources must be protected in accordance with the proper security requirements.V-223598MEDIUMIBM z/OS using DFSMS must properly specify SYS(x).PARMLIB(IGDSMSxx), SMS parameter settings.V-223599MEDIUMIBM z/OS PROFILE.TCPIP configuration statements for the TCP/IP stack must be coded properly.V-223600MEDIUMIBM z//OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.V-223601MEDIUMIBM z/OS TCP/IP resources must be properly protected.V-223602MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the Base TCP/IP component must be configured properly.V-223603MEDIUMIBM z/OS data sets for the Base TCP/IP component must be properly protected.V-223604MEDIUMIBM z/OS Configuration files for the TCP/IP stack must be properly specified.V-223605MEDIUMIBM z/OS Started tasks for the Base TCP/IP component must be defined in accordance with security requirements.V-223608MEDIUMIBM z/OS PROFILE.TCPIP configuration INACTIVITY statement must be configured to 900 seconds.V-223609MEDIUMIBM z/OS SMF recording options for the TN3270 Telnet Server must be properly specified.V-223610MEDIUMIBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.V-223611MEDIUMIBM z/OS TN3270 Telnet Server configuration statement MSG10 text must have the Standard Mandatory DoD Notice and Consent Banner.V-223613MEDIUMIBM z/OS VTAM session setup controls for the TN3270 Telnet Server must be properly specified.V-223615MEDIUMIBM z/OS TSOAUTH resources must be restricted to authorized users.V-223616HIGHIBM z/OS UNIX SUPERUSER resource must be protected in accordance with guidelines.V-223617MEDIUMIBM z/OS UNIX security parameters in etc/profile must be properly specified.V-223618MEDIUMIBM z/OS UNIX security parameters in /etc/rc must be properly specified.V-223619MEDIUMIBM z/OS UNIX resources must be protected in accordance with security requirements.V-223620MEDIUMIBM z/OS UNIX MVS HFS directory(s) with other write permission bit set must be properly defined.V-223621MEDIUMIBM z/OS BPX resource(s) must be protected in accordance with security requirements.V-223622MEDIUMIBM z/OS UNIX SYSTEM FILE SECURITY SETTINGS must be properly protected or specified.V-223623MEDIUMIBM z/OS UNIX MVS data sets with z/OS UNIX components must be properly protected.V-223624MEDIUMIBM z/OS UNIX MVS data sets or HFS objects must be properly protected.V-223625MEDIUMIBM z/OS UNIX HFS permission bits and audit bits for each directory must be properly protected.V-223626MEDIUMIBM z/OS UNIX MVS data sets used as step libraries in /etc/steplib must be properly protected.V-223629MEDIUMIBM z/OS UNIX OMVS parameters in PARMLIB must be properly specified.V-223630MEDIUMIBM z/OS UNIX HFS MapName files security parameters must be properly specified.V-223631MEDIUMIBM z/OS UNIX BPXPRMxx security parameters in PARMLIB must be properly specified.V-223632MEDIUMIBM z/OS User exits for the FTP Server must not be used without proper approval and documentation.V-223633MEDIUMIBM z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf must be properly specified.V-223634MEDIUMIBM z/OS user account for the z/OS UNIX SUPERSUSER userid must be properly defined.V-223635MEDIUMIBM z/OS UNIX user accounts must be properly defined.V-223636MEDIUMIBM z/OS UNIX groups must be defined with a unique GID.V-223637MEDIUMIBM z/OS Attributes of z/OS UNIX user accounts must have a unique GID in the range of 1-99.V-223638MEDIUMIBM z/OS Attributes of UNIX user accounts used for account modeling must be defined in accordance with security requirements.V-223639MEDIUMIBM z/OS startup user account for the z/OS UNIX Telnet Server must be defined properly.V-223640MEDIUMIBM z/OS HFS objects for the z/OS UNIX Telnet Server must be properly protected.V-223641MEDIUMIBM z/OS UNIX Telnet Server etc/banner file must have the Standard Mandatory DoD Notice and Consent Banner.V-223642MEDIUMIBM z/OS UNIX Telnet Server warning banner must be properly specified.V-223643MEDIUMIBM z/OS UNIX Telnet Server Startup parameters must be properly specified to display the banner.V-223644MEDIUMIBM z/OS System data sets used to support the VTAM network must be properly secured.V-223645MEDIUMIBM z/OS VTAM USSTAB definitions must not be used for unsecured terminals.V-245535MEDIUMIBM z/OS TCPIP.DATA configuration statement must contain the DOMAINORIGIN or DOMAIN specified for each TCP/IP defined.V-252547MEDIUMIBM z/OS TCP/IP AT-TLS policy must be properly configured in Policy Agent.V-252705MEDIUMIBM z/OS must enforce a minimum eight character password length.V-255895MEDIUMIBM z/OS FTP.DATA configuration statements for the FTP Server must be specified in accordance with requirements.V-255932MEDIUMIBM Integrated Crypto Service Facility (ICSF) Configuration parameters must be correctly specified.V-255933MEDIUMIBM Integrated Crypto Service Facility (ICSF) install data sets must be properly protected.V-255934MEDIUMIBM Integrated Crypto Service Facility (ICSF) Started Task name must be properly identified / defined to the system ACP.V-255945MEDIUMIBM Integrated Crypto Service Facility (ICSF) STC data sets must be properly protected.V-272873MEDIUMIBM z/OS DFSMS control data sets must reside on separate storage volumes.V-272874MEDIUMIBM z/OS RJE workstations and NJE nodes must be defined to the FACILITY resource class.V-275949MEDIUMzOSMF resource class(es) must be defined to the ACF2 GSO CLASMAP record in accordance with security requirements.V-275951MEDIUMICSF resources must be protected in accordance with security requirements.V-275964MEDIUMzOSMF resources must be protected in accordance with security requirements.V-275965MEDIUMICSF resource class(es) must be defined to the ACF2 GSO CLASMAP record in accordance with security requirements.