STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM z/OS RACF Security Technical Implementation Guide

Version

V9R8

Release Date

Mar 9, 2026

SCAP Benchmark ID

IBM_zOS_RACF_STIG

Total Checks

222

Tags

other
CAT I: 27CAT II: 193CAT III: 2

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (222)

V-223646MEDIUMCertificate Name Filtering must be implemented with appropriate authorization and documentation.V-223647MEDIUMExpired digital certificates must not be used.V-223648MEDIUMAll digital certificates in use must have a valid path to a trusted certification authority (CA).V-223649HIGHIBM RACF must limit Write or greater access to SYS1.NUCLEUS to system programmers only.V-223650LOWIBM RACF must limit Write or greater access to libraries that contain PPT modules to system programmers only.V-223652MEDIUMIBM RACF emergency USERIDs must be properly defined.V-223653MEDIUMIBM RACF SETROPTS LOGOPTIONS must be properly configured.V-223654MEDIUMIBM RACF must protect memory and privileged program dumps in accordance with proper security requirements.V-223655MEDIUMIBM z/OS system commands must be properly protected.V-223656MEDIUMIBM RACF must properly define users that have access to the CONSOLE resource in the TSOAUTH resource class.V-223657MEDIUMThe IBM RACF FACILITY resource class must be active.V-223658MEDIUMThe IBM RACF OPERCMDS resource class must be active.V-223659MEDIUMThe IBM RACF MCS consoles resource class must be active.V-223660MEDIUMIBM RACF CLASSACT SETROPTS must be specified for the TEMPDSN class.V-223661MEDIUMIBM RACF started tasks defined with the trusted attribute must be justified.V-223662MEDIUMIBM RACF USERIDs possessing the Tape Bypass Label Processing (BLP) privilege must be justified.V-223663MEDIUMIBM RACF DASD volume-level protection must be properly defined.V-223664MEDIUMIBM Sensitive Utility Controls must be properly defined and protected.V-223665MEDIUMIBM RACF Global Access Checking must be restricted to appropriate classes and resources.V-223666HIGHIBM RACF access to the System Master Catalog must be properly protected.V-223667HIGHIBM RACF must limit Write or greater access to SYS1.UADS to system programmers only, and WRITE or greater access must be limited to system programmer personnel and/or security personnel.V-223668HIGHIBM z/OS must protect dynamic lists in accordance with proper security requirements.V-223669MEDIUMIBM RACF allocate access to system user catalogs must be properly protected.V-223670MEDIUMIBM RACF must limit WRITE or greater access to System backup files to system programmers and/or batch jobs that perform DASD backups.V-223671MEDIUMIBM RACF must limit access to SYS(x).TRACE to system programmers only.V-223672MEDIUMIBM RACF batch jobs must be properly secured.V-223673MEDIUMIBM RACF batch jobs must be protected with propagation control.V-223674HIGHIBM RACF must limit Write or greater access to SYS1.IMAGELIB to system programmers only.V-223675HIGHIBM RACF must limit Write or greater access to SYS1.SVCLIB to appropriate authorized users.V-223676HIGHIBM RACF must limit Write or greater access to SYS1.LPALIB to system programmers only.V-223677HIGHIBM z/OS libraries included in the system REXXLIB concatenation must be properly protected.V-223678HIGHIBM RACF must limit write or greater access to all LPA libraries to system programmers only.V-223679HIGHIBM RACF must limit Write or greater access to libraries containing EXIT modules to system programmers only.V-223680MEDIUMIBM RACF must limit WRITE or greater access to all system-level product installation libraries to system programmers.V-223681MEDIUMIBM RACF must limit access to SYSTEM DUMP data sets to system programmers only.V-223682HIGHIBM RACF must limit WRITE or greater access to all APF-authorized libraries to system programmers only.V-223683MEDIUMIBM RACF access to SYS1.LINKLIB must be properly protected.V-223684HIGHThe IBM RACF System REXX IRRPWREX security data set must be properly protected.V-223685HIGHIBM RACF security data sets and/or databases must be properly protected.V-223686MEDIUMIBM RACF must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.V-223687HIGHIBM RACF must limit all system PROCLIB data sets to system programmers only.V-223688MEDIUMIBM RACF must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers.V-223689MEDIUMIBM z/OS MCS consoles access authorization(s) for CONSOLE resource(s) must be properly protected.V-223690MEDIUMIBM RACF must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.V-223691MEDIUMThe IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.V-223692MEDIUMThe IBM RACF JES(BATCHALLRACF) SETROPTS value must be set to JES(BATCHALLRACF).V-223693MEDIUMThe IBM z/OS JES(XBMALLRACF) SETROPTS value must be set to JES(XBMALLRACF).V-223694MEDIUMIBM RACF OPERAUDIT SETROPTS value must set to OPERAUDIT.V-223695MEDIUMThe IBM RACF PASSWORD(REVOKE) SETROPTS value must be specified to revoke the userid after three invalid logon attempts.V-223697HIGHIBM z/OS SYS1.PARMLIB must be properly protected.V-223699MEDIUMThe IBM RACF SETROPTS SAUDIT value must be specified.V-223700MEDIUMThe IBM RACF REALDSN SETROPTS value must be specified.V-223701MEDIUMIBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.V-223702MEDIUMIBM RACF SETROPTS RVARYPW values must be properly set.V-223703HIGHIBM RACF must define WARN = NO on all profiles.V-223704HIGHThe IBM RACF PROTECTALL SETROPTS value specified must be properly set.V-223705MEDIUMThe IBM RACF GRPLIST SETROPTS value must be set to ACTIVE.V-223706MEDIUMThe IBM RACF RETPD SETROPTS value specified must be properly set.V-223707MEDIUMThe IBM RACF TAPEDSN SETROPTS value specified must be properly set.V-223708MEDIUMThe IBM RACF WHEN(PROGRAM) SETROPTS value specified must be active.V-223709MEDIUMIBM RACF use of the AUDITOR privilege must be justified.V-223710MEDIUMThe IBM RACF database must be on a separate physical volume from its backup and recovery datasets.V-223711MEDIUMThe IBM RACF database must be backed up on a scheduled basis.V-223712MEDIUMIBM z/OS Batch job user IDs must be properly defined.V-223713MEDIUMIBM RACF use of the RACF SPECIAL Attribute must be justified.V-223714MEDIUMIBM RACF assignment of the RACF OPERATIONS attribute to individual userids must be fully justified.V-223715MEDIUMIBM z/OS must properly configure CONSOLxx members.V-223716MEDIUMIBM z/OS must properly protect MCS console userid(s).V-223717MEDIUMIBM RACF users must have the required default fields.V-223719MEDIUMIBM z/OS Started Tasks must be properly identified and defined to RACF.V-223721MEDIUMThe IBM RACF Automatic Data Set Protection (ADSP) SETROPTS value must be set to NOADSP.V-223722MEDIUMIBM RACF user accounts must uniquely identify system users.V-223723MEDIUMThe IBM RACF INACTIVE SETROPTS value must be set to 35 days.V-223724MEDIUMIBM RACF PASSWORD(RULEn) SETROPTS value(s) must be properly set.V-223725MEDIUMIBM RACF exit ICHPWX01 must be installed and properly configured.V-223726MEDIUMThe IBM RACF SETROPTS PASSWORD(MINCHANGE) value must be set to 1.V-223727MEDIUMIBM RACF SETROPTS PASSWORD(INTERVAL) must be set to 60 days.V-223728MEDIUMThe IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to five or more.V-223729HIGHNIST FIPS-validated cryptography must be used to protect passwords in the security database.V-223731MEDIUMThe IBM RACF ERASE ALL SETROPTS value must be set to ERASE(ALL) on all systems.V-223732MEDIUMIBM RACF DASD Management USERIDs must be properly controlled.V-223733MEDIUMIBM z/OS SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.V-223734MEDIUMIBM RACF permission bits and user audit bits for HFS objects that are part of the FTP server component must be properly configured.V-223735MEDIUMIBM z/OS data sets for the FTP server must be properly protected.V-223736MEDIUMIBM z/OS FTP.DATA configuration statements must indicate a BANNER statement with the proper content.V-223737MEDIUMIBM z/OS FTP.DATA configuration statements for the FTP server must specify the BANNER statement.V-223739MEDIUMIBM z/OS FTP.DATA configuration statements for the FTP Server must be specified in accordance with requirements.V-223741MEDIUMIBM z/OS user exits for the FTP server must not be used without proper approval and documentation.V-223742MEDIUMThe IBM z/OS FTP server daemon must be defined with proper security parameters.V-223743MEDIUMIBM FTP.DATA configuration for the FTP server must have the INACTIVE statement properly set.V-223744MEDIUMIBM z/OS startup parameters for the FTP server must have the INACTIVE statement properly set.V-223745MEDIUMIBM z/OS RJE workstations and NJE nodes must be defined to the FACILITY resource class.V-223746MEDIUMIBM z/OS JES2 input sources must be controlled in accordance with the proper security requirements.V-223747MEDIUMIBM z/OS JES2 input sources must be properly controlled.V-223748MEDIUMIBM z/OS JES2 output devices must be controlled in accordance with the proper security requirements.V-223749MEDIUMIBM z/OS JES2 output devices must be properly controlled for classified systems.V-223750MEDIUMIBM z/OS JESSPOOL resources must be protected in accordance with security requirements.V-223751MEDIUMIBM z/OS JESNEWS resources must be protected in accordance with security requirements.V-223752MEDIUMIBM z/OS JESTRACE and/or SYSLOG resources must be protected in accordance with security requirements.V-223753MEDIUMIBM z/OS JES2 spool resources must be controlled in accordance with security requirements.V-223754MEDIUMIBM z/OS JES2 system commands must be protected in accordance with security requirements.V-223755MEDIUMIBM z/OS surrogate users must be controlled in accordance with proper security requirements.V-223756MEDIUMIBM z/OS RJE workstations and NJE nodes must be controlled in accordance with security requirements.V-223757MEDIUMIBM z/OS must configure system wait times to protect resource availability based on site priorities.V-223758MEDIUMThe IBM z/OS BPX.SMF resource must be properly configured.V-223759MEDIUMIBM z/OS SMF recording options for the TN3270 Telnet Server must be properly specified.V-223760HIGHIBM RACF must be installed and active on the system.V-223761MEDIUMThe IBM z/OS system administrator (SA) must develop a process to disable emergency accounts after the crisis is resolved or 72 hours.V-223762MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are created.V-223763MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are modified.V-223764MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are deleted.V-223765MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are removed.V-223766MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify information system security officers (ISSOs) of account enabling actions.V-223767MEDIUMIBM z/OS required SMF data record types must be collected.V-223768MEDIUMIBM z/OS must employ a session manager to manage display of the Standard Mandatory DoD Notice and Consent Banner.V-223769MEDIUMIBM z/OS must specify SMF data options to assure appropriate activation.V-223770MEDIUMIBM z/OS SMF collection files (system MANx datasets or LOGSTREAM DASD) must have storage capacity to store at least one weeks worth of audit data.V-223771MEDIUMIBM z/OS system administrators must develop an automated process to collect and retain SMF data.V-223772MEDIUMIBM z/OS BUFUSEWARN in the SMFPRMxx must be properly set.V-223773MEDIUMIBM z/OS NOBUFFS in SMFPRMxx must be properly set (default is MSG).V-223774MEDIUMThe IBM z/OS system must use a time protocol that syncs with an authoritative external time source.V-223775MEDIUMIBM z/OS Time Protocol must be properly configured.V-223776MEDIUMIBM z/OS PARMLIB CLOCKxx must have the Accuracy PARM properly coded.V-223777HIGHIBM RACF must define UACC of NONE on all profiles.V-223778MEDIUMIBM z/OS PASSWORD data set and OS passwords must not be used.V-223780MEDIUMThe IBM z/OS Policy Agent must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.V-223781HIGHUnsupported system software must not be installed and/ or active on the system.V-223782MEDIUMIBM z/OS must not allow nonexistent or inaccessible LINKLIST libraries.V-223783MEDIUMIBM z/OS must not allow nonexistent or inaccessible Link Pack Area (LPA) libraries.V-223784MEDIUMIBM z/OS must not have inaccessible APF libraries defined.V-223785MEDIUMIBM zOS inapplicable PPT entries must be invalidated.V-223786MEDIUMIBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s).V-223787LOWIBM z/OS must not have duplicated sensitive utilities and/or programs existing in APF libraries.V-223788HIGHThe IBM z/OS systems requiring data-at-rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.V-223792MEDIUMThe IBM z/OS Policy Agent must contain a policy that protects against or limits the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.V-223793MEDIUMThe IBM z/OS Policy Agent must contain a policy that manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.V-223794MEDIUMThe IBM z/OS must employ a session manager that conceals, via the session lock, information previously visible on the display with a publicly viewable image.V-223795MEDIUMIBM z/OS must employ a session manager to manage session lock after a 15-minute period of inactivity.V-223796MEDIUMIBM z/OS must employ a session for users to directly initiate a session lock for all connection types.V-223797MEDIUMIBM z/OS must employ a session manager to manage retaining a users session lock until that user reestablishes access using established identification and authentication procedures.V-223798MEDIUMIBM z/OS system administrator must develop a procedure to remove or disable temporary user accounts after 72 hours.V-223800MEDIUMIBM z/OS system administrator must develop a procedure to notify designated personnel if baseline configurations are changed in an unauthorized manner.V-223801MEDIUMIBM z/OS system administrator must develop a procedure to provide an audit reduction capability that supports on-demand reporting requirements.V-223803MEDIUMIBM z/OS system administrator must develop a procedure to remove all software components after updated versions have been installed.V-223804MEDIUMIBM z/OS must shut down the information system, restart the information system, and/or notify the system administrator when anomalies in the operation of any security functions are discovered.V-223805MEDIUMIBM z/OS system administrator must develop a procedure to offload SMF files to a different system or media than the system being audited.V-223806MEDIUMIBM z/OS SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events.V-223807HIGHThe IBM RACF SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm to protect confidential information and remote access sessions.V-223809MEDIUMThe SSH daemon must be configured with the Standard Mandatory DoD Notice and Consent Banner.V-223810HIGHIBM z/OS SSH daemon must be configured to only use the SSHv2 protocol.V-223811MEDIUMIBM z/OS, for PKI-based authentication, must use the ICSF or ESM for key management.V-223812MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the Syslog daemon component must be properly configured.V-223813MEDIUMThe IBM z/OS Syslog daemon must be started at z/OS initialization.V-223814MEDIUMThe IBM z/OS Syslog daemon must be properly defined and secured.V-223815MEDIUMIBM z/OS DFSMS Program Resources must be properly defined and protected.V-223816MEDIUMIBM z/OS DFSMS control data sets must be protected in accordance with security requirements.V-223817MEDIUMIBM z/OS DFSMS-related RACF classes must be active.V-223818MEDIUMIBM z/OS DFSMS resources must be protected in accordance with the proper security requirements.V-223819MEDIUMIBM z/OS using DFSMS must properly specify SYS(x).PARMLIB(IGDSMSxx), SMS parameter settings.V-223820MEDIUMIBM z/OS PROFILE.TCPIP configuration statements for the TCP/IP stack must be coded properly.V-223821MEDIUMIBM z/OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.V-223822MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the Base TCP/IP component must be properly configured.V-223823MEDIUMIBM z/OS TCP/IP resources must be properly protected.V-223824MEDIUMThe IBM RACF SERVAUTH resource class must be active for TCP/IP resources.V-223826MEDIUMIBM z/OS data sets for the Base TCP/IP component must be properly protected.V-223827MEDIUMIBM z/OS Configuration files for the TCP/IP stack must be properly specified.V-223831MEDIUMIBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.V-223833MEDIUMThe IBM z/OS warning banner for the TN3270 Telnet server must contain the proper content of the Standard Mandatory DoD Notice and Consent Banner.V-223834MEDIUMIBM z/OS VTAM session setup controls for the TN3270 Telnet server must be properly specified.V-223835MEDIUMThe IBM z/OS PROFILE.TCPIP configuration for the TN3270 Telnet server must have the INACTIVE statement properly specified.V-223836MEDIUMIBM Z/OS TSOAUTH resources must be restricted to authorized users.V-223837HIGHIBM RACF LOGONIDs must not be defined to SYS1.UADS for non-emergency use.V-223838HIGHThe IBM z/OS UNIX SUPERUSER resources must be protected in accordance with guidelines.V-223839MEDIUMIBM z/OS BPX resource(s) must be protected in accordance with security requirements.V-223840MEDIUMIBM z/OS UNIX MVS HFS directories with other write permission bit set must be properly defined.V-223842MEDIUMIBM z/OS UNIX security parameters in etc/profile must be properly specified.V-223843MEDIUMIBM z/OS UNIX security parameters in /etc/rc must be properly specified.V-223844MEDIUMIBM z/OS UNIX resources must be protected in accordance with security requirements.V-223845MEDIUMIBM z/OS UNIX MVS data sets or HFS objects must be properly protected.V-223846MEDIUMIBM z/OS UNIX MVS data sets WITH z/OS UNIX COMPONENTS must be properly protected.V-223847MEDIUMIBM z/OS UNIX HFS permission bits and audit bits for each directory must be properly protected.V-223848MEDIUMIBM z/OS UNIX SYSTEM FILE SECURITY SETTINGS must be properly protected or specified.V-223849MEDIUMIBM z/OS UNIX MVS data sets used as step libraries in /etc/steplib must be properly protected.V-223850MEDIUMThe IBM RACF classes required to properly secure the z/OS UNIX environment must be ACTIVE.V-223851MEDIUMIBM z/OS UNIX OMVS parameters in PARMLIB must be properly specified.V-223852MEDIUMIBM z/OS UNIX BPXPRMxx security parameters in PARMLIB must be properly specified.V-223853MEDIUMIBM z/OS default profiles must be defined in the corresponding FACILITY Class Profile for classified systems.V-223854MEDIUMIBM z/OS UNIX HFS MapName files security parameters must be properly specified.V-223855MEDIUMIBM z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf must be properly specified.V-223856HIGHIBM z/OS UID(0) must be properly assigned.V-223857MEDIUMIBM z/OS UNIX groups must be defined with a unique GID.V-223859MEDIUMThe IBM z/OS user account for the UNIX kernel (OMVS) must be properly defined to the security database.V-223860MEDIUMThe IBM z/OS user account for the z/OS UNIX SUPERUSER userid must be properly defined.V-223861MEDIUMThe IBM z/OS user account for the UNIX (RMFGAT) must be properly defined.V-223862MEDIUMIBM z/OS UNIX user accounts must be properly defined.V-223863MEDIUMIBM z/OS attributes of UNIX user accounts used for account modeling must be defined in accordance with security requirements.V-223864MEDIUMThe IBM z/OS startup user account for the z/OS UNIX Telnet Server must be properly defined.V-223865MEDIUMIBM z/OS HFS objects for the z/OS UNIX Telnet Server must be properly protected.V-223866MEDIUMThe IBM z/OS UNIX Telnet Server etc/banner file must have the Standard Mandatory DoD Notice and Consent Banner.V-223867MEDIUMIBM z/OS UNIX Telnet server Startup parameters must be properly specified.V-223868MEDIUMThe IBM z/OS UNIX Telnet server warning banner must be properly specified.V-223869MEDIUMIBM z/OS System datasets used to support the VTAM network must be properly secured.V-223870MEDIUMIBM z/OS VTAM USSTAB definitions must not be used for unsecured terminals.V-230209MEDIUMThe IBM RACF System REXX IRRPHREX security data set must be properly protected.V-230210MEDIUMIBM RACF exit ICHPWX11 for password phrases must be installed and properly configured.V-235033MEDIUMIBM RACF must limit WRITE or greater access to LINKLIST libraries to system programmers only.V-245536MEDIUMThe IBM z/OS TCPIP.DATA configuration statement must contain the DOMAINORIGIN or DOMAIN specified for each TCP/IP defined.V-251107MEDIUMIBM z/OS sensitive and critical system data sets must not exist on shared DASDs.V-252553MEDIUMIBM z/OS TCP/IP AT-TLS policy must be properly configured in Policy Agent.V-255935MEDIUMIBM Integrated Crypto Service Facility (ICSF) Configuration parameters must be correctly specified.V-255936MEDIUMIBM Integrated Crypto Service Facility (ICSF) install data sets are not properly protected.V-255937MEDIUMIBM Integrated Crypto Service Facility (ICSF) Started Task name is not properly identified / defined to the system ACP.V-255938MEDIUMIBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the STARTED resource class for RACF.V-255939MEDIUMIBM Integrated Crypto Service Facility (ICSF) STC data sets must be properly protected.V-257135MEDIUMIBM Passtickets must be configured to be KeyEncrypted.V-272875MEDIUMIBM z/OS FTP Control cards must be properly stored in a secure PDS file.V-272877MEDIUMIBM z/OS started tasks for the Base TCP/IP component must be defined in accordance with security requirements.V-272879MEDIUMIBM z/OS DFSMS control data sets must reside on separate storage volumesV-275952MEDIUMzOSMF resource class(es) must be active in accordance with security requirements.V-275953MEDIUMThe ICSF resource class(es) must be active in accordance with security requirements.V-275954MEDIUMICSF resources must be protected in accordance with security requirements.V-275956MEDIUMzOSMF resources must be protected in accordance with security requirements.