STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM z/OS TSS Security Technical Implementation Guide

Version

V9R8

Release Date

Mar 9, 2026

SCAP Benchmark ID

IBM_zOS_TSS_STIG

Total Checks

230

Tags

other
CAT I: 33CAT II: 194CAT III: 3

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (230)

V-223871MEDIUMAll IBM z/OS digital certificates in use must have a valid path to a trusted Certification Authority (CA).V-223872MEDIUMExpired IBM z/OS digital certificates must not be used.V-223873MEDIUMIBM z/OS must have Certificate Name Filtering implemented with appropriate authorization and documentation.V-223874HIGHCA-TSS Security control ACIDs must be limited to the administrative authorities authorized and that require these privileges to perform their job duties.V-223875MEDIUMThe number of CA-TSS ACIDs possessing the tape Bypass Label Processing (BLP) privilege must be limited.V-223876HIGHCA-TSS MODE Control Option must be set to FAIL.V-223877MEDIUMThe CA-TSS NPWRTHRESH Control Option must be properly set.V-223878MEDIUMThe CA-TSS NPPTHRESH Control Option must be properly set.V-223879MEDIUMThe CA-TSS PTHRESH Control Option must be set to 2.V-223881MEDIUMIBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.V-223882HIGHIBM z/OS SYS1.PARMLIB must be properly protected.V-223883MEDIUMIBM z/OS for PKI-based authentication must use ICSF or the ESM to store keys.V-223885MEDIUMThe CA-TSS NEWPHRASE and PPSCHAR Control Options must be properly set.V-223886MEDIUMThe CA-TSS NEWPW control options must be properly set.V-223887HIGHIBM z/OS must use NIST FIPS-validated cryptography to protect passwords in the security database.V-223888MEDIUMThe CA-TSS PWEXP Control Option must be set to 60.V-223889MEDIUMThe CA-TSS PPEXP Control Option must be properly set.V-223890MEDIUMThe CA-TSS PWHIST Control Option must be set to 10 or greater.V-223891MEDIUMThe CA-TSS PPHIST Control Option must be properly set.V-223893MEDIUMCA-TSS access to SYS1.LINKLIB must be properly protected.V-223894HIGHCA-TSS must limit Write or greater access to SYS1.SVCLIB to system programmers only.V-223895HIGHCA-TSS must limit Write or greater access to SYS1.IMAGELIB to system programmers only.V-223896HIGHCA-TSS must limit Write or greater access to SYS1.LPALIB to system programmers only.V-223897HIGHCA-TSS must limit WRITE or greater access to all APF-authorized libraries to system programmers only.V-223898HIGHIBM z/OS libraries included in the system REXXLIB concatenation must be properly protected.V-223899HIGHCA-TSS must limit Write or greater access to all LPA libraries to system programmers only.V-223900HIGHCA-TSS must limit Write or greater access to SYS1.NUCLEUS to system programmers only.V-223901LOWCA-TSS must limit Write or greater access to libraries that contain PPT modules to system programmers only.V-223902MEDIUMCA-TSS must limit WRITE or greater access to LINKLIST libraries to system programmers only.V-223903HIGHCA-TSS security data sets and/or databases must be properly protected.V-223904HIGHCA-TSS must limit access to the System Master Catalog to appropriate authorized users.V-223905MEDIUMCA-TSS allocate access to system user catalogs must be limited to system programmers only.V-223906MEDIUMCA-TSS must limit WRITE or greater access to all system-level product installation libraries to system programmers only.V-223907MEDIUMCA-TSS must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.V-223908HIGHCA-TSS must limit Write or greater access to SYS1.UADS to system programmers only, and Read and Update access must be limited to system programmer personnel and/or security personnel.V-223909MEDIUMCA-TSS must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.V-223910MEDIUMCA-TSS must limit access to SYSTEM DUMP data sets to system programmers only.V-223911MEDIUMCA-TSS WRITE or Greater access to System backup files must be limited to system programmers and/or batch jobs that perform DASD backups.V-223912MEDIUMCA-TSS must limit access to SYS(x).TRACE to system programmers only.V-223913MEDIUMCA-TSS must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers only.V-223914HIGHCA-TSS must limit WRITE or greater access to libraries containing EXIT modules to system programmers only.V-223915HIGHCA-TSS must limit all system PROCLIB data sets to system programmers only and appropriate authorized users.V-223916MEDIUMCA-TSS must protect memory and privileged program dumps in accordance with proper security requirements.V-223917HIGHIBM z/OS must protect dynamic lists in accordance with proper security requirements.V-223918MEDIUMIBM z/OS system commands must be properly protected.V-223919MEDIUMIBM z/OS MCS consoles access authorization(s) for CONSOLE resource(s) must be properly protected.V-223920MEDIUMCA-TSS must properly define users that have access to the CONSOLE resource in the TSOAUTH resource class.V-223921MEDIUMIBM z/OS Operating system commands (MVS.) of the OPERCMDS resource class must be properly owned.V-223922MEDIUMCA-TSS AUTH Control Option values specified must be set to (OVERRIDE,ALLOVER) or (MERGE,ALLOVER).V-223923HIGHAccess to the CA-TSS MODE resource class must be appropriate.V-223924MEDIUMData set masking characters must be properly defined to the CA-TSS security database.V-223925HIGHCA-TSS Emergency ACIDs must be properly limited and must audit all resource access.V-223926MEDIUMCA-TSS ACIDs must not have access to FAC(*ALL*).V-223927MEDIUMThe CA-TSS ALL record must have appropriate access to Facility Matrix Tables.V-223928MEDIUMData set masking characters allowing access to all data sets must be properly restricted in the CA-TSS security database.V-223929HIGHIBM z/OS DASD Volume access greater than CREATE found in the CA-TSS database must be limited to authorized information technology personnel requiring access to perform their job duties.V-223930MEDIUMIBM z/OS Sensitive Utility Controls must be properly defined and protected.V-223931MEDIUMIBM z/OS Started tasks must be properly defined to CA-TSS.V-223932MEDIUMThe CA-TSS CANCEL Control Option must not be specified.V-223933MEDIUMThe CA-TSS HPBPW Control Option must be set to three days maximum.V-223934MEDIUMThe CA-TSS INSTDATA Control Option must be set to 0.V-223935MEDIUMThe CA-TSS OPTIONS Control Option must include option 4 at a minimum.V-223936MEDIUMCA-TSS TEMPDS Control Option must be set to YES.V-223937MEDIUMThe number of CA-TSS control ACIDs must be justified and properly assigned.V-223938MEDIUMThe number of CA-TSS ACIDs with MISC9 authority must be justified.V-223939MEDIUMThe CA-TSS LUUPDONCE Control Option value specified must be set to NO.V-223940MEDIUMThe CA-TSS Automatic Data Set Protection (ADSP) Control Option must be set to NO.V-223941MEDIUMCA-TSS RECOVER Control Option must be set to ON.V-223942MEDIUMIBM z/OS must properly configure CONSOLxx members.V-223943MEDIUMIBM z/OS must properly protect MCS console userid(s).V-223944MEDIUMThe CA-TSS CPFRCVUND Control Option value specified must be set to NO.V-223945MEDIUMThe CA-TSS CPFTARGET Control Option value specified must be set to LOCAL.V-223946LOWCA-TSS User ACIDs and Control ACIDs must have the NAME field completed.V-223947HIGHThe CA-TSS PASSWORD(NOPW) option must not be specified for any ACID type.V-223948LOWInteractive ACIDs defined to CA-TSS must have the required fields completed.V-223950MEDIUMCA-TSS Batch ACID(s) submitted through RJE and NJE must be sourced.V-223951MEDIUMIBM z/OS DASD management ACIDs must be properly defined to CA-TSS.V-223952MEDIUMCA-TSS user accounts must uniquely identify system users.V-223953MEDIUMCA-TSS security administrator must develop a process to suspend userids found inactive for more than 35 days.V-223954MEDIUMThe CA-TSS INACTIVE Control Option must be properly set.V-223955MEDIUMThe CA-TSS AUTOERASE Control Option must be set to ALL for all systems.V-223956MEDIUMCA-TSS DOWN Control Option values must be properly specified.V-223957HIGHThe CA-TSS Facility Control Option must specify the sub option of MODE=FAIL.V-223958MEDIUMCA-TSS ACID creation must use the EXP option.V-223959MEDIUMThe CA-TSS SUBACID Control Option must be set to U,8.V-223960MEDIUMCA-TSS must use propagation control to eliminate ACID inheritance.V-223961MEDIUMIBM z/OS scheduled production batch ACIDs must specify the CA-TSS BATCH Facility, and the Batch Job Scheduler must be authorized to the Scheduled production CA-TSS batch ACID.V-223962MEDIUMCA-TSS ADMINBY Control Option must be set to ADMINBY.V-223963MEDIUMCA-TSS LOG Control Option must be set to (SMF,INIT, SEC9, MSG).V-223964MEDIUMCA-TSS MSCA ACID password changes must be documented in the change log.V-223965MEDIUMThe IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.V-223966MEDIUMCA-TSS Default ACID must be properly defined.V-223967HIGHThe CA-TSS BYPASS attribute must be limited to trusted STCs only.V-223968MEDIUMCA-TSS MSCA ACID must perform security administration only.V-223969HIGHCA-TSS ACIDs granted the CONSOLE attribute must be justified.V-223970MEDIUMCA-TSS ACIDs defined as security administrators must have the NOATS attribute.V-223972MEDIUMCA-TSS VTHRESH Control Option values specified must be set to (10,NOT,CAN).V-223973MEDIUMIBM z/OS FTP.DATA configuration statements must have a proper banner statement with the Standard Mandatory DOD Notice and Consent Banner.V-223974MEDIUMIBM z/OS SMF recording options for the FTP server must be configured to write SMF records for all eligible events.V-223975MEDIUMCA-TSS permission bits and user audit bits for HFS objects that are part of the FTP server component must be properly configured.V-223976MEDIUMIBM z/OS data sets for the FTP server must be properly protected.V-223977MEDIUMIBM z/OS FTP Control cards must be properly stored in a secure PDS file.V-223978MEDIUMIBM z/OS user exits for the FTP server must not be used without proper approval and documentation.V-223979MEDIUMThe IBM z/OS FTP server daemon must be defined with proper security parameters.V-223980MEDIUMIBM z/OS FTP.DATA configuration for the FTP server must have the INACTIVE statement properly set.V-223981MEDIUMIBM z/OS startup parameters for the FTP server must have the INACTIVE statement properly set.V-223982MEDIUMIBM z/OS FTP.DATA configuration statements for the FTP server must specify the Standard Mandatory DoD Notice and Consent Banner statement.V-223985MEDIUMIBM z/OS JES2.** resource must be properly protected in the CA-TSS database.V-223986MEDIUMIBM z/OS RJE workstations and NJE nodes must be controlled in accordance with STIG requirements.V-223987MEDIUMIBM z/OS JES2 input sources must be controlled in accordance with the proper security requirements.V-223988MEDIUMIBM z/OS JES2 input sources must be properly controlled.V-223989MEDIUMIBM z/OS JES2 output devices must be controlled in accordance with the proper security requirements.V-223990MEDIUMIBM z/OS JES2 output devices must be properly controlled for classified systems.V-223991MEDIUMIBM z/OS JESSPOOL resources must be protected in accordance with security requirements.V-223992MEDIUMIBM z/OS JESNEWS resources must be protected in accordance with security requirements.V-223993MEDIUMIBM z/OS JESTRACE and/or SYSLOG resources must be protected in accordance with security requirements.V-223994MEDIUMIBM z/OS JES2 spool resources must be controlled in accordance with security requirements.V-223995MEDIUMIBM z/OS JES2 system commands must be protected in accordance with security requirements.V-223996MEDIUMIBM z/OS Surrogate users must be controlled in accordance with proper security requirements.V-223997MEDIUMDuplicated IBM z/OS sensitive utilities and/or programs must not exist in APF libraries.V-223998MEDIUMIBM z/OS required SMF data record types must be collected.V-223999MEDIUMIBM z/OS Session manager must properly configure wait time limits.V-224000MEDIUMThe IBM z/OS BPX.SMF resource must be properly configured.V-224001MEDIUMIBM z/OS must specify SMF data options to ensure appropriate activation.V-224002MEDIUMIBM z/OS BUFUSEWARN in the SMFPRMxx must be properly set.V-224003MEDIUMIBM z/OS PASSWORD data set and OS passwords must not be used.V-224004MEDIUMThe CA-TSS database must be on a separate physical volume from its backup and recovery data sets.V-224005MEDIUMThe CA-TSS database must be backed up on a scheduled basis.V-224006MEDIUMThe IBM z/OS Policy Agent must be configured to deny-all, allow-by-exception firewall policy for allowing connections to other systems.V-224007MEDIUMIBM z/OS must not have Inaccessible APF libraries defined.V-224008MEDIUMIBM z/OS inapplicable PPT entries must be invalidated.V-224009MEDIUMIBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s).V-224010MEDIUMIBM z/OS sensitive and critical system data sets must not exist on shared DASD.V-224011MEDIUMThe IBM z/OS Policy Agent must contain a policy that manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.V-224013MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are created.V-224014MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are modified.V-224015MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are deleted.V-224016MEDIUMThe IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are removed.V-224017HIGHUnsupported IBM z/OS system software must not be installed and/or active on the system.V-224018MEDIUMIBM z/OS must not allow nonexistent or inaccessible Link Pack Area (LPA) libraries.V-224019MEDIUMIBM z/OS must not allow nonexistent or inaccessible LINKLIST libraries.V-224020HIGHCA-TSS must be installed and properly configured.V-224021MEDIUMIBM z/OS SMF collection files (system MANx data sets or LOGSTREAM DASD) must have storage capacity to store at least one weeks worth of audit data.V-224022MEDIUMIBM z/OS System Administrators must develop an automated process to collect and retain SMF data.V-224023MEDIUMThe IBM z/OS system must use a time protocol that syncs with an authoritative external time source.V-224024MEDIUMIBM z/OS Time Protocol must be properly configured. IBM z/OS SNTP daemon (SNTPD) permission bits must be properly configured.V-224025MEDIUMIBM z/OS PARMLIB CLOCKxx must have the Accuracy PARM coded properly.V-224026MEDIUMThe IBM z/OS Policy Agent must contain a policy that protects against or limits the effects of denial-of-service (DoS) attacks by ensuring IBM z/OS is implementing rate-limiting measures on impacted network interfaces.V-224031MEDIUMIBM z/OS must configure system wait times to protect resource availability based on site priorities.V-224032MEDIUMIBM z/OS must employ a session manager to conceal, via the session lock, information previously visible on the display with a publicly viewable image.V-224034MEDIUMIBM z/OS must employ a session manager to manage retaining a users session lock until that user reestablishes access using established identification and authentication procedures.V-224035MEDIUMIBM z/OS system administrator (SA) must develop a procedure to remove or disable temporary user accounts after 72 hours.V-224036MEDIUMIBM z/OS system administrator (SA) must develop a procedure to remove or disable emergency accounts after the crisis is resolved or 72 hours.V-224037MEDIUMIBM z/OS system administrator (SA) must develop a procedure to notify SAs and information system security officers (ISSOs) of account enabling actions.V-224038MEDIUMIBM z/OS system administrator must develop a procedure to notify designated personnel if baseline configurations are changed in an unauthorized manner.V-224040MEDIUMIBM z/OS system administrator must develop a procedure to remove all software components after updated versions have been installed.V-224041MEDIUMIBM z/OS system administrator must develop a procedure to shut down the information system, restart the information system, and/or notify the system administrator when anomalies in the operation of any security functions are discovered.V-224042MEDIUMIBM z/OS system administrator must develop a procedure to offload SMF files to a different system or media than the system being audited.V-224043MEDIUMIBM z/OS must employ a session manager for users to directly initiate a session lock for all connection types.V-224044HIGHThe SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm.V-224045HIGHIBM z/OS SSH daemon must be configured to only use the SSHv2 protocol.V-224046MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the Syslog daemon component must be configured properly.V-224047MEDIUMThe IBM z/OS Syslog daemon must not be started at z/OS initialization.V-224048MEDIUMThe IBM z/OS Syslog daemon must be properly defined and secured.V-224049MEDIUMIBM z/OS DFSMS resources must be protected in accordance with the proper security requirements.V-224050MEDIUMIBM z/OS DFSMS Program Resources must be properly defined and protected.V-224051MEDIUMIBM z/OS DFSMS control data sets must be protected in accordance with security requirements.V-224052MEDIUMIBM z/OS using DFSMS must properly specify SYS(x).PARMLIB(IGDSMSxx), SMS parameter settings.V-224054MEDIUMIBM z/OS SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events.V-224055MEDIUMThe IBM z/OS SSH daemon must be configured with the Standard Mandatory DoD Notice and Consent Banner.V-224056MEDIUMIBM z/OS PROFILE.TCPIP configuration statements for the TCP/IP stack must be properly coded.V-224057MEDIUMIBM z/OS permission bits and user audit bits for HFS objects that are part of the Base TCP/IP component must be configured properly.V-224058MEDIUMIBM z/OS TCP/IP resources must be properly protected.V-224059MEDIUMIBM z/OS data sets for the Base TCP/IP component must be properly protected.V-224060MEDIUMIBM z/OS Configuration files for the TCP/IP stack must be properly specified.V-224061MEDIUMIBM z/OS started tasks for the Base TCP/IP component must be defined in accordance with security requirements.V-224062MEDIUMIBM z//OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.V-224065MEDIUMIBM z/OS TN3270 Telnet server configuration statement MSG10 text must have the Standard Mandatory DoD Notice and Consent Banner.V-224066MEDIUMIBM z/OS SMF recording options for the TN3270 Telnet server must be properly specified.V-224067MEDIUMIBM z/OS SSL encryption options for the TN3270 Telnet server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.V-224068MEDIUMIBM z/OS VTAM session setup controls for the TN3270 Telnet server must be properly specified.V-224069MEDIUMIBM z/OS PROFILE.TCPIP configuration for the TN3270 Telnet server must have the INACTIVE statement properly specified.V-224072MEDIUMIBM Z/OS TSOAUTH resources must be restricted to authorized users.V-224073HIGHCA-TSS LOGONIDs must not be defined to SYS1.UADS for non-emergency use.V-224074MEDIUMIBM z/OS UNIX HFS MapName file security parameters must be properly specified.V-224075MEDIUMIBM z/OS NOBUFFS in SMFPRMxx must be properly set (default is MSG).V-224076MEDIUMIBM z/OS BPX resource(s) must be protected in accordance with security requirements.V-224077MEDIUMIBM z/OS UNIX resources must be protected in accordance with security requirements.V-224078HIGHIBM z/OS UNIX SUPERUSER resources must be protected in accordance with guidelines.V-224079MEDIUMIBM z/OS UNIX MVS data sets or HFS objects must be properly protected.V-224080MEDIUMIBM z/OS UNIX MVS data sets with z/OS UNIX components must be properly protected.V-224081MEDIUMIBM z/OS UNIX MVS data sets used as step libraries in /etc/steplib must be properly protected.V-224082MEDIUMIBM z/OS UNIX HFS permission bits and audit bits for each directory must be properly protected.V-224083MEDIUMIBM z/OS UNIX system file security settings must be properly protected or specified.V-224084MEDIUMIBM z/OS UNIX MVS HFS directory(s) with OTHER write permission bit set must be properly defined.V-224085HIGHThe CA-TSS HFSSEC resource class must be defined with DEFPROT.V-224086MEDIUMIBM z/OS UNIX OMVS parameters in PARMLIB must be properly specified.V-224087MEDIUMIBM z/OS UNIX BPXPRMxx security parameters in PARMLIB must be properly specified.V-224088MEDIUMIBM z/OS UNIX security parameters in etc/profile must be properly specified.V-224089MEDIUMIBM z/OS UNIX security parameters in /etc/rc must be properly specified.V-224090MEDIUMIBM z/OS Default profiles must not be defined in TSS OMVS UNIX security parameters for classified systems.V-224091MEDIUMIBM z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf must be properly specified.V-224092MEDIUMIBM z/OS attributes of z/OS UNIX user accounts must have a unique GID in the range of 1-99.V-224093MEDIUMThe IBM z/OS user account for the UNIX kernel (OMVS) must be properly defined to the security database.V-224094MEDIUMThe IBM z/OS user account for the z/OS UNIX SUPERUSER userid must be properly defined.V-224095MEDIUMThe IBM z/OS user account for the UNIX (RMFGAT) must be properly defined.V-224096HIGHIBM z/OS UID(0) must be properly assigned.V-224097MEDIUMIBM z/OS UNIX user accounts must be properly defined.V-224098MEDIUMIBM z/OS attributes of UNIX user accounts used for account modeling must be defined in accordance with security requirements.V-224099MEDIUMThe IBM z/OS UNIX Telnet server etc/banner file must have the Standard Mandatory DoD Notice and Consent Banner.V-224100MEDIUMThe IBM z/OS startup user account for the z/OS UNIX Telnet server must be properly defined.V-224101MEDIUMIBM z/OS HFS objects for the z/OS UNIX Telnet server must be properly protected.V-224102MEDIUMThe IBM z/OS UNIX Telnet server Startup parameters must be properly specified.V-224103MEDIUMThe IBM z/OS UNIX Telnet server warning banner must be properly specified.V-224104MEDIUMIBM z/OS System data sets used to support the VTAM network must be properly secured.V-224105MEDIUMIBM z/OS VTAM USSTAB definitions must not be used for unsecured terminals.V-245537MEDIUMThe IBM z/OS TCPIP.DATA configuration statement must contain the DOMAINORIGIN or DOMAIN specified for each TCP/IP defined.V-251108HIGHThe IBM z/OS systems requiring data at rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.V-252554MEDIUMIBM z/OS TCP/IP AT-TLS policy must be properly configured in Policy Agent.V-255896MEDIUMIBM z/OS FTP.DATA configuration statements for the FTP Server must be specified in accordance with requirements.V-255940MEDIUMIBM Integrated Crypto Service Facility (ICSF) Configuration parameters must be correctly specified.V-255941MEDIUMIBM Integrated Crypto Service Facility (ICSF) install data sets are not properly protected.V-255942MEDIUMIBM Integrated Crypto Service Facility (ICSF) Started Task name is not properly identified / defined to the system ACP.V-255943MEDIUMIBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.V-255944MEDIUMIBM Integrated Crypto Service Facility (ICSF) STC data sets must be properly protected.V-272878MEDIUMIBM z/OS DFSMS control data sets must reside on separate storage volumes.V-275959MEDIUMzOSMF resource class(es) must be properly owned in accordance with security requirements.V-275960MEDIUMzOSMF resources must be protected in accordance with security requirements.V-275961MEDIUMICSF resource class(es) must be properly owned in accordance with security requirements.V-275962MEDIUMICSF resources must be protected in accordance with security requirements.