CA 1 Tape Management TMC, AUDIT and optional RDS and VPD datasets will be properly protected.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224260	SRG-OS-000018	ZCA1A003	SV-224260r1141356_rule	2025-09-27	7

Description
CA 1 Tape Management TMC and AUDIT and optional datasets control the operations and access to the tape management system, and site specific information regarding tape volumes. Unauthorized access to these datasets could threaten the integrity and availability of the CA 1 Tape Management System, and compromise the confidentiality of customer data.

ℹ️ Check
Refer to the following report produced by the dataset and Resource Data Collection: - SENSITVE.RPT(CA1RPT). Automated Analysis Refer to the following report produced by the dataset and Resource Data Collection: - PDI(ZCA10003). Verify that all CA 1 Tape Management TMC, AUDIT, and optional RDS and VPD datasets are properly protected. If the following guidance is true, this is not a finding. The ACF2 dataset access authorizations restrict READ access to application support personnel, production control and scheduling personnel, operations personnel, and auditors. The ACF2 dataset access authorizations restrict WRITE and/or greater access to only systems programming personnel and tape management personnel. The ACF2 dataset access authorizations restrict UPDATE access to CA 1 batch production jobs and CA 1 started tasks. The ACF2 dataset access authorizations specify that all (i.e., failures and successes) ALTER access are logged.

ℹ️ Check

Refer to the following report produced by the dataset and Resource Data Collection: - SENSITVE.RPT(CA1RPT). Automated Analysis Refer to the following report produced by the dataset and Resource Data Collection: - PDI(ZCA10003). Verify that all CA 1 Tape Management TMC, AUDIT, and optional RDS and VPD datasets are properly protected. If the following guidance is true, this is not a finding. The ACF2 dataset access authorizations restrict READ access to application support personnel, production control and scheduling personnel, operations personnel, and auditors. The ACF2 dataset access authorizations restrict WRITE and/or greater access to only systems programming personnel and tape management personnel. The ACF2 dataset access authorizations restrict UPDATE access to CA 1 batch production jobs and CA 1 started tasks. The ACF2 dataset access authorizations specify that all (i.e., failures and successes) ALTER access are logged.

✔️ Fix
The ISSO will ensure that WRITE and/or greater access to CA 1 TMC, AUDIT, and optional RDS and VPD datasets is limited to only systems programming personnel and tape management personnel. UPDATE access can be given to CA 1 STCs and/or batch users. READ access can be given to application support personnel, production control and scheduling personnel, operations personnel, and auditors. ALTER access will be logged. The installing systems programmer will identify and document the product datasets, categorize them according to who will have WRITE and/or greater access, and if required, ensure that all WRITE and/or greater access is logged. The installing systems programmer will identify if any additional groups have WRITE and/or greater access for specific datasets, and once documented will work with the ISSO to ensure they are properly restricted to the ACP (Access Control Program) active on the system. (Note: The datasets and/or dataset prefixes identified below are examples of a possible installation. The actual datasets and/or prefixes are determined when the product is installed on a system through the product's installation guide and can be site specific.) Due to the unique file structure of the TMC and Audit datasets, CA 1 uses the YSVC programs to handle all direct I/O activity. Because standard OPEN/CLOSE macros are not used, typical dataset security checks are not performed. Even if a user does not have READ access to these datasets, the YSVC programs can enable that user to read and update records within these files. Therefore, control READ access to the TMC and Audit datasets by the YSVCUNCD and YSVCCOND resource names. Typical users should be restricted to conditional READ access. Restrict CA 1 batch production jobs and CA 1 started tasks to the following access authority: Unconditional READ and UPDATE access to the TMC, Audit, Retention, and Vault Pattern Description datasets. Note: READ and UPDATE access to the TMC and Audit datasets are controlled by the YSVCUNCD and YSVCCOND resource names, and by standard ACP dataset controls, because some CA 1 utilities use conventional OPEN/CLOSE methods. The following commands are provided as a sample for implementing dataset controls: SET RULE $KEY(S3C) $PREFIX(SYS3) CA1.AUDIT UID(<audtaudt>) R(A) E(A) CA1.AUDIT UID(<operaudt>) R(A) E(A) CA1.AUDIT UID(<pcspaudt>) R(A) E(A) CA1.AUDIT UID(CA1 STCs) R(A) W(A) E(A) CA1.AUDIT UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.AUDIT UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.AUDIT UID(<tstcaudt>) R(A) W(A) A(L) E(A) CA1.RDS UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.RDS UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.RDS UID(<tstcaudt>) R(A) W(A) A(L) E(A) CA1.TMC UID(<appsaudt>) R(A) E(A) CA1.TMC UID(<audtaudt>) R(A) E(A) CA1.TMC UID(<operaudt>) R(A) E(A) CA1.TMC UID(<pcspaudt>) R(A) E(A) CA1.TMC UID(CA1 STCs) R(A) W(A) E(A) CA1.TMC UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.TMC UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.TMC UID(<tstcaudt>) R(A) W(A) A(L) E(A) CA1.VPD UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.VPD UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.VPD UID(<tstcaudt>) R(A) W(A) A(L) E(A)

✔️ Fix

The ISSO will ensure that WRITE and/or greater access to CA 1 TMC, AUDIT, and optional RDS and VPD datasets is limited to only systems programming personnel and tape management personnel. UPDATE access can be given to CA 1 STCs and/or batch users. READ access can be given to application support personnel, production control and scheduling personnel, operations personnel, and auditors. ALTER access will be logged. The installing systems programmer will identify and document the product datasets, categorize them according to who will have WRITE and/or greater access, and if required, ensure that all WRITE and/or greater access is logged. The installing systems programmer will identify if any additional groups have WRITE and/or greater access for specific datasets, and once documented will work with the ISSO to ensure they are properly restricted to the ACP (Access Control Program) active on the system. (Note: The datasets and/or dataset prefixes identified below are examples of a possible installation. The actual datasets and/or prefixes are determined when the product is installed on a system through the product's installation guide and can be site specific.) Due to the unique file structure of the TMC and Audit datasets, CA 1 uses the YSVC programs to handle all direct I/O activity. Because standard OPEN/CLOSE macros are not used, typical dataset security checks are not performed. Even if a user does not have READ access to these datasets, the YSVC programs can enable that user to read and update records within these files. Therefore, control READ access to the TMC and Audit datasets by the YSVCUNCD and YSVCCOND resource names. Typical users should be restricted to conditional READ access. Restrict CA 1 batch production jobs and CA 1 started tasks to the following access authority: Unconditional READ and UPDATE access to the TMC, Audit, Retention, and Vault Pattern Description datasets. Note: READ and UPDATE access to the TMC and Audit datasets are controlled by the YSVCUNCD and YSVCCOND resource names, and by standard ACP dataset controls, because some CA 1 utilities use conventional OPEN/CLOSE methods. The following commands are provided as a sample for implementing dataset controls: SET RULE $KEY(S3C) $PREFIX(SYS3) CA1.AUDIT UID(<audtaudt>) R(A) E(A) CA1.AUDIT UID(<operaudt>) R(A) E(A) CA1.AUDIT UID(<pcspaudt>) R(A) E(A) CA1.AUDIT UID(CA1 STCs) R(A) W(A) E(A) CA1.AUDIT UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.AUDIT UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.AUDIT UID(<tstcaudt>) R(A) W(A) A(L) E(A) CA1.RDS UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.RDS UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.RDS UID(<tstcaudt>) R(A) W(A) A(L) E(A) CA1.TMC UID(<appsaudt>) R(A) E(A) CA1.TMC UID(<audtaudt>) R(A) E(A) CA1.TMC UID(<operaudt>) R(A) E(A) CA1.TMC UID(<pcspaudt>) R(A) E(A) CA1.TMC UID(CA1 STCs) R(A) W(A) E(A) CA1.TMC UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.TMC UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.TMC UID(<tstcaudt>) R(A) W(A) A(L) E(A) CA1.VPD UID(<syspaudt>) R(A) W(A) A(L) E(A) CA1.VPD UID(<tapeaudt>) R(A) W(A) A(L) E(A) CA1.VPD UID(<tstcaudt>) R(A) W(A) A(L) E(A)