CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224305	SRG-OS-000104	ZCIC0040	SV-224305r1141384_rule	2025-09-23	7

Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

ℹ️ Check
Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC). Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(LOGONIDS). Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. Verify the following items are in effect for each CICS region logonid. If the following guidance is true, this is not a finding. A unique logonid is associated with the CICS region. The CICS region logonid has the STC, ACF2CICS, MUSASS, and NO-SMC attributes specified. Note: The ACF2CICS privilege will be restricted to CICS region logonids only. If CICS region submits jobs on behalf of its users, the JOBFROM attribute is specified. If CICS region has a requirement to update information in the ACF2 database, the MUSUPDT attribute is specified. Not granted the ACF2 NON-CNCL privilege. No access to interactive online facilities (e.g., TSO) other than CICS.

ℹ️ Check

Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC). Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(LOGONIDS). Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. Verify the following items are in effect for each CICS region logonid. If the following guidance is true, this is not a finding. A unique logonid is associated with the CICS region. The CICS region logonid has the STC, ACF2CICS, MUSASS, and NO-SMC attributes specified. Note: The ACF2CICS privilege will be restricted to CICS region logonids only. If CICS region submits jobs on behalf of its users, the JOBFROM attribute is specified. If CICS region has a requirement to update information in the ACF2 database, the MUSUPDT attribute is specified. Not granted the ACF2 NON-CNCL privilege. No access to interactive online facilities (e.g., TSO) other than CICS.

✔️ Fix
The ISSO will ensure that each CICS region is associated with a unique userid and that userid is properly defined. Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure that the following is defined for each CICS region: A unique userid is defined. Use the ACF2 insert command to accomplish this. A sample command is provided here: INSERT <cicsregionid> NAME('STC, CICS Region') JOBFROM MUSASS NO-SMC STC ACF2CICS

✔️ Fix

The ISSO will ensure that each CICS region is associated with a unique userid and that userid is properly defined. Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure that the following is defined for each CICS region: A unique userid is defined. Use the ACF2 insert command to accomplish this. A sample command is provided here: INSERT <cicsregionid> NAME('STC, CICS Region') JOBFROM MUSASS NO-SMC STC ACF2CICS