CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224496	SRG-OS-000104	ZCIC0041	SV-224496r1145204_rule	2025-09-27	7

Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. An improperly defined or controlled CICS default userid may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

ℹ️ Check
Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC). Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER). - SENSITVE.RPT(TCICSTRN). - SENSITVE.RPT(GCICSTRN). Note: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes. Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. Verify the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid). If the following guidance is true, this is not a finding. Not granted the RACF OPERATIONS attribute. No access to interactive on-line facilities (e.g., TSO) other than CICS. TIMEOUT parameter in the CICS segment is set to 15 minutes. A system's default time for terminal lockout or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a timeout adjusted beyond the 15-minute recommendation to explain the basis for this decision. Restricted from accessing all data sets and resources with the following exceptions: Non-restricted CICS transactions (e.g., CESF, CESN, 'good morning' transaction, etc.) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO) Note: Refer to the IBM CICS Transaction Server Resource Definition Guide for latest and most accurate definition for the Default CICS User. Note: Any exceptions to these guidelines must be approved by the site ISSO and documented in site security plan. Note: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.

ℹ️ Check

Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC). Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER). - SENSITVE.RPT(TCICSTRN). - SENSITVE.RPT(GCICSTRN). Note: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes. Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. Verify the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid). If the following guidance is true, this is not a finding. Not granted the RACF OPERATIONS attribute. No access to interactive on-line facilities (e.g., TSO) other than CICS. TIMEOUT parameter in the CICS segment is set to 15 minutes. A system's default time for terminal lockout or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a timeout adjusted beyond the 15-minute recommendation to explain the basis for this decision. Restricted from accessing all data sets and resources with the following exceptions: Non-restricted CICS transactions (e.g., CESF, CESN, 'good morning' transaction, etc.) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO) Note: Refer to the IBM CICS Transaction Server Resource Definition Guide for latest and most accurate definition for the Default CICS User. Note: Any exceptions to these guidelines must be approved by the site ISSO and documented in site security plan. Note: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.

✔️ Fix
Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid). If the following guidance is true, this is not a finding. Not granted the RACF OPERATIONS attribute. Issue a RACF LU (Listuser) command on the CICS default userid. The OPERATIONS attribute can be removed via the RACF command ALU <cicsdefaultuser> NOOPERATIONS No access to interactive on-line facilities (e.g., TSO) other than CICS. Use the RACF ALU (Altuser) command to remove attributes such as TSO. Example: ALU <cicsdefaultuser> NOTSO TIMEOUT parameter in the CICS segment is set to 15 minutes. A system's default time for terminal lockout or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a timeout adjusted beyond the 15-minute recommendation to explain the basis for this decision. Use the RACF LU (ListUser) command to display the CICS segment. An example is shown here: LU <cicsdefaultuser> CICS Use the RACF ALU command to set the 15 minute timeout value. An example is shown here: ALU <cicsdefaultuser> CICS(TIMEOUT(15)) Restricted from accessing all data sets and resources with the following exceptions: Delete the CICS default user from data set access lists via the command: PE '<data set profile name>' ID(<cicsdefaultuser>) DEL Non-restricted CICS transactions (e.g., CESF, CESN, "good morning" transaction, etc.) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO) Note: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.

✔️ Fix

Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid). If the following guidance is true, this is not a finding. Not granted the RACF OPERATIONS attribute. Issue a RACF LU (Listuser) command on the CICS default userid. The OPERATIONS attribute can be removed via the RACF command ALU <cicsdefaultuser> NOOPERATIONS No access to interactive on-line facilities (e.g., TSO) other than CICS. Use the RACF ALU (Altuser) command to remove attributes such as TSO. Example: ALU <cicsdefaultuser> NOTSO TIMEOUT parameter in the CICS segment is set to 15 minutes. A system's default time for terminal lockout or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a timeout adjusted beyond the 15-minute recommendation to explain the basis for this decision. Use the RACF LU (ListUser) command to display the CICS segment. An example is shown here: LU <cicsdefaultuser> CICS Use the RACF ALU command to set the 15 minute timeout value. An example is shown here: ALU <cicsdefaultuser> CICS(TIMEOUT(15)) Restricted from accessing all data sets and resources with the following exceptions: Delete the CICS default user from data set access lists via the command: PE '<data set profile name>' ID(<cicsdefaultuser>) DEL Non-restricted CICS transactions (e.g., CESF, CESN, "good morning" transaction, etc.) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO) Note: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.