BMC IOA is not properly defined to the Facility Matrix Table for Top Secret.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224605	SRG-OS-000104	ZIOAT036	SV-224605r958482_rule	2025-02-24	7

Description
Improperly defined security controls for BMC IOA could result in the compromise of the network, operating system, and customer data.

ℹ️ Check
Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(FACLIST) - Preferred report containing all control option values in effect including default values - TSSCMDS.RPT(TSSPRMFL) - Alternate report containing only control option values explicitly coded at TSS startup Ensure the BMC IOA Facility Matrix table is defined as follows: FAC(USERxx=NAME=IOA,PGM=IOA,ID=nn,ACTIVE,SHRPRF,ASUBM) FAC(IOA=NOABEND,MULTIUSER,NOXDEF,SIGN(S),RES,LUMSG) FAC(IOA=STMSG,WARNPW,NORNDPW,NOAUDIT,NOTSOC,MODE=FAIL) FAC(IOA=LOG(SMF,INIT,MSG,SEC9),UIDACID=8,LOCKTIME=000)

ℹ️ Check

Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(FACLIST) - Preferred report containing all control option values in effect including default values - TSSCMDS.RPT(TSSPRMFL) - Alternate report containing only control option values explicitly coded at TSS startup Ensure the BMC IOA Facility Matrix table is defined as follows: FAC(USERxx=NAME=IOA,PGM=IOA,ID=nn,ACTIVE,SHRPRF,ASUBM) FAC(IOA=NOABEND,MULTIUSER,NOXDEF,SIGN(S),RES,LUMSG) FAC(IOA=STMSG,WARNPW,NORNDPW,NOAUDIT,NOTSOC,MODE=FAIL) FAC(IOA=LOG(SMF,INIT,MSG,SEC9),UIDACID=8,LOCKTIME=000)

✔️ Fix
The BMC IOA system programmer and the IAO will ensure that the TOP SECRET Facility Matrix Table is proper defined using the following example: IOA: FACILITY(USERxx=NAME=IOA,PGM=IOA,ID=nn,ACTIVE,SHRPRF) FACILITY(IOA=ASUBM,NOABEND,MULTIUSER,NOXDEF) FACILITY(IOA=LUMSG,STMSG,SIGN(S),NORNDPW) FACILITY(IOA=NOAUDIT,RES,WARNPW,NOTSOC) FACILITY(IOA=MODE=FAIL,LOG(SMF,INIT,MSG,SEC9)) FACILITY(IOA=UIDACID=8,LOCKTIME=000)

✔️ Fix

The BMC IOA system programmer and the IAO will ensure that the TOP SECRET Facility Matrix Table is proper defined using the following example: IOA: FACILITY(USERxx=NAME=IOA,PGM=IOA,ID=nn,ACTIVE,SHRPRF) FACILITY(IOA=ASUBM,NOABEND,MULTIUSER,NOXDEF) FACILITY(IOA=LUMSG,STMSG,SIGN(S),NORNDPW) FACILITY(IOA=NOAUDIT,RES,WARNPW,NOTSOC) FACILITY(IOA=MODE=FAIL,LOG(SMF,INIT,MSG,SEC9)) FACILITY(IOA=UIDACID=8,LOCKTIME=000)