CICS userids are not defined and/or controlled in accordance with proper security requirements.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224736	SRG-OS-000080	ZCICT041	SV-224736r958472_rule	2024-12-16	7

Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

ℹ️ Check
a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(WHOOPROP) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the CICS region is defined to the PROPCNTL resource class. c) If (b) are true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

✔️ Fix
Ensure the CICS region is defined to the PROPCNTL resource class. Example: TSS ADDTO(owning acid) PROPCNTL(CICS region acid)