Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

zOS Front End Processor for TSS Security Technical Implementation Guide

V7R2 · · · Released 01 Oct 2025 · 5 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V7R1 · 30 Jan 2025 ✎ 5

Comparison against the immediately-prior release (V7R1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Content changes 5

  • V-224720 Medium check All hardware components of the FEPs are not placed in secure locations where they cannot be stolen, damaged, or disturbed
  • V-224722 Medium checkfix A documented procedure is not available instructing how to load and dump the FEP NCP (Network Control Program).
  • V-224723 Medium check An active log is not available to keep track of all hardware upgrades and software changes made to the FEP (Front End Processor).
  • V-224724 Medium checkfix NCP (Net Work Control Program) Data set access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel.
  • V-224725 Medium check A password control is not in place to restrict access to the service subsystem via the operator consoles (local and/or remote) and a key-lock switch is not used to protect the modem supporting the remote console of the service subsystem.
Sort by
b
All hardware components of the FEPs are not placed in secure locations where they cannot be stolen, damaged, or disturbed
CM-6 - Medium - CCI-000366 - V-224720 - SV-224720r1146377_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
ZFEP0011
Vuln IDs
  • V-224720
  • V-6900
Rule IDs
  • SV-224720r1146377_rule
  • SV-7195
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.
Checks: C-26411r1146377_chk

Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - Documents and procedures restricting access to the hardware components of the FEPs. If the hardware components of the FEPs are located in secure locations, this is not a finding.

Fix: F-26399r1145980_fix

Ensure that hardware components of the FEPs are protected as specified below: Physical security is the first level of security control for the FEPs. Install all hardware components of the FEPs in secure locations where they cannot be stolen, damaged, or disturbed. Make sure that FEP hardware is located in a secure area with limited access to authorized personnel.

b
A documented procedure is not available instructing how to load and dump the FEP NCP (Network Control Program).
CM-6 - Medium - CCI-000366 - V-224722 - SV-224722r1145984_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
ZFEP0013
Vuln IDs
  • V-224722
  • V-6902
Rule IDs
  • SV-224722r1145984_rule
  • SV-7197
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.
Checks: C-26413r1145982_chk

Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - Documents and procedures regarding the NCP load and dump processes. If a procedure is in place relative to the NCP load and dump processes, this not a finding.

Fix: F-26401r1145983_fix

If documented procedures for loading and dumping the FEP NCP (Network Control Program) are not available. Create a procedure document for dumping and loading the FEP and make sure that they are available to the ISSO and to authorized personnel responsible to perform these functions.

b
An active log is not available to keep track of all hardware upgrades and software changes made to the FEP (Front End Processor).
CM-3 - Medium - CCI-000318 - V-224723 - SV-224723r1145986_rule
RMF Control
CM-3
Severity
M
CCI
CCI-000318
Version
ZFEP0014
Vuln IDs
  • V-224723
  • V-6903
Rule IDs
  • SV-224723r1145986_rule
  • SV-7198
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.
Checks: C-26414r1145985_chk

Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - All documents and procedures that apply to FEP operations including network management, FEP initialization, IPL, shutdown, NCP dumping, backup, and recovery. If a log is in place to keep track of all hardware upgrades and software changes, this is not a finding.

Fix: F-26402r520191_fix

The systems programmer will see that a a log of all hardware and software upgrades/changes has been created for auditing purposes and problem tracking. All changes and upgrades will be logged.

b
NCP (Net Work Control Program) Data set access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel.
CM-5 - Medium - CCI-001499 - V-224724 - SV-224724r1146378_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
ZFEP0015
Vuln IDs
  • V-224724
  • V-6904
Rule IDs
  • SV-224724r1146378_rule
  • SV-7199
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.
Checks: C-26415r1145987_chk

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(NCPRPT). The ACP data set rules for NCP data sets restrict WRITE and/or greater access to authorized personnel (e.g., systems programming personnel), this is not a finding.

Fix: F-26403r1146378_fix

Identify Names of the following data sets used for installation and in development/production environments: - NCP system data sets - NCP source definition data sets - NCP load modules - NCP host dump data sets - NCP utility programs Have the ISSO validate that they are properly protected by the ACP. And that only authorized personnel are permitted UPDATE and/or ALLOCATE access (e.g., z/OS systems programming personnel).

b
A password control is not in place to restrict access to the service subsystem via the operator consoles (local and/or remote) and a key-lock switch is not used to protect the modem supporting the remote console of the service subsystem.
AC-3 - Medium - CCI-000213 - V-224725 - SV-224725r1146379_rule
RMF Control
AC-3
Severity
M
CCI
CCI-000213
Version
ZFEP0016
Vuln IDs
  • V-224725
  • V-6905
Rule IDs
  • SV-224725r1146379_rule
  • SV-7200
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.
Checks: C-26416r1146379_chk

Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.). If the following guidance is true, this is not a finding. Ensure password controls are in place to restrict access to the service subsystem via the operator consoles (local and/or remote). Ensure a key-lock switch is used to protect the modem supporting the remote console of the service subsystem. Ensure documents and procedures exist for any of the above functions of the service subsystem and FEP resources.

Fix: F-26404r1145991_fix

If any of the below procedures are not in place, than correct the situation by documenting the missing procedure(s). The systems programmer should validate that Control authorization to use service subsystem console (local or remote) by FEP internal security control through password validation. Restrict access to these passwords to the absolutely minimum number of necessary personnel. Use of vendor default passwords is prohibited. Assign different passwords for the local and remote consoles. Disconnect the local/remote console after three unsuccessful attempts to log on. Passwords used by vendor (COMTEN, IBM, CNT, or AMDAHL) service personnel will be changed after any maintenance is done. All passwords will be changed every 90 days. Restrict permission to change passwords only to authorized personnel. Use a key lock switch on the modem supporting the remote console of the service subsystem to prevent unauthorized access. The key lock switch is only open for scheduled and authorized remote access.