z/OS RACF STIG SRR Checklist (Y26M01)

19 items · Security · Hard difficulty · 3 hours

Run a complete z/OS RACF SRR to verify RACF configuration and STIG compliance.

• Review STIG version and supporting resources

  Confirm checklist version Y26M01 and download required XCCDF/SRR files.

• Confirm target system is IBM z/OS

  Verify CPE/host inventory lists z/OS as the target OS.

• Verify RACF is installed and running

  Check RACF service status and base datasets are present.

• Validate RACF configuration against STIG settings

  Compare system settings with STIG requirements and note deviations.

• Review user and group account controls

  Assess account lifecycle, privileges, and administration policies.

• Audit privileged accounts

  List and verify justification for all privileged/userids.

• Secure system and service accounts

  Ensure non-interactive accounts have strong controls and no default passwords.

• Remove or disable unused accounts

  Disable accounts with no business need and document actions.

• Verify access control lists and permissions

  Confirm dataset and resource permissions follow least privilege.

• Check logging and audit configuration

  Validate audit scope, collectors, and log integrity controls.

• Ensure auditing is enabled

  Confirm RACF and system auditing are active for required events.

• Confirm log retention and protection meet policy

  Verify retention periods, offsite copies, and access controls.

• Run SRR scripts and capture output

  Execute provided SRR/XCCDF scripts and save reports for review.

• Validate patch levels and software versions

  Compare installed releases to vendor and DISA requirements.

• Confirm backups and recovery procedures

  Ensure RACF critical datasets are backed up and restore tested.

• Document exceptions and mitigations

  Record deviations from STIG with justification and compensating controls.

• Report findings to designated point of contact

  Send SRR results and remediation steps to the listed POC.

• Update checklist and resource links

  Refresh local checklist copy and link to latest DISA resources and SHA values.

• Schedule periodic reviews and re-assessments

  Set a cadence for future SRRs and STIG updates.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.