STIGQter: STIG Summary: Mainframe Product Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 24 Jan 2020:

The Mainframe product must perform an integrity check of all software from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity at startup, at transitional states as defined in site security plan or security-relevant events, or annually.

DISA Rule

SV-82991r1_rule

Vulnerability Number

V-68501

Group Title

SRG-APP-000475-MFP-000374

Rule Version

SRG-APP-000475-MFP-000374

Severity

CAT II

CCI(s)

• CCI-002710 - The information system performs an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.

Weight

10

Fix Recommendation

Configure the Mainframe Product to perform an integrity check of all software from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity at startup, at transitional states as defined in site security plan or security-relevant events, or annually.

Check Contents

If the Mainframe Product has no function or capability for integrity verification, this is not applicable.

Examine installation and configuration settings.

If the Mainframe Product is not configured to perform an integrity check of all software from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity at startup, at transitional states as defined in site security plan or security-relevant events, or annually, this is a finding.

Vulnerability Number

V-68501

Documentable

False

Rule Version

SRG-APP-000475-MFP-000374

Severity Override Guidance

If the Mainframe Product has no function or capability for integrity verification, this is not applicable.

Examine installation and configuration settings.

If the Mainframe Product is not configured to perform an integrity check of all software from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity at startup, at transitional states as defined in site security plan or security-relevant events, or annually, this is a finding.

Check Content Reference

M

Target Key

3061

Comments