Check: ACF2-OS-000170
IBM z/OS ACF2 STIG:
ACF2-OS-000170
(in versions v9 r2 through v7 r1)
Title
IBM z/OS PARMLIB CLOCKxx must have the Accuracy PARM coded properly. (Cat II impact)
Discussion
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time, a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).
Check Content
Refer to the CLOCKxx member of PARMLIB. If the ACCURACY parm is not coded, this is a finding. If the ACCURACY parm is coded to "1000", this is not a finding.
Fix Text
Define the CLOCKxx statement to include the ACCURACY parm set to "1000".
Additional Identifiers
Rule ID: SV-223553r1001127_rule
Vulnerability ID: V-223553
Group Title: SRG-OS-000356-GPOS-00144
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-002046 |
The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period. |
| CCI-004922 |
Synchronize system clocks within and between systems or system components. |
| CCI-004926 |
Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period. |
Controls
| Number | Title |
|---|---|
| AU-8(1) |
Synchronization with Authoritative Time Source |