Title

IBM z/OS system administrator must develop a procedure to offload SMF files to a different system or media than the system being audited. (Cat II impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

Check Content

Ask the system administrator for the procedure to offload SMF files to a different system or media than the system being audited. If the procedure does not exist, this is a finding.

Fix Text

Develop a procedure to offload SMF files to a different system or media than the system being audited.

Additional Identifiers

Rule ID: SV-223585r853557_rule

Vulnerability ID: V-223585

Group Title: SRG-OS-000479-GPOS-00224

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.