Check: IBMZ-VM-000950
IBM zVM STIG:
IBMZ-VM-000950
(in version v1 r0.1)
Title
The IBM z/VM CA VM:Secure product audit records must be offloaded on a weekly basis. (Cat II impact)
Discussion
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Check Content
Check audit offload procedure. If it can be determined that the audit records are being offloaded on a weekly basis, this is not a finding.
Fix Text
Develop procedures that offload Audit minidisk on a weekly basis.
Additional Identifiers
Rule ID:
Vulnerability ID: IBMZ-VM-000950
Group Title:
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-001851 |
The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| AU-4 (1) |
Transfer To Alternate Storage |