Navigate

Check: IBMZ-VM-000940

IBM zVM STIG: IBMZ-VM-000940 (in version v1 r0.1)

Title

The IBM z/VM CA VM:Secure product audit records must offload audit records to a different system or media. (Cat II impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

Check Content

If there is no documented process for audit offload, this is a finding. Examine the documented user process for audit record offload. If the procedure does not offload to a different system or media, this is a finding.

Fix Text

Develop a user written procedure to offload audit records to a different system or media.

Additional Identifiers

Rule ID:

Vulnerability ID: IBMZ-VM-000940

Group Title:

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001851	The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-4 (1)	Transfer To Alternate Storage