Security reference

The security reference information provides details about security rules, RACF® classes, commands and resources, SIT parameters, and standards.

Available CICS health checks supported by IBM Health Checker for z/OS
Checking and reporting of key security configuration settings in CICS® regions identifies configuration issues, potential compliance exposures, and enables simpler auditing. This section provides details about each health checker rule.
Summary of RACF classes for CICS resources
RACF provides classes for CICS resources, CICSPlex® SM resources, and the system resources that CICS uses.
CICS transactions subject to security checking
To conform with a zero trust strategy and various compliance regulations such as PCI-DSS, as of CICS TS 6.2, all CICS transactions, excluding CJXA and CICSPlex SM transactions (CO**), are defined with CMDSEC(YES) and RESSEC(YES). This might impact your security definitions.
Commands subject to command security
These commands are subject to command security. If you enable command security, security checks are performed for these commands, when they are issued from a CICS application and for the equivalent commands that you can issue with the CEMT main terminal transaction or CECI. CICS calls RACF to check that the user that initiated the transaction has authority to use the command for the specified resource.
Resources subject to command security checking
For transaction and resource security checking, you identify the resources to RACF by using the identifiers that you assigned to them; for example, file names, queue names, and transaction names. However, for command security, the resource identifiers are all predefined by CICS, and you use these predefined names when you define resource profiles to RACF or as the RESID values on the QUERY SECURITY command.
Resource and command check cross-reference
Use this cross-reference to check commands against resources.
Responses to SDC HTTP calls
SDC captures the security definitions required by applications during development. You can interact with security definition capture (SDC) through an HTTP REST interface. The response schema and example responses are documented.
Data captured by CICS security discovery
Security discovery data (SDD) is the information that is collected about unique CICS resource accesses for every user while CICS security discovery is active.
Security discovery statistics
CICS security discovery statistics show the number of security calls that have, or would have, been made while resource security is active.
Security-related system initialization parameters
These SIT parameters are used by CICS security processing.
Security standards
CICS complies with the following standards for security processing.
SMF 1154 subtype 80 record
The CICS SMF 1154 subtype 80 compliance evidence record is documented in XSCC – SMF 1154 Subtype 80.
SRR reason codes
The security request recording (SRR) reason codes are returned by SRR to indicate why the security check succeeded or failed.
The SAML linkable interface, DFHSAML
This topic describes the input and output containers, copybooks, DSECTs, and response codes that are used by CICS SAML support.