The IBM z/OS Policy Agent must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223780	RACF-OS-000240	SV-223780r991593_rule		Medium

Description

Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of DoD data.

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2025-06-24

Details

Check Text (C-25453r515028_chk)

Examine the policy agent policy statements.

If it can be determined that the policy agent employs a deny-all, allow-by exception firewall policy for allowing connections to other systems this is not a finding.

Fix Text (F-25441r515029_fix)

Develop a policy application and policy agent to employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.