IBM z/OS system administrator must develop a procedure to offload SMF files to a different system or media than the system being audited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223805	RACF-OS-000510	SV-223805r959008_rule		Medium

Description

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2025-06-24

Details

Check Text (C-25478r515103_chk)

Ask the system administrator for the procedure to offload SMF files to a different system or media than the system being audited.

If the procedure does not exist, this is a finding.

Fix Text (F-25466r515104_fix)

Develop a procedure to offload SMF files to a different system or media than the system being audited.