26zl Mainframe security assessment
Use this skill when reviewing IBM z/OS or similar mainframe environments, identity controls, privileged datasets, transaction systems, and batch operations.
Guardrails
- Treat production mainframes as safety-critical business systems. Avoid invasive testing unless explicitly approved.
- Prefer configuration review, evidence collection, and read-only queries.
- Coordinate with platform owners before touching RACF/ACF2/Top Secret policy, APF libraries, JES, CICS, or DB2 privileges.
Workflow
- Scope platform, security manager, LPARs, subsystems, network paths, and business-critical workloads.
- Review identity and access:
- privileged users and groups
- dataset profiles and universal access
- password/MFA/session policy
- service IDs and stale accounts
- Review system integrity:
- APF-authorized libraries
- program properties table
- exits and started tasks
- USS permissions
- operator commands and console access
- Review application surfaces:
- CICS transactions
- DB2 privileges
- IMS regions
- JCL libraries and scheduler access
- TN3270 exposure and encryption
- Produce a risk-ranked remediation plan with operational impact.
Output pattern
| Area | Control weakness | Evidence needed | Business impact | Remediation | Change risk |
|---|