--- title: What's Running on Your LPARs, and Has It Changed? description: Change control proves a change was approved, not that the module on disk is the approved one. How FIM and SMP/E checks close that gap on z/OS. image: https://blog.virtelweb.com/hubfs/Gemini_Generated_Image_a6jfrpa6jfrpa6jf.jpg --- [![Virtel-logo202](https://blog.virtelweb.com/hs-fs/hubfs/Virtel-logo202.png?width=200&height=62&name=Virtel-logo202.png "Virtel-logo202")](https://blog.virtelweb.com/) - [Articles](https://blog.virtelweb.com/) - [Resources](https://www.virtelweb.com/support-resources/resources.html?utm_source=blog&utm_medium=blog_cta) - [Try Virtel](https://www.virtelweb.com/support-resources/virtel-demos-and-free-trial.html?utm_source=blog&utm_medium=blog_cta) - [Contact Us](https://www.virtelweb.com/contact.html?utm_source=blog&utm_medium=blog_cta) - [Virtel Web Suite](https://www.virtelweb.com?utm_source=blog&utm_medium=blog_cta) ###### Posted by [Sebastian DEWAR](https://blog.virtelweb.com/author/sebastian-dewar), [Maxime Quartier](https://blog.virtelweb.com/author/maxime-quartier) ###### October 21, 2026 # What's Running on Your LPARs, and Has It Changed? 8 min read  ## *Why do so few z/OS estates verify that what runs on each LPAR is still what they installed?* ![Gemini\_Generated\_Image\_a6jfrpa6jfrpa6jf](https://blog.virtelweb.com/hs-fs/hubfs/Gemini_Generated_Image_a6jfrpa6jfrpa6jf.jpg?width=642&height=428&name=Gemini_Generated_Image_a6jfrpa6jfrpa6jf.jpg) Between April and August 2012, intruders moved through mainframe systems operated by CSC in Denmark, which held Danish police records and the national population register. The operator did not detect them. The breach came to light only after Swedish police, investigating a similar attack on the z/OS environment run by Logica in Sweden, passed a lead to their Danish counterparts.**[1](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-1)** The case is old, but the question it raises is not. **If someone with privileged access changed a module in an APF-authorized library on one of your LPARs last month, how long would it take you to find out?** Every mainframe environment should be able to answer two questions quickly. The first is what is deployed: which z/OS release runs on each LPAR, with which PTFs applied. We looked at that question, and why it still takes days on many estates, in [What You Actually Run: z/OS Asset Inventory and Compliance](https://blog.virtelweb.com/what-you-actually-run-z-os-asset-inventory-compliance). The second question is the subject of this article: **has any of it been modified since the last verified baseline, and was each change authorized?** #### KEY TAKEAWAYS - Inventory tells you what should be on each LPAR. File integrity monitoring (FIM) tells you whether it still is. - On z/OS, the libraries that matter most to an attacker (APF, LPA, LNKLST, PARMLIB) are often assumed stable because they go through formal change control. - Change control proves a change was approved. It does not prove that the bytes on disk are the ones that were approved. - DORA, PCI DSS v4.0.1 and ISO/IEC 27001:2022 all expect evidence that system integrity is monitored, not a declaration that it is. ## What is file integrity monitoring? File integrity monitoring records a baseline of critical files, typically a cryptographic hash plus attributes such as size, location and last update, and then continuously checks that the current state still matches. When it does not, the tool raises an alert so that someone can decide whether the change was expected. The discipline is far from new. On Unix systems it goes back to the early 1990s, and it is now a baseline expectation in payment security: PCI DSS v4.0.1 Requirement 11.5.2 calls for a change-detection mechanism, such as FIM, that alerts on unauthorized modification of critical system, configuration and content files and runs comparisons at least once a week.**[2](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-2)** ## Deployed is not the same as effective On distributed platforms, FIM is one of the most widely deployed controls and one of the most poorly operated. Baselines drift and are never re-certified. Alerts are not matched against approved change windows. The resulting noise teaches operators to ignore the very signal the control exists to produce. The Carbanak campaign, documented by Kaspersky in February 2015, shows how long attackers can operate once they are inside. They entered banks through spear-phishing, moved laterally until they reached systems that controlled money, then altered account databases and instructed ATMs to dispense cash. Kaspersky reported that up to 100 financial institutions were hit, with losses per bank between $2.5 million and $10 million and total losses possibly as high as $1 billion.**[3](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-3)**  Each operation ran two to four months from the first infected computer to cash-out. That is the window continuous integrity monitoring is meant to shrink. | 2-4 | *Months each Carbanak intrusion typically lasted, from the first infected computer to cashing out. That is the window integrity monitoring is meant to close.*  Source: Kaspersky GReAT, "The Great Bank Robbery: the Carbanak APT", February 2015p ) | | --- | --- | ## Why are z/OS system libraries an easy blind spot? On z/OS the problem is the same, with one aggravating factor: FIM has been adopted unevenly. Many estates have neither the distributed world's imperfect coverage nor anything to replace it. The datasets that would matter most to an attacker are APF-authorized libraries, LPA and LNKLST concatenations, PARMLIB and PROCLIB members, and critical application load libraries. A modified module in an APF-authorized library runs with the highest level of trust the system grants. Yet in many shops these libraries are assumed to be stable precisely because every change to them goes through a formal release process. That assumption holds against accidental or casual modification. It does not hold against someone with the access and patience to work around change control, whether an external attacker using stolen credentials or an insider. A change ticket is a statement that a change was approved. It is not proof that the module on disk is the one that was approved. This is not a case of the mainframe lagging behind a solved discipline. Binary integrity is handled poorly almost everywhere. Many mainframe environments simply have not yet reached the stage of handling it at all. ## Authorized or known: the mainframe's advantage z/OS has something most distributed platforms lack: a system of record for installed software. IBM and vendor products are installed and maintained through SMP/E, which keeps track of every element and every PTF applied to it. That makes a stronger kind of integrity check possible. Instead of only asking whether a module differs from last week's baseline, a tool can ask whether the module on disk matches a version that SMP/E actually installed. A difference from the baseline that traces back to SMP/E maintenance is a known change. A difference that traces back to nothing is the one that needs investigating, whatever authority was used to make it. Vanguard describes this comparison against SMP/E as the core of how its SAMM product separates legitimate maintenance from modules of unknown origin.**[4](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-4)** The same mechanism also answers the inventory question from the other side. If a tool can see which PTFs are actually present in the libraries running on each LPAR, it can show where a critical fix is missing, not just where it was recorded as applied. ## Monitoring that fits the platform Mainframe teams have good reasons to be wary of transplanting distributed-style agents onto z/OS: the broad RACF access such an agent would need, its CPU and I/O footprint on a platform built for predictable response times, and the supply-chain risk that SolarWinds made concrete.**[5](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-5)** We discussed these constraints in detail in our article on [z/OS asset inventory](https://blog.virtelweb.com/what-you-actually-run-z-os-asset-inventory-compliance). Integrity monitoring built on native z/OS constructs sits in a different part of that risk space. A started task running under its own narrowly scoped RACF identity, consuming data the system already produces (SMF records, dataset update events) rather than polling live state, and offloading hash computation to zIIP processors where available, does not carry the same profile as a polling agent. It still needs RACF governance and proper sizing. But the objection that "FIM cannot run on a mainframe without disrupting it" no longer stands. ## What regulation now expects The regulatory framework has moved faster than operational practice. None of the texts below mentions the mainframe by name, and none prescribes a specific tool. All of them assume the operator can show evidence of system integrity on demand. DORA. Article 9(2) requires financial entities to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit. Article 9(4)(e) requires documented policies, procedures and controls for ICT change management, covering changes to software, hardware, firmware, systems and security parameters.**[6](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-6)** Article 17 of Commission Delegated Regulation (EU) 2024/1774 sets out what those change management procedures must contain, and Article 4 of the same text requires an ICT asset management policy with detailed records for each asset.**[7](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-7)** For more on DORA and the mainframe, see [DORA and Mainframe Access: The Security Gap Nobody Is Watching](https://blog.virtelweb.com/dora-and-mainframe-access-the-security-gap-nobody-is-watching). PCI DSS v4.0.1. Requirement 11.5.2 covers change detection and file integrity monitoring, and Requirement 12.5.1 requires an up-to-date inventory of in-scope system components.**[2](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-2)** Both apply to any mainframe that stores, processes or transmits cardholder data, or is connected to the environment that does. ISO/IEC 27001:2022. The standard does not name FIM, but several Annex A controls are where auditors look for this kind of evidence: A.8.9 (configuration management), A.8.32 (change management), A.8.7 (protection against malware) and A.5.36 (compliance with policies, rules and standards for information security).**[8](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-8)** NIS2. For essential and important entities in the EU, Article 21(2) of Directive (EU) 2022/2555 requires risk-management measures that include security in the acquisition, development and maintenance of network and information systems.**[9](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-9)** The common thread is simple. The cost of being unable to show what is running, and whether it has been modified, has moved from operational inconvenience to compliance exposure. | *In environments I have operated, the questions "do we know what is running" and "do we know it has not been modified" were answered separately, by different teams, with different tools, on different timelines. The teams were good. The tools were workable. The timelines were the problem. Auditors and attackers do not wait for internal coordination.* \- Sebastian Dewar, CTO, Virtel | | --- |   #### Vanguard SAMM, solution distributed by Virtel Vanguard SAMM (Software Application Monitoring and Malware Detection) addresses both questions in a single product. According to Vanguard, SAMM automatically baselines APF, LPA, LNKLST, system PARMLIB and PROCLIB datasets, monitors them 24/7, and checks each change against SMP/E to tell known maintenance from modules of unknown origin, including changes made from another system. It also reports which PTFs and APARs are actually present on each LPAR, provides a web interface and a 3270 interface, and can forward alerts to a SIEM. Vanguard positions SAMM against PCI DSS 4.0, DORA, SOX and GLBA requirements.**[4](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-4)** **[10](https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed#src-10)** ## Making integrity a continuous discipline In environments that have made the shift, the approach that works has three parts. Treat inventory and integrity as compliance functions. As a side task for the systems team "when there is time", they compete with urgent operational work and lose. As primary deliverables, with reporting lines into compliance and audit, they get a budget category that operational backlog never has. Answer both questions with one process. Asking what is deployed and asking whether it has been modified are two sides of the same problem: knowing the state of the IT estate with confidence at any moment. Splitting them across separate products and separate teams rebuilds the silos the discipline is meant to remove. Connect the mainframe to the rest of security operations. Integrity alerts should be matched against approved change windows, so that the noise problem seen on distributed platforms is not repeated, and they should reach the same SIEM and dashboards the rest of the organization uses. Data that lives in a tool only mainframe engineers open keeps the mainframe invisible to the people whose decisions depend on it. ## Knowing what runs, proving it hasn't changed The two questions are old. The systems that prompt them are older. What has changed is that regulators now expect documentary answers, attackers punish environments that cannot give them, and the tooling to answer them on z/OS has matured enough that manual effort is no longer the obstacle. The mainframe earned its reputation for stability through fifty years of skilled operation. The next decade asks for the same skill plus continuous visibility into inventory and integrity, something the distributed world has tooled for but, where integrity is concerned, rarely operates well. The mainframe has the chance to do it properly: know what runs, and verify continuously that it has not changed. ## Frequently asked questions ### What is file integrity monitoring on z/OS? It is the practice of baselining critical datasets and load modules, such as APF-authorized libraries, LPA, LNKLST and PARMLIB members, and alerting when their current state no longer matches. On z/OS, changes can also be checked against SMP/E, the platform's system of record for installed software. ### Does PCI DSS require file integrity monitoring on the mainframe? PCI DSS v4.0.1 Requirement 11.5.2 requires change detection, such as FIM, on critical files of in-scope system components, with comparisons at least weekly. A mainframe that stores, processes or transmits cardholder data, or is connected to the cardholder data environment, is in scope. ### Does DORA explicitly require file integrity monitoring? No. DORA requires integrity of data and systems (Article 9(2)) and documented ICT change management controls (Article 9(4)(e) and Article 17 of Delegated Regulation 2024/1774). FIM is one way to prove those controls actually operate. ### How is FIM different from change management? Change management records that a change was requested and approved. FIM verifies what actually changed on disk. Without FIM, you can show that changes were authorized, but not that the only changes made were authorized ones.   Vanguard SAMM, solution distributed by Virtel Know what runs on every LPAR, and prove it hasn't changed. Vanguard SAMM brings continuous maintenance-level validation and file integrity monitoring to z/OS LPARs and libraries, with audit-ready reporting. Virtel handles integration, training and local support. [Discover Vanguard SAMM →](https://www.virtelweb.fr/vanguard/vanguard-samm-securite-mainframe-zos.html) SOURCES and REFERENCES 1. [Help Net Security — Pirate Bay founder suspected of hacking police databases](https://www.helpnetsecurity.com/?p=35367) Help Net Security, 2013 — CSC Denmark mainframe intrusion, April–August 2012. See also [PCWorld](https://www.pcworld.com/article/2042320/swedish-court-oks-pirate-bay-cofounder-svartholm-wargs-extradition-to-denmark.html) on the related Logica and Nordea z/OS cases 2. [PCI Security Standards Council — PCI DSS v4.0.1, Requirements 11.5.2 and 12.5.1](https://www.pcisecuritystandards.org/document_library/) pcisecuritystandards.org — v4.0.1 has replaced v4.0, retired on 31 December 2024 3. [Kaspersky GReAT — The Great Bank Robbery: the Carbanak APT](https://www.kaspersky.com/about/press-releases/the-great-bank-robbery-carbanak-cybergang-steals-1bn-from-100-financial-institutions-worldwide) securelist.com, 16 February 2015 4. [Vanguard Integrity Professionals — SAMM Technical Overview](https://www.go2vanguard.com/wp-content/uploads/SAMM-Technical-Overview.pdf) go2vanguard.com — vendor documentation, May 2025 5. [CISA — Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations (SolarWinds)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a) cisa.gov — Advisory AA20-352A 6. [Regulation (EU) 2022/2554 — Digital Operational Resilience Act (DORA), Article 9](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) EUR-Lex — applicable since 17 January 2025 7. [Commission Delegated Regulation (EU) 2024/1774 — RTS on the ICT risk management framework, Articles 4 and 17](https://eur-lex.europa.eu/eli/reg_del/2024/1774/oj) EUR-Lex — supplementing DORA 8. [ISO/IEC 27001:2022 — Annex A controls A.5.36, A.8.7, A.8.9 and A.8.32](https://www.iso.org/standard/27001) iso.org 9. [Directive (EU) 2022/2555 — NIS2, Article 21](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) EUR-Lex 10. [Vanguard Integrity Professionals — SAMM product page](https://www.go2vanguard.com/solutions/samm/) go2vanguard.com — Software Application Monitoring and Malware Detection 11. [Vanguard — SAMM for z/OS white paper](https://www.go2vanguard.com/wp-content/uploads/SAMM-for-zOS-whitepaper.pdf) Vanguard Integrity Professionals, 2025 12. [Virtel — Vanguard SAMM, sécurité mainframe z/OS](https://www.virtelweb.fr/vanguard/vanguard-samm-securite-mainframe-zos.html) virtelweb.fr — distribution, integration and support Topics: [z/OS](https://blog.virtelweb.com/topic/z-os), [DORA](https://blog.virtelweb.com/topic/dora), [PCI DSS](https://blog.virtelweb.com/topic/pci-dss), [Compliance](https://blog.virtelweb.com/topic/compliance), [Inventory](https://blog.virtelweb.com/topic/inventory), [LPAR](https://blog.virtelweb.com/topic/lpar), [File integrity monitoring](https://blog.virtelweb.com/topic/file-integrity-monitoring) Back to Top - Share - - [*X*](https://twitter.com/intent/tweet?url=https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed) - - [mailto:?body=https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed](mailto:?body=https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed) #### Related Articles [Knowing the Components Is Not the Same as Understanding the System](https://blog.virtelweb.com/knowing-the-components-is-not-the-same-as-understanding-the-system) [Is this the end of IBM 3270 green screens?](https://blog.virtelweb.com/is-this-the-end-of-ibm3270-green-screen) #### Topics - [Mainframe (24)](https://blog.virtelweb.com/tag/mainframe) - [3270 Emulation (17)](https://blog.virtelweb.com/tag/3270-emulation) - [Mainframe Modernization (13)](https://blog.virtelweb.com/tag/mainframe-modernization) - [3270 modernization (10)](https://blog.virtelweb.com/tag/3270-modernization) - [z/OS (10)](https://blog.virtelweb.com/tag/z-os) - [TN3270 (9)](https://blog.virtelweb.com/tag/tn3270) - [Virtel (9)](https://blog.virtelweb.com/tag/virtel) - [APIs (8)](https://blog.virtelweb.com/tag/apis) - [LegacyTransformation (8)](https://blog.virtelweb.com/tag/legacytransformation) - [WebEnablement (8)](https://blog.virtelweb.com/tag/webenablement) - [security (7)](https://blog.virtelweb.com/tag/security) - [terminal emulator (7)](https://blog.virtelweb.com/tag/terminal-emulator) - [DORA (3)](https://blog.virtelweb.com/tag/dora) - [Mainframe Applications (3)](https://blog.virtelweb.com/tag/mainframe-applications) - [Mainframe security (2)](https://blog.virtelweb.com/tag/mainframe-security) - [RACF (2)](https://blog.virtelweb.com/tag/racf) - [green screen modernization (2)](https://blog.virtelweb.com/tag/green-screen-modernization) - [AI (1)](https://blog.virtelweb.com/tag/ai) - [AI agents (1)](https://blog.virtelweb.com/tag/ai-agents) - [AT-TLS (1)](https://blog.virtelweb.com/tag/at-tls) - [Asset management (1)](https://blog.virtelweb.com/tag/asset-management) - [Audit (1)](https://blog.virtelweb.com/tag/audit) - [Compliance (1)](https://blog.virtelweb.com/tag/compliance) - [Identity (1)](https://blog.virtelweb.com/tag/identity) - [Inventory (1)](https://blog.virtelweb.com/tag/inventory) - [Knowledge Transfer (1)](https://blog.virtelweb.com/tag/knowledge-transfer) - [LPAR (1)](https://blog.virtelweb.com/tag/lpar) - [Mainframe News (1)](https://blog.virtelweb.com/tag/mainframe-news) - [Mainframe Skills (1)](https://blog.virtelweb.com/tag/mainframe-skills) - [NIS2 (1)](https://blog.virtelweb.com/tag/nis2) - [Network (1)](https://blog.virtelweb.com/tag/network) - [PCI DSS (1)](https://blog.virtelweb.com/tag/pci-dss) - [Patch management (1)](https://blog.virtelweb.com/tag/patch-management) - [Pentest (1)](https://blog.virtelweb.com/tag/pentest) - [SOX (1)](https://blog.virtelweb.com/tag/sox) - [Training (1)](https://blog.virtelweb.com/tag/training) - [Virtel News (1)](https://blog.virtelweb.com/tag/virtel-news) - [case study (1)](https://blog.virtelweb.com/tag/case-study) - [cics (1)](https://blog.virtelweb.com/tag/cics) - [testimonial (1)](https://blog.virtelweb.com/tag/testimonial) See All Topics [Contact](https://www.virtelweb.com/contact.html) [Privacy](https://www.virtelweb.com/privacy.html) [About](https://www.virtelweb.com/about/syspertec-group.html) [Legal](https://www.virtelweb.com/legal.html) Copyright © 2026 Virtel. All Rights Reserved ![Virtel-logo2025-fondSombre](https://blog.virtelweb.com/hs-fs/hubfs/Virtel-logo2025-fondSombre.png?width=1500&height=465&name=Virtel-logo2025-fondSombre.png "Virtel-logo2025-fondSombre") ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Sebastian DEWAR", "url" : "https://blog.virtelweb.com/author/sebastian-dewar" }, "dateModified" : "2026-10-21T08:59:31.047Z", "datePublished" : "2026-10-21T08:59:05.000Z", "headline" : "What's Running on Your LPARs, and Has It Changed?", "image" : [ "https://blog.virtelweb.com/hubfs/Gemini_Generated_Image_a6jfrpa6jfrpa6jf.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.virtelweb.com/hubfs/LOGO%20VIRTEL%20RVB.jpg" }, "name" : "Syspertec Group" } } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "about" : [ { "@type" : "Thing", "name" : "File integrity monitoring" }, { "@type" : "Thing", "name" : "SMP/E" }, { "@type" : "Thing", "name" : "Digital Operational Resilience Act (DORA)" } ], "articleSection" : "Mainframe Security", "author" : [ { "@type" : "Person", "jobTitle" : "CTO", "name" : "Sebastian Dewar", "url" : "https://blog.virtelweb.com/author/sebastian-dewar", "worksFor" : { "@type" : "Organization", "name" : "Virtel" } }, { "@type" : "Person", "name" : "Maxime Quartier", "url" : "https://blog.virtelweb.com/author/maxime-quartier", "worksFor" : { "@type" : "Organization", "name" : "Virtel" } } ], "citation" : [ "https://www.helpnetsecurity.com/?p=35367", "https://www.kaspersky.com/about/press-releases/the-great-bank-robbery-carbanak-cybergang-steals-1bn-from-100-financial-institutions-worldwide", "https://www.pcisecuritystandards.org/document_library/", "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "https://eur-lex.europa.eu/eli/reg_del/2024/1774/oj", "https://eur-lex.europa.eu/eli/dir/2022/2555/oj", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a", "https://www.go2vanguard.com/solutions/samm/" ], "dateModified" : "2026-10-08", "datePublished" : "2026-10-08", "description" : "Change control proves a change was approved, not that the module on disk is the approved one. How FIM and SMP/E checks close that gap on z/OS.", "headline" : "What's Running on Your LPARs, and Has It Changed?", "inLanguage" : "en", "isBasedOn" : "https://blog.virtelweb.com/what-you-actually-run-z-os-asset-inventory-compliance", "keywords" : [ "file integrity monitoring z/OS", "FIM", "SMP/E", "APF-authorized libraries", "LPAR", "PCI DSS 11.5.2", "DORA", "ISO/IEC 27001:2022", "Vanguard SAMM", "z/OS" ], "mainEntityOfPage" : { "@id" : "https://blog.virtelweb.com/whats-running-on-your-lpars-and-has-it-changed", "@type" : "WebPage" }, "mentions" : [ { "@type" : "SoftwareApplication", "name" : "Vanguard SAMM (Software Application Monitoring and Malware Detection)" } ], "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.virtelweb.com/images/logos/logo2020SyspertecIBMprovider.JPG" }, "name" : "Virtel" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It is the practice of baselining critical datasets and load modules, such as APF-authorized libraries, LPA, LNKLST and PARMLIB members, and alerting when their current state no longer matches. On z/OS, changes can also be checked against SMP/E, the platform's system of record for installed software." }, "name" : "What is file integrity monitoring on z/OS?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "PCI DSS v4.0.1 Requirement 11.5.2 requires change detection, such as FIM, on critical files of in-scope system components, with comparisons at least weekly. A mainframe that stores, processes or transmits cardholder data, or is connected to the cardholder data environment, is in scope." }, "name" : "Does PCI DSS require file integrity monitoring on the mainframe?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. DORA requires integrity of data and systems (Article 9(2)) and documented ICT change management controls (Article 9(4)(e) and Article 17 of Delegated Regulation 2024/1774). FIM is one way to prove those controls actually operate." }, "name" : "Does DORA explicitly require file integrity monitoring?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Change management records that a change was requested and approved. FIM verifies what actually changed on disk. Without FIM, you can show that changes were authorized, but not that the only changes made were authorized ones." }, "name" : "How is FIM different from change management?" } ] } ```