CSF maps to the five NIST Cybersecurity Framework functions end-to-end:
DORA demands two-hour recovery. NIST requires continuous monitoring. PCI DSS mandates file integrity. CSF maps directly to the frameworks that govern your industry — so compliance is a built-in outcome, not a separate project.
Identify
Security visibility, asset awareness, governance alignment, and compliance reporting — integrated into your enterprise security stack.
NIST Identify defines what must be protected. MainTegrity CSF establishes continuous awareness of your z/OS environment by maintaining cryptographic baselines of critical software and configurations.
FIM+ builds and preserves trusted baselines.
Supply Chain Security validates vendor software before installation, blocking compromised code at the gate.
CSF Foundation integrates with SIEM/SOC platforms (Splunk, QRadar, ServiceNow) for enterprise visibility.
Automated reporting supports NIST CSF, PCI-DSS, DORA, and other frameworks.
By defining trusted assets and approved behavior, CSF ensures complete visibility before an incident occurs.
Protect
Prevent malicious change before damage occurs — enforcing integrity, access control, and trusted execution.
NIST Protect focuses on preventative safeguards. CSF enforces integrity at machine speed — stopping threats before they execute.
Supply Chain Security cryptographically verifies updates prior to installation.
FIM+ prevents unauthorized modification of critical files and parameters.
CSF Foundation intelligent whitelisting ensures only approved jobs and programs execute — reducing false positives.
Integration with RACF, ACF2, and TSS strengthens access control.
AI integrations enhance protection without increasing alert fatigue.
Damage Control First: prevent the breach from taking effect, preserving operational continuity.
Detect
Real-time anomaly detection, encryption detection in seconds, and data exfiltration defense — without alert fatigue.
NIST Detect requires continuous monitoring. CSF observes live system activity through security and SMF exits — not delayed log analysis.
Early Warning detects reconnaissance, privilege escalation, impersonation, and rogue encryption in real time.
NetWatch identifies abnormal data transfers and suspicious network behavior.
FIM+ detects unauthorized changes via cryptographic hash comparison.
Behavioral thresholds detect novel attacks, not just signatures.
Intelligent whitelisting ensures alerts represent genuine threats.
Milliseconds matter. Detection without action is documentation of your breach.
Respond
Immediate automated suspension, guided investigation, and rapid containment — without halting business operations.
NIST Respond focuses on containing impact. CSF reacts instantly while allowing legitimate processing to continue.
CSF Foundation Real-Time Reaction suspends malicious tasks immediately.
Browser-based forensics show what changed, who changed it, and when it was last trusted.
SOC integration enables coordinated escalation and faster containment.
Stop the damage first. Investigate with clarity and time on your side.
Recover
Embedded recovery planning, surgical restore, and trusted backup validation — restoring only what was compromised.
NIST Recover ensures rapid restoration and resilience. CSF embeds recovery intelligence directly into the platform.
Restore Assist (CSF Foundation) generates JCL for surgical recovery.
FIM+ identifies the last known good state.
Integrated backup visibility confirms clean recovery points.
Recovery avoids regression, preserving legitimate business changes.
Modern ransomware persists in software layers. CSF restores trusted operations — minimizing financial, operational, and reputational impact.
Ready. Set. Compliant.
The race to compliance doesn't have to be a marathon.
DORA
Digital Operational Resilience Act
DORA establishes a comprehensive framework to ensure the operational resilience of financial institutions and their critical service providers across the European Union. It became fully applicable in January 2025, making compliance an immediate priority.
Unlike general cybersecurity guidance, DORA is prescriptive. It mandates specific capabilities across ICT risk management, incident reporting, resilience testing, and third-party oversight — and it applies not only to financial institutions but also to their critical technology providers.
Key DORA articles and how MainTegrity CSF addresses them:
- Articles 5–16 — ICT Risk Management: Organizations must identify, protect, detect, respond, and recover from ICT threats. CSF provides continuous integrity monitoring across the full lifecycle — FIM+ detects unauthorized changes in real time, Early Warning catches reconnaissance and privilege escalation, and Restore Assist enables rapid, surgical recovery.
- Article 17 — ICT Incident Reporting: DORA requires organizations to classify, report, and remediate ICT incidents with specific timelines. FIM+ forensics provide immediate scope, timing, and attribution data — the exactly what regulators ask for.
- Articles 24–27 — Digital Resilience Testing: Advanced testing including threat-led penetration testing (TLPT) must validate detection and response capabilities. CSF's track record — Pentesters 0, CSF 3 — demonstrates that skilled penetration testers have not breached a CSF-protected system.
- Articles 28–44 — Third-Party Oversight: Critical ICT providers face direct regulatory scrutiny. Supply Chain validates vendor-provided software against known good states before deployment, supporting separation of duties requirements.
Why this matters for mainframes: DORA doesn't exempt mainframes. If financial transactions run on z/OS — and they often do — the mainframe is an ICT system subject to all DORA requirements. Most organizations have robust detection on distributed systems but significant gaps on the mainframe. CSF closes that gap.
PCI/DSS
Payment Card Industry Data Security Standard
If your mainframe handles credit or debit card information, you are subject to PCI DSS. Backed by Visa, Mastercard, American Express, and most other major financial industry players, PCI DSS applies to every computer processing debit or credit card information — mainframes included.
IBM states that 87% of credit card transactions and 29 billion ATM transactions are processed on z/OS every year. PCI DSS V4 is now in force, and requirements have become stricter, not looser.
Without integrity monitoring technology, you do not comply. Period.
Both DSS V3.2.1 and V4 explicitly require File Integrity Monitoring to meet Controls 10.5.5 and 11.5:
- Control 10.5.5 asks: "Is file-integrity monitoring or change-detection software used on logs to ensure that existing log data cannot be changed without generating alerts?"
- Control 11.5 asks: "Is a change-detection mechanism deployed to detect unauthorized modification of critical system files, configuration files, or content files?"
These are not recommendations — they are stated requirements. Some organizations attempt to use "compensating controls" as substitutes, but these must always be defended during audits, lower compliance scores, and face even more scrutiny under V4. With no generally accepted substitute for FIM processing on z/OS, mainframes that need to comply need FIM+.
Executive liability: PCI DSS Part 3b requires the personal signature of your CIO, CFO, or CEO attesting that all compliance requirements are met. When that attestation asks whether file integrity monitoring is deployed, the executive signing is personally certifying the answer. If FIM isn't actually in place on the mainframe, that signature becomes a significant personal liability.
FIM+ eliminates the compliance burden:
- Produces, files, and distributes required weekly compliance reports automatically
- Eliminates the need for compensating controls entirely — direct compliance with 10.5.5 and 11.5
- Shortens PCI audits by providing clean, automated evidence
- Improves compliance scores while simultaneously improving security
Bottom line: MainTegrity is recognized as a thought leader in the PCI DSS space — selected to address the North American PCI conference on mainframe ransomware avoidance. FIM+ eliminates unnecessary manual effort, improves compliance scores, has better reporting, and shortens audits, all while improving your cyber security.
HIPAA
Health Insurance Portability and Accountability Act
The HIPAA Security Rule focuses on protecting the confidentiality, integrity, and availability of electronic health records. Full NIST compliance is not required — HIPAA targets specific security outcomes related to health information protection.
MainTegrity CSF addresses HIPAA's key requirements directly:
- §164.308(a)(7) — Contingency Plan (Administrative Requirement) Organizations must quickly recover from malicious or accidental changes. CSF provides policy-driven recovery actions, identifies changes in error, and deploys audit and backout automation — recovering only compromised components without affecting the rest of the environment.
- §164.312(b) — Audit Controls (Technical Requirement) HIPAA requires mechanisms to record and examine activity in systems containing ePHI. FIM+ provides change reporting with complete forensic detail on every change, maintaining a comprehensive, tamper-evident audit trail.
- §164.312(c)(1) — Integrity (Technical Requirement) ePHI must be protected from improper alteration or destruction. FIM+ performs hash validation of files and configurations, provides instant alerting to changes, and continuously monitors for both internal and external threats.
- §164.312(e)(2)(i) — Integrity Controls (Technical Requirement) Transmitted ePHI must not be improperly modified without detection. FIM+ delivers real-time alerts when changes occur, tracks all changes with a complete audit trail — what changed, when, and by whom — and NetWatch monitors network connections to detect data exfiltration.
Breach Notification Support: HIPAA requires organizations to notify affected individuals within 60 days with specific details. FIM+ forensics provide this information immediately — exactly which datasets were affected, when the unauthorized changes occurred, and the extent of the modifications. This means accurate, specific notifications rather than estimates assembled over weeks of manual investigation.
Reference: NIST SP 800-66r1 — An Introductory Resource Guide for Implementing the HIPAA Security Rule
NIST
Digital Operational Resilience Act
A cornerstone of FIM+ functionality is the NIST Cybersecurity Framework — specifically all five pillars: Identify, Protect, Detect, Respond, and Recover.
FIM+ implements nearly all NIST CSF recommendations in these areas. Every item marked with * indicates where FIM+ provides stronger controls than traditional tools. Items marked with # indicate advanced techniques that extend beyond the current CSF standard.
- IDENTIFY — Asset Management*, Business Environment, Governance*, Risk Assessment, Risk Management Strategy
- PROTECT — Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance*, Protective Technology*
- DETECT — Anomalies and Events, Security*, Continuous Monitoring*, Detection Processes*, Backup Verify*#, Whitelist/Baselines*#
- RESPOND — Response Planning*, Communications*, Analysis*, Mitigation/Improvements*, Content Comparison*#
- RECOVER— Recovery Planning*, Improvements*, Communications*, Software Recovery*#, Verify Restore*#, Immutable Backups*#
However, FIM+ goes further. MainTegrity expects many of these advanced extensions to become requirements in CSF V2, which is in the review process. FIM+ provides not only compliance with the current standard but also a degree of future-proofing.
FIM+ CSF Extensions — capabilities beyond current NIST CSF:
- Whitelists (Baselines) — the first continuously up-to-date whitelist on z/OS, as suggested by recent NIST bulletins. There has never before been such a capability on z/OS, which historically left organizations unable to detect compromised components before damage occurred.
- Verify Backup (Hash) — cryptographic verification of backup integrity
- Ransom Early Warning — detect encryption attacks in progress
- Real-time Alerts — instant notification of security events
- Automated Forensics — GUI-based investigation with organized evidence
- Policy-Driven Recovery — customer-specific response protocols
- Verify Restored Systems — post-recovery integrity validation
- Audit Evidence Reports — automated compliance documentation
- Content Comparison — side-by-side before/after analysis
Standards Convergence: MainTegrity has found a high degree of convergence between the various security standards, many of them with NIST CSF at their heart. A strong NIST CSF implementation on the mainframe creates a multiplier effect across your entire compliance portfolio — PCI DSS, DORA, FISMA, ISO 27001, and SOX all build on NIST foundations.
Better Security = Better Compliance.
Compliance results in better security for your IBM mainframe to protect against increasingly sophisticated attacks. And better security always results in better compliance. The two reinforce each other.
FISMA
Federal Information Security Management Act
FISMA is a US federal law enacted in 2002 and amended by the 2014 Federal Information Security Modernization Act. It affects government agencies and contractors and addresses the protection of information and information systems from threats — unauthorized access, use, modification, and destruction. FISMA applies not only to federal agencies but also to public and private organizations that provide services for government agencies.
To adhere to FISMA compliance, organizations must implement the controls in the NIST 800-53 publication. These controls cover five families directly addressed by CSF:
- Access Control (AC) — FIM+ detects unauthorized changes even when made with valid credentials, closing the gap left by access control systems like RACF, ACF2, and TSS that only control who can access resources, not what they do once inside.
- Audit and Accountability (AU) — FIM+ maintains a comprehensive, tamper-evident audit trail of all changes to monitored resources, providing the evidence required for Authority to Operate (ATO) assessments.
- Configuration Management (CM) — FIM+ continuously verifies that system configurations match approved baselines. Change control integration with ServiceNow and BMC Helix ensures every change has an approved request.
- Incident Response (IR) — The forensics browser provides organized, visual evidence for investigation. Millisecond threat suspension halts malicious activity while business operations continue.
- System and Information Integrity (SI) — Cryptographic hash comparison detects any modification to system files, parameters, and security configurations. Continuous monitoring meets FISMA's requirement for ongoing assessment rather than periodic audits.
Beyond US Federal: Irrespective of whether your organization is subject to FISMA, NIST 800-53 provides valuable insight as to what can be done to protect computer systems. In fact, 800-53 has been adopted and modified by cybersecurity authorities in many countries:
- Canada — ITSG-33
- Australia — Information Security Manual (ISM)
- United Kingdom — Cyber Essentials
- Germany — BSI-100 series
Security experts worldwide point to 800-53 and ISO 27001 as the foundation for protecting all computer systems, including mainframes.
SOX
Sarbanes-Oxley Act
The Sarbanes-Oxley Act was introduced in 2002 to enhance corporate governance and accountability in financial reporting. SOX compliance involves annual audits of public companies to demonstrate accurate financial reporting and prevent fraud. Failure to comply can result in significant fines or imprisonment.
SOX requires that all financial reports include an Internal Controls Report — demanding meticulous record-keeping and verification of all IT assets, including data and computers, with any discrepancies requiring immediate remediation and strict procedures.
How FIM+ automates SOX compliance:
FIM+ scans all production files and detects when changes have occurred. Using the ServiceNow gateway, FIM+ automatically determines if there is a corresponding approved change request:
- Approved change found → Noted, recorded, and passed. Audit trail captures the approval reference.
- No matching request → Alert sent to SOX Response Team via email and text for investigation.
SOX audit reports are generated automatically, showing either "Unauthorized access" or "All Services Correct." The FIM+ forensics browser and recovery assistant speed resolution when unauthorized changes are detected. At audit time, FIM+ automatically produces a complete audit trail — including how each event was resolved — dramatically shortening the process.
Expected Results:
- Day 1: Avoid 50% of manual labour immediately upon deployment
- After solution tailoring: Up to 90% reduction in staff time compared to manually reviewing thousands of SMF update records daily and checking change control for proper approval
- Audit impact: 33% reduced audit time and fees
The FIM+ forensics browser makes auditors more self-sufficient, saving additional time and cost. With a superior information base, audits can focus on year-over-year improvements rather than chasing errors.
GDPR
General Data Protection Regulation
GDPR is an outcome-based standard. Ignore it at your peril.
The General Data Protection Regulation mandates that organizations implement appropriate technical and organizational measures to ensure the security of personal data. It applies to any organization processing personal data of EU residents, regardless of where the organization is based.
Unlike prescriptive standards, GDPR focuses on achieving specific outcomes. Article 43 suggests compliance groups — PCI, NIST, and ISO 27001 — as foundations for demonstrating appropriate technical measures. Organizations already aligned to these frameworks through CSF have a strong foundation for GDPR compliance.
What sets GDPR apart is enforcement. Penalties reach up to 4% of total worldwide annual revenue. European data regulators issued a record €2.92 billion in fines in a single year, up 168% year-over-year, with Meta the hardest hit (source: Forbes).
Companies affected:
- Amazon — €746 million ($877 million)
- Facebook/Meta — €265 million ($275 million)
- WhatsApp — €225 million ($255 million)
- Google Ireland — €90 million ($102 million)
- British Airways — €22 million ($26 million)
The British Airways fine is particularly relevant because it resulted from a cyber attack — not a data handling policy violation. Regulators apply severe penalties for inadequate technical security measures, not just willful misuse of data.
How MainTegrity CSF addresses GDPR:
- Article 32 — Security of Processing: FIM+ continuously monitors mainframe datasets for unauthorized changes to personal data. When modifications occur, FIM+ detects them immediately through cryptographic signature comparison, generates alerts, and records the event with full attribution — providing the "appropriate technical measures" evidence GDPR requires.
- Article 33 — 72-Hour Breach Notification: When a breach occurs, GDPR gives you 72 hours to notify the supervisory authority with specifics — the nature of the breach, categories of data subjects affected, likely consequences, and measures taken. FIM+ forensics provide this information immediately, not after weeks of manual investigation.
- Article 32 — Recovery Capability: GDPR requires the ability to restore availability and access to personal data in a timely manner. CSF's Restore Assist enables rapid recovery of both data and software infrastructure — because recovering data alone isn't enough. Without the software infrastructure, recovery can take weeks.
NetWatch monitors network connections to detect data exfiltration attempts, providing protection against unauthorized transfer of personal data outside the organization.
References: gdpr-info.eu | ISO 27001 Information Security