mainframe vulnerability patch or ptf level equivalent information

Over the past years, there have been a regular discussion with our internal auditors about the state (and value) of a vulnerability test for the mainframe.

With each audit, the internal auditors have elevated their assessments deeper and deeper into the controls that exist with the z/OS architecture; and with some context, their requests attempts to align what exist in the distributed world that is of

In the last internal audit, there was a finding by the internal auditors that there is a lack of vulnerability test for the mainframe platform. More specifically, the auditors are looking for an independent validation to assess, test and validate that the mainframe z/OS infrastructure (and likely, in the future, the other infrastructure technology products like IMS, CICS, MQ, DB2, WAS/z) have the correct level of patch maintenance as well as a version that is supported by the vendor. From a patch maintenance perspective, the audit's requirements was to ensure that any security vulnerability patches have been applied. The internal auditors are fully aware of the process that the z/OS system programmers perform where we apply z/OS maintenance to our LPARs on a quarterly basis, we subscribe to the IBM Security bulletin board.

Our requirement is in two folds….
a) A command or module in z/OS that will identify the i) z/OS version and ii) PUT or RSU level plus any PTFs that is identified in the IBM security bulletin board
b) Extract information for an IBM site that will provide the supportable version(s) of z/OS (from our side, n and n-1 would be sufficient, since we rarely be at n-2 from the latest version of z/OS) as well as the PUT or RSU levels with available dates