IBM Security Z Security

First, check the SYSPRINT of your STIG evaluation run, to see if another CKFREEZE was included, or added to the CKFREEZE you wanted.  I have seen this message when an active CKFREEZE was magically added for the current system, due to a conflict in the COMPLEX value specified for the CKFREEZE and RACF data source.  An active CKFREEZE does not use a CKFREEZE data set, but dynamically retrieves some information from common storage during the CARLa run.  Obviously, it does not read (system) data sets.

This happens, for example, when you use a CKFREEZE that was collected on another LPAR, you use the active RACF database, or an UNLOAD that was not from the same LPAR as the CKFREEZE, and you forgot to link the two using a COMPLEX name in SE.1.

If this doesn't help, inspect the CKFREEZE data set you used as input.  Select the set(s) that you use for the STIG run from SE.1, then go to option IN.F.  This reads the relevant info from the input files.  The CKFREEZE entry has the CKFCOLL commands used to write the data set.

Thanks Rob.  I think you are on the right track saying that another CKFREEZE file is being used based on the messages below.  the full file I created was in job CNACOPY and then the second CKFREEZE file was created by CKNSERVE.

CKR0132 00 Reading configuration for system PRD1 iplvol RSPRDC from CKR1CF00 SHR398 SHR347 SHR276 SHR149 SHR053 ITSSECP.RACF.
           running IBM CORP z/OS 3.1.0 DFSMS 3.1.0 JES2 HJE77E0 RACF HRF77E0 TSO 5.1.0 HSM  3.1.0 on z/Architecture          
           created by program CKFCOLL 3.1.0 4Z196 230704083 job CNACOPY  at 11 Feb 2026 08:05:12.94 (APF)                    
                                                                                                                             
-PRD2HOST->CKN197I 00 Remote server file name CKNCKFA1 used for TYPE=CKFREEZE ACTIVE for SV0001CF of PRD2HOST client 287 job 
CKR0132 00 Reading configuration for system PRD2 iplvol RSPRDC from SV0001CF Remote input from ZSECSYS PRD2HOST              
           running IBM CORP z/OS 3.1.0 DFSMS 3.1.0 JES2 HJE77E0 RACF HRF77E0 TSO 5.1.0 HSM  3.1.0 on z/Architecture          
           created by program CKFCOLL 3.1.0 4Z196 230704083 job CKNSERVE at 11 Feb 2026 09:03:12.84 (APF)                    

How would I specify that I only want the file from CNACOPY to be used for this?  

Thanks!

PRD2HOST->CKN197I 00 Remote server file name CKNCKFA1 used for TYPE=CKFREEZE ACTIVE

This will be your culprit.  If you run your reports from ISPF, you normally use SE.1 to specify the input files.  Put your RACF data source and the CKFREEZE data set name in one Set of input files entry, and specify a value in the COMPLEX field for the entry.  Make sure there is only one Set selected.

If you run your reports in a batch job, ensure there is one ALLOC TYPE=CKFREEZE DSN=xxx COMPLEX=yyy ZSECNODE=zzzz and one ALLOC TYPE={RACF|UNLOAD} DSN=rrr COMPLEX=yyy ZSECNODE=zzzz so with the same COMPLEX.

Thanks again Rob!  that did the trick, I appreciate you!