Implementing Pervasive Encryption on z/OS

Encrypt each z/OS dataset with a key label tied to an ICSF key in the CKDS, enabling policy-driven encryption via data classes or profiles.

Encrypt extended format datasets such as PDSE, extended VSAM, extended sequential, and zFS datasets. Encrypting non-extended VSAM or PDS remains unavailable, though future z/OS versions may change this.

Encrypt by policy on z/OS using DFSMS data classes or RACF dataset profiles, rather than applying DSKEYLBL to individual datasets, for stronger protection than full-disk encryption.

Encrypt at-rest data on tape via tape subsystem and coupling facility, enabling multiple encrypted datasets on a tape with keys, but no encrypted and non-encrypted data on the same tape.

Explore options for encrypting z/OS data at rest beyond disk and tape, including JES2 spool encryption via key label, RACF JESJOBS policy, and database datasets for Db2 and IMS.

Examine the encryption pyramid for data at rest, balancing coverage from full disk and tape to dataset and database encryption with granularity, and consider application encryption.

Review the data-at-rest encryption options, from application-level selective encryption to full disk encryption, and identify where ASPG MegaCryption and disk dataset policies fit within pervasive encryption on z/OS.

Explore in-flight encryption on z/OS, including coupling facility data encryption and the z/OS–coupling facility link, with IBM Fibre Channel Endpoint Security for disks, but no tape channel option.

Assess why you encrypt on z/OS and select a tailored toolbox of options, such as dataset encryption, coupling facility encryption, ssl/tls, and ipsec. Begin with the most critical data.