## RMF Support for Crypto Express6 

RMF enhances the Monitor I Crypto Activity data gatherer to recognize and exploit performance data for the new Crypto Express6 (CEX6) card. RMF supports all valid card configurations on z14 and provides CEX6 crypto activity data in the SMF type 70 subtype 2 records and RMF Postprocessor Crypto Activity Report. 

Reporting can be done at an LPAR/domain level to provide more granular reports for capacity planning and diagnosing problems. This feature requires fix for APAR OA54952. 

The supported operating systems are listed in Table 7-10 on page 259. 

## z/OS Data Set Encryption 

Aligned with IBM Z Pervasive Encryption initiative, IBM provides application-transparent, policy-controlled dataset encryption in IBM z/OS. 

Policy driven z/OS Data Set Encryption enables users to perform the following tasks: 

GLYPH<SM590000> De-couple encryption from data classification; encrypt data automatically independent of labor intensive data classification work. 

GLYPH<SM590000> Encrypt data immediately and efficiently at the time it is written. 

GLYPH<SM590000> Reduce risks that are associated with mis-classified or undiscovered sensitive data. 

GLYPH<SM590000> Help protect digital assets automatically. 

GLYPH<SM590000> Achieve application transparent encryption. 

IBM Db2 for z/OS and IBM Information Management System (IMS) intend to use z/OS Data Set Encryption. 

With z/OS Data Set Encryption DFSMS enhances data security with support for data set level encryption by using DFSMS access methods. This function is designed to give users the ability to encrypt their data sets without changing their application programs. DFSMS users can identify which data sets require encryption by using JCL, Data Class, or the RACF data set profile. Data set level encryption can allow the data to remain encrypted during functions, such as backup and restore, migration and recall, and replication. 

z/OS Data Set Encryption requires CP Assist for Cryptographic Functions (CPACF). For protected keys, it requires z196 or later Z servers with CEX3 or later. The degree of encryption performance improvement is based on the encryption mode that is used. 

Considering the significant enhancements that were introduced with z14, the encryption mode of XTS is used by access method encryption to obtain the best performance possible. It is not recommended to enable z/OS data set encryption until all sharing systems, fallback, backup, and DR systems support encryption. 

In addition to applying PTFs enabling the support, ICSF configuration is required. The supported operating systems are listed in Table 7-10 on page 259. 

## Crypto Analytics Tool for Z 

The IBM CAT is an analytics solution that collects data on your z/OS cryptographic infrastructure, presents reports, and analyzes if there are vulnerabilities. CAT collects cryptographic information from across the enterprise and provides reports to help users better manage the crypto infrastructure and ensure it follows best practices. The use of CAT can help you deal with managing complex cryptography resources across your organization. 

