Using Your Security System › Security Profiles › Data Set Selection Profiles › Data Set Exclusion Using DONOTENCRYPT

Data Set Exclusion Using DONOTENCRYPT

When using BES.DEFAULT all output tape data sets will selected and encrypted using the default encryption parameter. However, certain data sets should be excluded from this process, such as the CA Tape Encryption data base. To exclude these data sets you need to create a data set selection profile using DONOTENCRYPT on the encryption parameter. When DONOTENCRYPT is detected, CA Tape Encryption will not process the data set. Use the following format to define this encryption parameter:

BESn=(DONOTENCRYPT)

n

Specifies an identifying number for a CA Tape Encryption subsystem other than BES1.

You can define DONOTENCRYPT as your default encryption profile on BES.DEFAULT and then define additional discrete, generic, or fully-qualified data set selection profiles to limit encryption to those defined. One advantage of using this method is to override your DFSMS ACS routines and ensure all data sets encrypted are based on security data set selection profiles.