Performing Recovery Operations › Recovery Operational Considerations

Recovery Operational Considerations

When you implement CA Tape Encryption, consider the following points for performing recovery operations:

• Ensure that the tape files written as part of the backup processing for system residence volumes and other essential system volumes are not encrypted.
• CA Tape Encryption must be included in the list of essential components that are to be recovered before you run any application jobs.
• The backup copy of the mirror database must not be encrypted because it must be read before the BES subsystem can be started. The data contained in the primary and mirror databases is already encrypted to protect their contents.

  Note: The BESDBBAK member of the CTAPJCL data set contains a model job that should be used to back up the mirror database.

• ICSF is always required on your primary system and any disaster recovery systems that run on a z800 or z900 processor, and is optional on all z890, z990, and z9 processors. In an emergency situation, you can run on a z800 or z900 system without ICSF if only AES128, AES192, or AES256 algorithms are in use. CA Tape Encryption provides software implementations of these algorithms, however, they do not perform as well as the hardware implementations.
  • If you have elected to save symmetric keys in the ICSF CKDS, you must also recover the CKDS or use the TBEMIGRT utility.
  • For information about using TBEMIGRT, see How Key Management for Disaster Recovery Backup Works.
  • You should specify the following ICSF option when setting up and configuring ICSF:

    CHECKAUTH(NO)
    

    For information about the CHECKAUTH option, see the chapter “Managing Operations.”