CICS command security

CICS® command security controls the use of system programming commands; that is, commands that require the special CICS translator option, SP.

Introduction to command security
CICS command security applies to system programming commands; that is, commands that require the special CICS translator option, SP. Security checking is performed for these commands, when they are issued from a CICS application program, and for the equivalent commands that you can issue with the CEMT main terminal transaction.
CICS resources subject to command security checking
For transaction and resource security checking, you identify the resources to RACF® using the identifiers that you have assigned to them; for example, file names, queue names, and transaction names. However, in the case of command security, the resource identifiers are all predefined by CICS, and you use these predefined names when defining resource profiles to RACF.
Parameters for specifying command security
In addition to the SEC and SECPRFX system initialization parameters, CICS provides the XCMD system initialization parameter and the CMDSEC attribute on the TRANSACTION resource definition option to enable you to specify that you want command security.
Security checking of transactions running under CEDF
When a transaction is run under the CEDF transaction, CICS takes into account the security settings for the target transaction only.
CEMT considerations
In general, the resources that the CICS-supplied CEMT main terminal transaction operates on are the same as the equivalent system programming commands.
Authorization failures in application programs
CICS returns a RESP2 value of 100 for command security failures, a value of 101 for resource security failures, and a value of 102 for surrogate security failures.

Parent topic: Implementing RACF protection in a single CICS region