Protecting Data on Tapes

DFSMShsm provides three basic methods for protecting tape volumes under its control. You can choose more than one tape protection option.

RACF®: DFSMShsm protects each tape backup volume, dump tape volume, and tape migration level 2 (ML2) volume with RACF. The tape volume is RACF protected when the tape is first written. DFSMShsm protects the tape volume with RACF by adding the volume to the RACF tape volume set for DFSMShsm. All tape volumes in the RACF tape volume set for DFSMShsm share the same access list and auditing controls. Protection of the tape volume is removed when the tape becomes empty and is returned to scratch status.
Expiration date: If you use expiration date protection, DFSMShsm protects each tape backup volume, dump tape volume, tape ML2 volume, and aggregate tape volume with an expiration date. DFSMShsm places an expiration date of 99365 (means that the date never expires) in the IBM® standard data set label 1 unless specified otherwise by a DFSMShsm parameter or installation exit.
Password: If you use password protection, DFSMShsm causes each backup, dump, or migration tape to be password indicated. The password indication is placed in the security byte in the IBM standard data set label 1.
Recommendation: IBM does not recommend the use of data set password protection because it provides less protection than the use of RACF. See z/OS DFSMSdfp Advanced Services for a discussion of password protection and the reasons to not use it.