What's new in CICS TS 6.2?

Release highlights

All the enhancements at a glance

Some enhancements are shown under more than one category; the information is the same in all cases.

Service indicates that the capability is available through APAR after the General Availability of CICS TS 6.2.

For the developer experience

Support for Java 25

Service Available with APAR PH69930.

CICS supports Java 25 using IBM® Semeru Runtime® Certified Edition for z/OS. A minimum version of 25.0.1.0 is required.

Calling CICS services on virtual threads is not supported.

Java 25 is not supported for use with SAML JVM servers at all CICS releases.

To enable Db2® type 2 connectivity when you are running Java 25, add LIBPATH_SUFFIX=/usr/lpp/db2v13/jdbc/lib to the JVM profile.

Java 8, Java 11, Java 17 and Java 21 continue to be supported.

Learn more about CICS and Java.

Support for Java 21

Service Available with APAR PH64035.

CICS supports Java 21 using IBM Semeru Runtime Certified Edition for z/OS. A minimum version of 21.0.4.0 is required.

Calling CICS services on virtual threads is not supported.

Java 21 is not supported for use with SAML JVM servers at all CICS releases.

To enable Db2 type 2 connectivity when you are running Java 21, add LIBPATH_SUFFIX=/usr/lpp/db2v13/jdbc/lib to the JVM profile.

Java 8, Java 11 and Java 17 continue to be supported.

Learn more about CICS and Java.

Support for Java 17

This release adds support for Java 17 using IBM Semeru Runtime Certified Edition for z/OS. A minimum version of 17.0.7.0 is required.

Java 17 is not supported for use with SAML JVM servers at all CICS releases. To enable Db2 type 2 connectivity with Java 17, add LIBPATH_SUFFIX=/usr/lpp/db2v13/jdbc/lib to the JVM profile.

Java 8, Java 11 and Java 17 continue to be supported.

Learn more about CICS and Java.

Support for Jakarta Enterprise Edition 10

Service Available with APAR PH60795.

The CICS Liberty JVM server now supports Jakarta Enterprise Edition (EE) 10.

This capability is also available on CICS TS 6.1 with APAR PH60795.

Learn more about Liberty features supported for Jakarta EE 10.

Support for Spring Boot 3

Service Available with APAR PH60795.

Developers can use the latest features in Spring Boot 3 to build modern and lightweight applications with optimized access to CICS services and data.

This capability is also available on CICS TS 6.1 with APAR PH60795.

Learn more about Spring Boot applications.

Enhanced container support

CICS API, EXCI, JCICS API and JCICSX API support prepending data to the existing data in a container. New option PREPEND is introduced on PUT CONTAINER (CHANNEL), PUT64 CONTAINER, and PUT CONTAINER (EXCI) commands. New methods prepend() and prependString() are introduced to the JCICS container class. New methods appendWith(), prepend(), and prependWith() are introduced to JCICSX classes BITContainer and WritableBITContainer and a new method prepend() is introduced to JCICSX classes CHARContainer, WritableCHARContainer, and WritableContainer.

Learn more about transferring data between programs using channels.

Support for Node.js 18

Developers can use Node.js 18 to build microservices and web applications using the latest JavaScript features and frameworks, with optimized access to CICS TS programs with the ibm-cics-api API. This support requires IBM Open Enterprise SDK for Node.js.

Learn more about developing Node.js applications.

Support for Node.js 24

Developers can use Node.js 24 to build microservices and web applications using the latest JavaScript features and frameworks, with optimized access to CICS TS programs by using the ibm-cics-api API. This support requires IBM Open Enterprise SDK for Node.js 24.

Learn more about Developing Node.js applications.

Support for Liberty collectives

In a system that hosts multiple Liberty servers, including Liberty JVM servers, it can be useful to manage and monitor these servers, and their applications, from a centralized administrative control point.

Learn more about collectives for Liberty servers.

Improved experience in CICS Explorer for Gradle and generated CICS bundles

CICS Explorer users can now right-click on a Gradle or Maven project and use wizards to create bundle parts: for example, policies or FILE resource definitions.

Learn more about what's new in CICS Explorer.

Support for MicroProfile 6.0 and MicroProfile 6.1

Developers can use the latest features in MicroProfile 6.0 and MicroProfile 6.1 to build resilient, secure and easy to monitor microservices.

Learn more about Developing microservices with MicroProfile .

For system management

New DFHRL messages for GRPLIST installation of BUNDLE resources

New messages DFHRL0137I and DFHRL0138W indicate whether all GRPLIST-defined BUNDLE resources are installed and reached their target status, as defined by the STATUS attribute on their BUNDLE resource definitions. The new messages help you to determine when a CICS region is open for business and ready for workload to be routed its way.

DFHRL0137I indicates a successful GRPLIST installation of BUNDLE resources that are at their target initial status. DFHRL0138W is issued if one or more BUNDLEs failed to be installed; you can refer to previous DFHAM4938 messages to identify the failed BUNDLEs.

New DFHKE messages for vendor tables

The following new DFHKEnnnn messages are issued to indicate the status of vendor tables:

• DFHKE0010 indicates that a vendor table is successfully loaded.
• DFHKE0011 indicates that a vendor table has invalid content.
• DFHKE0012 indicates that a module in a vendor table cannot be loaded.
• DFHKE0013 indicates a conflict between two vendor tables.

Enhanced support for GRPLIST

You can now retrieve GRPLIST in a number of ways:

• Regions view of CICS Explorer
• CEMT INQUIRE SYSTEM
• INQUIRE SYSTEM SPI command
• CICSPlex SM CICS region (CICSRGN) view

This enhancement provides you with alternatives to obtain the names of the lists containing resource definition groups that are loaded during system initialization for a CICS cold start.

Learn more about the GRPLIST system initialization parameter.

Enhancements to CICS policies

• New option to set the WLMHEALTH time interval is supported by the Set z/OS WLM health open status system rule action.

  You can now change the region's WLMHEALTH time interval as part of the system rule action. This enhancement makes it easier for you to manage the z/OS WLM health of a CICS region by using a variety of policy system rules.

  This capability is also available on CICS TS 6.1 with APAR PH58295.

  Learn more about managing availability of your system by using a group of system rules.

• A new system rule, transaction class queued tasks, monitors when the number of tasks queuing for membership to a TRANCLASS approaches the TRANCLASS purge threshold and enables CICS to take a policy action in response. This policy system rule can give you an early warning on the situation and take precautionary measures.

  Learn more about the transaction class queued tasks system rule.

• Service CICS policies that have an action to issue a message to the CSSL destination now also send the message to the system console.

  This enables system automation products that monitor the CICS system console to take further action when these messages are issued.

  This capability is also available in CICS TS 6.1 with APAR PH62711 and CICS TS 5.6 with APAR PH62710.

  Learn more about policy system rules.

Health check on stabilized functions

Out-of-date technology inside CICS TS for z/OS is often stabilized and might be reduced in capability or discontinued in a future release. Stabilized functions that are still in use might expose CICS to potential risks, reduction of performance, or constraints in capability. It is highly recommended that you upgrade to modern technology and functions and make the most of new CICS capabilities.

A new health check, CICS_STABILIZED_FUNCTIONS can alert you to the use of outdated, stabilized technology and functions in your CICS regions.

Learn more about CICS_STABILIZED_FUNCTIONS health check.

Resilience to surging requests for TRANCLASS-managed transactions

Transaction classes control the maximum number of tasks that can be dispatched and queued for transactions that belong to an active transaction class. In an ideal situation, a CICS region with well-tuned transaction classes handles workloads by dispatching and queuing tasks so that requests are served within an expected response time. However, in an abnormal situation - for example, if tasks have built up as a result of a slow-down or a surge of requests into the CICS region - further requests are purged according to the PURGETRESH of the TRANCLASS and transaction abends occur. CICS TS 6.2 introduces several enhancements including the capability to monitor queued tasks so that you are aware of the situation and the option to control TRANCLASS purge actions.

A new system rule, transaction class queued tasks, monitors when the number of tasks queuing for membership to a TRANCLASS approaches the TRANCLASS purge threshold and enables CICS to take a policy action in response. This policy system rule can give you an early warning on the situation and take precautionary measures.

Instead of resolving to the purge action of an AKCC abend as it did in previous CICS releases, CICS TS 6.2 can discard a request to start a transaction when its associated TRANCLASS has reached the purge threshold. This avoids unnecessary transaction abends that would otherwise occur and consume even more from a constrained system. To support this enhancement, the TRANCLASS resource definition has a new attribute PURGEACTION through which you can set the purge action to DISCARD or ABEND. CICS API, SPI, and statistics have been enhanced to support PURGEACTION. In a workload routing environment, it is important to ensure a consistent use of purge action for a workload. See the queue algorithm and the link neutral queue algorithm.

Learn more...

• Transaction class queued tasks system rule
• TRANCLASS resources
• Using PURGETHRESH and PURGEACTION

CICSPlex® SM can now process type 71 ENF events for a CICSplex

This enhancement can help to reduce a significant amount of system overload that would otherwise occur for processing high volume of type 71 ENF events.

RACF sends a type 71 ENF signal to listeners when a CONNECT, REMOVE, or REVOKE command changes a users’ resource authorization, or when a user ID is revoked as a result of too many failed password attempts. A CMAS can now listen for type 71 ENF events and make type 71 ENF event data available for its connected MAS regions to consume. This means that MAS regions can obtain type 71 ENF event data directly from the owning CMAS, without the need to register as a type 71 ENF event listener themselves.

A new option, CPSM, is introduced on the RACFSYNC system initialization parameter. A MAS region must be started with RACFSYNC=CPSM so that it does not register as a type 71 ENF event listener but still processes type 71 ENF event data obtained from its connected CMAS.

For CICSPlex SM security, when a CMAS region that is set with RACFSYNC=YES receives a type 71 ENF event, security information for the affected user ID is rebuilt the next time the user ID is used, irrespective of the setting of the SECTIMEOUT parameter.

Learn more about the RACFSYNC system initialization parameter.

CICS opens TCPIPSERVICE automatically after a TCP/IP restart

Available with z/OS 2.5 and higher, ENF event code 80 signals when a TCP/IP stack and its extended services have been fully initialized. CICS can now respond to ENF 80 events and automatically set the TCPIPSERVICE status back to OPEN if it was set to CLOSED as a result of an outage of TCP/IP.

Learn more about z/OS Communications Server: Using ENF event code 80 to notify applications of complete initialization of the TCP/IP stack and extended services.

Integration of CICS and CICSPlex SM shutdowns

You can now use PERFORM SHUTDOWN and PERFORM SHUTDOWN IMMEDIATE, or their CEMT equivalents, directly on CMAS and MAS regions. In processing the command, CICS shuts down the CMAS or stops the MAS agent code as part of the shutdown process. The integration of CICS and CICSPlex SM shutdowns makes system management of CICSPlex SM environments easier.

Learn more about PERFORM SHUTDOWN.

Monitoring use of CICSPlex SM Data Repository

You are now alerted when the CICSPlex SM Data Repository EYUDREP exceeds 70% of its capacity so that you have time to review the space allocation for the data set to ensure that it has sufficient capacity for intended system operations.

The owning CMAS issues message EYUXD1032 when EYUDREP exceeds 70% of its available extents in either of its DATA or INDEX components.

Learn more about sizing and expanding the CICSPlex SM data repository.

Suppress SMF records with zero-counting fields

Transaction and Program statistics that contain zero count fields following a reset are suppressed for interval, requested, and requested reset type statistics. This reduces SMF volume at most of the times that CICS statistics are being generated, retaining the ability to use CICS statistics as a way to inventory CICS resources.

Learn more about reset characteristics of statistics counters.

Updated CMCI JVM server requirements

CMCI JVM server now requires Java version 11 or later.

Learn more about configuring the CMCI JVM server for the CICS bundle deployment API.

Expanded Ansible® IBM z/OS CICS collection to automate CICS resource and region actions

CICS TS 6.2 extends the IBM z/OS CICS collection that was introduced in CICS TS 6.1 (see Ansible IBM z/OS CICS collection to automate CICS resource and region actions). In addition to the Ansible modules for working with the CICS TS system management CMCI REST API, the collection now provides a set of modules for provisioning and managing CICS TS data sets and utilities. You can use these Ansible modules to create automation tasks for CICS region provisioning operations and for CICS startup and shutdown operations. Sample playbooks show you how to do this with the latest version of the Ansible IBM z/OS CICS collection.

The IBM z/OS CICS collection is developed as an open-source project at IBM z/OS CICS collection GitHub and is available on Ansible Galaxy and Ansible Automation Hub.

Learn more about IBM z/OS CICS collection.

Operator for CICS integration with Red Hat® OpenShift® Container Platform

IBM CICS Transaction Server Operator Collection (CICS TS Operator Collection) can drive Ansible CICS region provisioning through the Red Hat OpenShift Container Platform interface. Through z/OS Cloud Broker and CICS TS Operator, you can provision an instance of a CICS TS region and manage CICS TS resources from Red Hat OpenShift Container Platform.

Learn more about IBM CICS TS Operator.

CICS TS resource builder is provided as a container image

Service Available with CICS TS resource builder 1.0.4.

CICS TS resource builder is a command-line tool to facilitate configuration as code for CICS resources. Version 1.0.4 is available as a container image for Linux®® AMD64 and z/OS® s390x.

Learn more about CICS TS resource builder.

Prepare for a future release of CICS TS

Service Available with APAR PH66142.

The DFHCSVC and DFHIRP modules for future CICS TS releases have been shipped as modules DFHNCSVC and DFHNIRP on current releases ahead of the general availability of the newest CICS TS release. If you wish to install the future release modules DFHCSVC and DFHIRP to fit in with your scheduled z/OS IPLs, follow the instruction in Installing newest release CICS Type 3 SVC and DFHIRP modules supplied through maintenance.

For security

Zero trust enhancements

To conform with a zero trust strategy and various compliance regulations such as PCI-DSS, you need to protect your sensitive data. In CICS this means enabling resource security and command security in regions where sensitive data exists, and configuring RACF with profiles to protect your resources so that they can only be accessed by users who have a business reason to do so. The user needs to be connected to a group (role) that needs access to one or more transactions and other resources that represent an application.

CICS provides security discovery for easier migration to zero trust, enables command and resource security for both CICS and user transactions to conform with zero trust, and eases maintenance of zero trust with security definition capture (SDC) and security definition validation (SDV).

• Use CICS security discovery to identify security definitions that are required for resource security in production regions.

  With security discovery, you analyze RACF® definitions, optionally with usage data (security discovery data) by using the Security Discovery perspective in CICS Explorer and convert the resulting security metadata back to RACF commands to implement resource security. Currently it has some restrictions.

  You can work with SDD using the Security Discovery Records view in CICS Explorer or the INQUIRE SECDISCOVERY, PERFORM SECDISCOVERY WRITE, and SET SECDISCOVERY SPI commands.

  Learn more about CICS security discovery.

• After implementing required security definitions, enable command security (CMDSEC) and resource security (RESSEC) in production.

  All CICS transactions, excluding CJXA and CICSPlex SM transactions (CO**), are defined with CMDSEC(YES) and RESSEC(YES) to conform with this practice.

  Existing user transaction definitions stay unchanged, but new transaction use CMDSEC(YES) and RESSEC(YES) by default.

  You must review and update security definitions for potential command and resource security checking. For instructions, see Review security definitions for command and resource security implementation.

  Learn more ...

  • CICS transactions subject to security checking
  • TRANSACTION resources

• Use CICS security definition capture (SDC) to capture security definitions that are required for command and resource security, even during development.

  After you have migrated to a zero trust strategy, you can identify and implement required changes to security definitions when there's a code change before pushing the changes to a production region with full CICS security.

  You can further automate and integrate that process into your CI/CD (continuous integration/continuous delivery) pipeline as part of a DevSecOps approach. CICS offers an example implementation of a full CI pipeline, known as security definition validation (SDV).

  See also Security Definition Validation for CICS TS example implementation.

• Service Use the example implementation, Security Definition Validation for CICS TS (SDV), to see how you might introduce CICS application security testing into a CI/CD pipeline.

  If an application code change request in the pipeline flow results in a change to the security definitions that are required for that application to run, an approval process is initiated and must be approved by a security administrator. The application code change request is blocked until the security administrator approves it.

  SDV is not part of CICS TS, nor is it an installable product. It is an example implementation of security definition validation that uses the security definition capture capability in CICS TS 6.2 onwards.

  Learn more about capturing and validating security definitions during the development process.

TLS enhancements

• Default cipher suite specification file for outbound web requests.

  The com.ibm.cics.web.defaultcipherfile feature toggle is extended to apply to URIMAP resources with no ciphers specified.

  Message DFHWB1561 is issued to indicate that a URIMAP defined with CIPHERS() is being installed and list the ciphers that CICS uses instead.

  This capability is also available in CICS TS 6.1 with APAR PH60212.

  Learn more about feature toggles.

• SIT parameter CERTEXPIRYWARN allows CICS to warn about expiring certificates in the certificate chain.

  The new CERTEXPIRYWARN SIT parameter allows CICS to warn about such expiring certificates so that you can take action before the certificate expires and the TLS connection fails.

  CERTEXPIRYWARN checks only certificates that are sent by the partner system through TLS connections. For CICS managed certificates, that is, certificates defined in RACF, use the RACF_CERTIFICATE_EXPIRATION check provided by IBM Health Checker for z/OS instead.

  When CERTEXPIRYWARN is enabled in web owning regions, CICS issues message DFHSO1100I when the certificate is about to expire within a specified range of days. CICS also issues a trace entry if the SO trace level is set to 2.

  Learn more about CERTEXPIRYWARN.

• Key rings can be more easily shared between CICS regions.

  KEYRING system initialization parameter accepts more formats of key ring name so that you can use key rings that are not owned by the current region user ID.

  This capability is also available in CICS TS 5.5 and CICS TS 5.6 with APAR PH49253, and CICS TS 6.1 with APAR PH49261.

  Learn more about the KEYRING system initialization parameter.

• Minimum key size used during TLS handshakes is increased.

  For increased key strength, CICS uses a minimum key size of 256 for ECC keys and 2048 for RSA, DSA and Diffie-Hellman keys during TLS handshakes. You must increase the key sizes within your certificates. Otherwise, the TLS handshake fails and message DFHSO0123 is issued with a return code of 508.

  To continue using a small key size, set feature toggle com.ibm.cics.tls.minimumkeystrength=1024. This feature toggle allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes. This feature toggle is also available in CICS TS 5.4, 5.5, and 5.6 with APAR PH50175, and CICS TS 6.1 with APAR PH51719.

  Learn more about increasing the minimum key size for TLS connections.

• Sysplex caching for TLS 1.3 is supported.

  Sharing information about the SSL session across different CICS regions in a sysplex is particularly useful when HTTP requests are being routed across a set of CICS regions by using TCP/IP connection workload balancing techniques, such as TCP/IP port sharing or Sysplex Distributor. CICS now supports sysplex caching for TLS 1.3 in addition to previous support for sysplex caching in earlier versions of TLS.

  Learn more about the SSLCACHE system initialization parameter.

• HTTP strict transport security (HSTS) is supported.

  HTTP strict transport security (HSTS) helps servers prevent man-in-the-middle attacks by instructing compliant user agents to only interact with the server through secure connections (HTTPS).

  You can now configure a CICS server to use HSTS with a set of com.ibm.cics.web.hsts feature toggles.

  This feature is also available in CICS TS 5.5 and CICS TS 5.6 with APAR PH55369, and CICS TS 6.1 with APAR PH55370.

  Learn more about support for HSTS.

New options on SIGNON, CHANGE PASSWORD, and CHANGE PHRASE reveal more sign-on information

New options CHANGETIME, DAYSLEFT, EXPIRYTIME, INVALIDCOUNT, and LASTUSETIME are added to SIGNON, CHANGE PASSWORD, and CHANGE PHRASE commands. These options reveal more sign-on information, for example, the last time the password or password phrase was changed, the last time the user ID was accessed, when the password or password phrase will expire, and the number of times when an invalid password or password phrase was entered.

Messages DFHCE3549 and DFHSN1100 are also updated to show the number of previous failed attempts to sign on, and the date and time the user ID was last accessed.

The new options on CHANGE PASSWORD and CHANGE PHRASE are also available in CICS TS 5.5 and 5.6 with APAR PH59546, and 6.1 with APAR PH59547.

New options on XPPT allow you to secure remote programs at a lower cost

A new option DPLONLY is added to the XPPT system initialization parameter. By specifying DPLONLY on XPPT (XPPT=(YES,DPLONLY) or XPPT=(class_name,DPLONLY)), CICS checks only the first program that is linked by the mirror program (DFHMIRS) during distributed program link (DPL). This can reduce the security cost while retaining control over remotely linked programs.

The ALL (default) option maintains the behavior in CICS TS 6.1 and earlier. When ALL is specified over DPLONLY, CICS performs the security check on all invoked programs.

Learn more about security for CICS programs.

Command security checking removed for INQUIRE TERMINAL, INQUIRE NETNAME, and SET TERMINAL when programs or tasks inquire on or set their own terminals

For INQUIRE TERMINAL, INQUIRE NETNAME, and SET TERMINAL, command security checking is not performed if the task or program that issues the command was started or attached to the same terminal that is being inquired or modified by the command, with a few exceptions. This is because resource security checking was already performed on the terminal when the program or task was started or attached to the terminal. With this enhancement, programs or tasks that inquire or set their own terminals won't need full access to these commands. Therefore, it not just simplifies the security management, but also improves security by avoiding granting more access than is necessary.

Learn more about CICS resources subject to command security checking.

Enhancements to surrogate security for JCL job submissions to the JES internal reader

Surrogate security for JCL job submissions to the internal reader is now streamlined under the control of the XUSER system initialization parameter and is enabled by default. As a result, the com.ibm.cics.spool.surrogate.check={true|false} feature toggle is removed.

A new system initialization parameter, INTRDRJOBUSER is introduced. It specifies a default job user ID to be used when you submit a JCL job using SPOOL commands and the JOB card does not specify the USER parameter. The default of INTRDRJOBUSER is to use the task user ID, but you can specify INTRDRJOBUSER=REGION to use the CICS region user ID instead. The INTRDRJOBUSER system initialization parameter replaces the feature toggle com.ibm.cics.spool.defaultjobuser={region|task}.

Learn more about security for submitting a JCL job to the internal reader.

Mandatory initialization parameters for WUI or SMSSJ if security is active

For a CICSPlex SM WUI server (CPSMCONN=WUI), TCPIPSSL is now mandatory if security is active.

For a CICS System Management Single Server (SMSS) defined with CPSMCONN=SMSSJ, CMCISSL is mandatory if security is active.

Learn more ...

• WUI initialization parameters in EYUWUI data set
• Specifying CMCI and TCP/IP options for the SMSS

CICSPlex SM can now process type 71 ENF events for a CICSplex

This enhancement can help to reduce a significant amount of system overload that would otherwise occur for processing high volume of type 71 ENF events.

RACF sends a type 71 ENF signal to listeners when a CONNECT, REMOVE, or REVOKE command changes a users’ resource authorization, or when a user ID is revoked as a result of too many failed password attempts. A CMAS can now listen for type 71 ENF events and make type 71 ENF event data available for its connected MAS regions to consume. This means that MAS regions can obtain type 71 ENF event data directly from the owning CMAS, without the need to register as a type 71 ENF event listener themselves.

A new option, CPSM, is introduced on the RACFSYNC system initialization parameter. A MAS region must be started with RACFSYNC=CPSM so that it does not register as a type 71 ENF event listener but still processes type 71 ENF event data obtained from its connected CMAS.

For CICSPlex SM security, when a CMAS region that is set with RACFSYNC=YES receives a type 71 ENF event, security information for the affected user ID is rebuilt the next time the user ID is used, irrespective of the setting of the SECTIMEOUT parameter.

Learn more about the RACFSYNC system initialization parameter.

Monitoring and statistics fields to audit QUERY SECURITY LOGMESSAGE(NOLOG) requests

The QUERY SECURITY command allows you to query the security authorization of a user to access a resource. For enhanced protection against brute-force attacks, new monitoring and statistics fields are introduced so that you can still monitor the QUERY SECURITY requests even when violation messages are inhibited:

• The statistics field XSG_AUTHOR_FAIL_NL_NA (DFHSTUP name Failed authorizations NOLOG NOTAUTH) and monitoring field XSNLNACT to record the number of QUERY SECURITY LOGMESSAGE(NOLOG) requests that succeeded but returned no authority on READ, UPDATE, CONTROL or ALTER.
• The statistics field XSG_AUTHOR_FAIL_NL_NF (DFHSTUP name Failed authorizations NOLOG NOTFND) and monitoring field XSNLNFCT to record the number of QUERY SECURITY LOGMESSAGE(NOLOG) requests that failed with response code 13 NOTFND and reason code 5 or 8.

Learn more...

• Security domain: Global statistics
• Performance data in group DFHTASK

Updated WS-Security requirements

The IBM XML Toolkit for z/OS prerequisite has been updated to v1.11.

Learn more about installing the prerequisites for WS-Security support.

Multi-factor Authentication (MFA) terminal signon improvement for users with expired credentials

Service Available with APAR PH63625.

You can now activate the IDTDATA class in RACF to logon and change expired credentials.

This capability is also available in CICS TS 6.1 with APAR PH63625.

Learn more about How it works: Multi-factor authentication (MFA)

New JVM system property to regenerate LTPA keys

Service Available with APAR PH69930.

New com.ibm.cics.jvmserver.wlp.ltpa.regenerate JVM system property to help manage stricter password requirements in Liberty JVM servers.

Learn more about com.ibm.cics.jvmserver.wlp.ltpa.regenerate.

First-stage shutdown PLT programs now always run with CMDSEC(YES) and RESSEC(YES)

First-stage shutdown PLT programs always run with CMDSEC(YES) and RESSEC(YES), regardless of the security attributes of the transaction that issued the PERFORM SHUTDOWN command.

Learn more about Security for CICS shutdown.

For performance

Read and browse requests to shared data tables are threadsafe

The following commands, when used to access a CICS maintained or user maintained shared data table, can now run on an open TCB as well as on the QR TCB:

• READ (without the UPDATE option)
• STARTBR
• READNEXT (without the UPDATE option)
• READPREV (without the UPDATE option)
• ENDBR
• RESETBR

Commands that update a shared data table (READ with UPDATE, REWRITE, READNEXT with UPDATE, READPREV with UPDATE, DELETE, WRITE) are not threadsafe and continue to run only on the QR TCB. The loading of shared data tables is also unaffected by this change and executes always on the QR TCB.

The use of threadsafe READ and BROWSE access to shared data tables, thereby allowing file control requests to have cross memory access on open TCBs, can only be achieved when both the AOR and the FOR are at CICS TS 6.2 or higher.

Learn more about upgrading AORs and FORs.

CICSPlex SM can now process type 71 ENF events for a CICSplex

This enhancement can help to reduce a significant amount of system overload that would otherwise occur for processing high volume of type 71 ENF events.

RACF sends a type 71 ENF signal to listeners when a CONNECT, REMOVE, or REVOKE command changes a users’ resource authorization, or when a user ID is revoked as a result of too many failed password attempts. A CMAS can now listen for type 71 ENF events and make type 71 ENF event data available for its connected MAS regions to consume. This means that MAS regions can obtain type 71 ENF event data directly from the owning CMAS, without the need to register as a type 71 ENF event listener themselves.

A new option, CPSM, is introduced on the RACFSYNC system initialization parameter. A MAS region must be started with RACFSYNC=CPSM so that it does not register as a type 71 ENF event listener but still processes type 71 ENF event data obtained from its connected CMAS.

For CICSPlex SM security, when a CMAS region that is set with RACFSYNC=YES receives a type 71 ENF event, security information for the affected user ID is rebuilt the next time the user ID is used, irrespective of the setting of the SECTIMEOUT parameter.

Learn more about the RACFSYNC system initialization parameter.

For resilience

Enhanced SOS protection and monitoring of z/OS MEMLIMIT storage in the 64-bit addressing range

CICS introduces the capability to monitor the part of 64-bit z/OS storage that is allocated by the z/OS MEMLIMIT parameter. CICS periodically monitors the state of unallocated z/OS storage available to the CICS region in its z/OS address space, against a short-on-storage (SOS) threshold set by the new system initialization parameter ZOSSOS64UNALLOC. CICS issues console messages to notify you of SOS conditions. You can use system policy rules that are triggered by these SOS messages, with an action to set the z/OS WLM health value to 0, so as to limit new work coming to the affected region.

Storage manager global statistics include new fields that report on the state of unallocated storage in the z/OS MEMLIMIT storage and on SOS conditions that have occurred to it. These statistics help you understand your current use of the z/OS MEMLIMIT storage, track fluctuations in the storage usage overtime, and identify and avoid SOS conditions that might occur.

Learn more about monitoring unallocated z/OS storage for CICS.

Resilience to surging requests for TRANCLASS-managed transactions

Transaction classes control the maximum number of tasks that can be dispatched and queued for transactions that belong to an active transaction class. In an ideal situation, a CICS region with well-tuned transaction classes handles workloads by dispatching and queuing tasks so that requests are served within an expected response time. However, in an abnormal situation - for example, if tasks have built up as a result of a slow-down or a surge of requests into the CICS region - further requests are purged according to the PURGETRESH of the TRANCLASS and transaction abends occur. CICS TS 6.2 introduces several enhancements including the capability to monitor queued tasks so that you are aware of the situation and the option to control TRANCLASS purge actions.

A new system rule, transaction class queued tasks, monitors when the number of tasks queuing for membership to a TRANCLASS approaches the TRANCLASS purge threshold and enables CICS to take a policy action in response. This policy system rule can give you an early warning on the situation and take precautionary measures.

Instead of resolving to the purge action of an AKCC abend as it did in previous CICS releases, CICS TS 6.2 can discard a request to start a transaction when its associated TRANCLASS has reached the purge threshold. This avoids unnecessary transaction abends that would otherwise occur and consume even more from a constrained system. To support this enhancement, the TRANCLASS resource definition has a new attribute PURGEACTION through which you can set the purge action to DISCARD or ABEND. CICS API, SPI, and statistics have been enhanced to support PURGEACTION. In a workload routing environment, it is important to ensure a consistent use of purge action for a workload. See the queue algorithm and the link neutral queue algorithm.

Learn more...

• Transaction class queued tasks system rule
• TRANCLASS resources
• Using PURGETHRESH and PURGEACTION

Suppress SMF records with zero-counting fields

Transaction and Program statistics that contain zero count fields following a reset are suppressed for interval, requested, and requested reset type statistics. This reduces SMF volume at most of the times that CICS statistics are being generated, retaining the ability to use CICS statistics as a way to inventory CICS resources.

Learn more about reset characteristics of statistics counters.

Sysplex caching for TLS 1.3 is supported

Sharing information about the SSL session across different CICS regions in a sysplex is particularly useful when HTTP requests are being routed across a set of CICS regions by using TCP/IP connection workload balancing techniques, such as TCP/IP port sharing or Sysplex Distributor. CICS now supports sysplex caching for TLS 1.3 in addition to previous support for sysplex caching in earlier versions of TLS.

Learn more about the SSLCACHE system initialization parameter.

Enhanced exploitation of Instruction Execution Protection

This release introduces further CICS exploitation of Instruction Execution Protection (IEP) beyond its use for CICS-managed storage and CICS dynamic storage areas (DSAs). Now the majority of requests for z/OS storage issued by CICS for its own internal purposes have been converted to use a STORAGE OBTAIN call that specifies that non-executable storage is used, thereby protecting CICS internal use of z/OS storage from errors such as stack overflow and malicious attacks. This applies to 24-bit, 31-bit, and 64-bit z/OS storage. Protection is provided if CICS is running on a level of IBM Z hardware and operating system that support IEP regardless of the setting of feature toggle com.ibm.cics.sm.iep. The feature toggle only controls whether IEP is applied to CICS-managed storage and CICS DSAs.

Learn more about Instruction execution protection.

Automatic redirecting of HTTP response for INVOKE SERVICE command

Service APAR PH63742 required.

The INVOKE SERVICE command has been updated to allow for redirects of the HTTP response to the information contained in the location header.

This capability is also available on CICS TS 6.1 with APAR PH63742, and on CICS TS 5.6 with APAR PH61670.

Learn more about INVOKE SERVICE.

For documentation and other information

Version 6 documentation

This documentation covers all releases of CICS TS for z/OS, Version 6. Differences between the releases are highlighted with tags in both HTML and PDF, like this: 6.2 and 6.1.

The release tags indicate functional difference between Version 6 releases. They do not imply applicability for Version 5 releases. Refer to Upgrading or the CICS TS Version 5 documentation for clarification.

Machine translation of documentation

CICS online documentation and IBM Documentation Offline are now translated in languages other than English: Brazilian Portuguese, French, German, Italian, Japanese, Korean, Simplified Chinese, and Spanish. PDF documentation is not currently translated.

Archived publications added to CICS documentation

Some archived IBM publications, including the IBM 3270 Data Stream Programmers Reference, are provided for download from Archived CICS documentation. These publications are referenced by some CICS messages and are provided as-is.

Enhanced information

Some areas of the documentation are rewritten to make them easier to work with:

• Trace information. Terms related to trace are consolidated and explained in Terms to understand about CICS trace. A new section How it works: Tracing in CICS expands the explanation of basic concepts such as trace points, trace levels, trace destinations, and different types of CICS trace. z/OS trace is now covered in Using z/OS trace for problem determination.
• Security information. All Security for Java applications documentation is re-written. How it works topics, examples, or both are added for security of JCICSX applications, Java APIs, Java threads and tasks, and so on. Configuration tasks are added for syncToOSThread, LDAP, and OAuth 2.0. Diagrams and best practices are added to most of the documentation about securing CICS.
• A new video about CICS security basics is available. See Video: What does security mean for CICS?

PDF

Any information in IBM Docs that is not available in PDF is listed in Documentation in PDF. Some of the biggest PDFs are split to make them easier to work with. CICS Messages is now in 3 parts. The Diagnosis Reference is split into Component Reference, Domain Reference, and Executable Module Reference.

Learn more about What documentation is available?.