Encrypting all data sets using a storage group with z/OS DFSMS data set encryption

Db2 supports z/OS DFSMS data set encryption for all of the data sets in a storage group using a key label for encryption and decryption.

1. Obtain a key label from the RACF/ICSF administrator and ensure the key label is defined on all the backup sites used in disaster recovery and all the subsystems in a data sharing group.

   For information on key labels, see "Creating a key label naming convention" in Getting Started with z/OS Data Set Encryption (IBM Redbooks).

2. Issue a CREATE or ALTER STOGROUP statement to define a key label.
   Db2 provides the specified key label to DFSMS when allocating new data sets within the storage group. To override the Db2-provided key label at a table level, use the CREATE TABLE or ALTER TABLE statement with the KEY LABEL clause. This table-level override is only available for tables in universal or partitioned table spaces. The key label specified at the RACF data set profile overrides any Db2 provided key label.
3. Issue the REORG TABLESPACE utility against each table space within the storage group.
   The key label that is specified in the ALTER STOGROUP statement is provided to DFSMS when allocating new data sets for the table spaces. The key label specified at the RACF data set profile overrides the Db2 provided key label