Using z/OS DFSMS data set encryption to encrypt the data sets associated with a particular table

Db2 for z/OS supports z/OS DFSMS data set encryption for the data sets associated with a particular table.

To encrypt table spaces with z/OS DFSMS data set encryption, use the following steps:

1. Obtain a key label from the RACF/ICSF administrator and ensure the key label is defined on all the backup sites used in disaster recovery and all the subsystems in a data sharing group.

   For information on key labels, see "Creating a key label naming convention" in Getting Started with z/OS Data Set Encryption (IBM Redbooks).

2. Issue a CREATE or ALTER TABLE statement to define a key label to encrypt Db2-managed data sets.
   Use this procedure to encrypt DB2-managed data sets for universal table spaces or partitioned table spaces. For user-managed data sets, you need to use DFSMS interfaces. For table spaces that can contain multiple tables, use the CREATE STOGROUP or ALTER STOGROUP statement with the KEY LABEL clause.
3. Run the REORG TABLESPACE utility against the table spaces associated with the table.
   The key label specified on the CREATE TABLE or ALTER TABLE statement is provided to DFSMS when data sets for the table space, auxiliary (XML or LOB) table spaces, or indexes associated with the table are allocated. If a key label is specified for the RACF data set profile, it overrides the Db2-provided key label.