Each of the services in ICSF calls an exit before and after processing. z/OS Cryptographic Services ICSF Application Programmer's Guide describes the services in greater detail.
You can use a service exit to change, augment, or replace processing or to bypass the IBM-supplied processing for the service entirely. Services installation exits gives further details about exits for the services.