When you pass the SSM parameter to KGUP in a JCL statement, you need to enable special secure mode processing. To use special secure mode, the installation options data set must specify YES for the SSM installation option or the CSF.SSM.ENABLE SAF profile must be defined in the XFACILIT SAF resource class.