Responsibilities of the implementation team

Some of the responsibilities that might be assigned to the implementation team are:

Defining RACF® security objectives
Deciding what to protect and how to report attempted violations
Establishing resource ownership structures
Developing the RACF implementation plan and installing RACF
Educating all users of the RACF-protected system

Table 1 describes the responsibilities of typical implementation team members.

Table 1. Participants of the security implementation team
User type	Responsibility
Security Administrator	As security administrator, you have overall responsibility for RACF implementation. It is your job to ensure that the work of the implementation team is consistent with good security practice and in line with the security policy established earlier. In addition, you or your delegate administrators should be responsible for educating the installation users about how RACF will be implemented. (That is, will there be a grace period before the new security procedures take effect? How will the implementation of RACF affect the day-to-day responsibilities of each user?)
Technical Support Person	The technical support person is normally a system programmer who installs RACF and maintains the RACF database. This person has overall responsibility for the programming aspects of system protection and provides technical input on the feasibility of implementing various aspects of the implementation plan. In addition, the technical support person writes, installs, and tests RACF exit routines, if they are required. If you will have RACF installed on more than one system in your installation, the implementation team should include a technical support person for each system on which you are using RACF. For more information, see z/OS Security Server RACF System Programmer's Guide.
Auditor	The auditor provides guidance on good auditing practice as it relates to data security and user access. This person implements the necessary RACF logging and reporting options to provide an effective audit of security measures. For more information on the auditor's duties, see z/OS Security Server RACF Auditor's Guide.
User Representative	The user representative should be a prospective group administrator who represents a major application area, perhaps a user support services or liaison function.
Other Users	Other users might be considered as members of the implementation team if appropriate. For example, other users who are involved with security include CICS®, TSO, and database administrators and JES, MVS™, and PSF system programmers.

The rest of this topic discusses some of the major responsibilities of the security implementation team.