ICSF is preferred but not required. You can begin using PKI Services without installing ICSF and install it later without reinstalling PKI Services. ICSF is strongly suggested to store and protect your certificate authority's private key. If you plan to have PKI Services generate key pairs for certificates, you must install ICSF and set up the ICSF PKCS #11 token data set (TKDS). For more information, see Installing and configuring ICSF (optional).