When you pass the SSM parameter to KGUP in a JCL statement, you need to enable special secure mode processing. You must specify SSM(YES) in the installation options data set.

For CCF Systems, if you use logical partition (LPAR) mode, you also need to enable special secure mode on the Change LPAR Crypto panel from the Hardware Master Console of the server support element. If you have the optional TKE workstation, you can use it to enable and disable special secure mode.