ICSF functions access an in-storage copy of the CKDS when the functions reference keys by label. However when you use KGUP, the program makes changes to a disk copy of the CKDS. This situation allows you to maintain the keys in the data set without disturbing current cryptographic operations.

When you update the disk copy, you can use the Refresh option on the Key Administration panel to replace the in-storage copy with the disk copy. For a description of this panel path, see Steps for refreshing the active CKDS using the ICSF panels. Besides using the panels to refresh the in-storage CKDS, you can invoke a utility program to perform the task. Refer to Refreshing the in-storage CKDS using a utility program for details.

If you are running in a sysplex environment and ICSF instances are sharing a CKDS, you should perform a coordinated CKDS refresh operation . Refer to Performing a coordinated CKDS refresh.