Deciding which RACF protections to use

There are different options you can use depending on how much protection you want.

Note: To give specific authority to a certain user you could include that user on the access list for that data set. To do that see Permitting an individual or a group to use a data set.

The following options provide different degrees of general protection for your data set:

UACC (universal access authority).
Universal access authority specifies the authority any user not on the access list has to use the data set. The UACC can have one of the following values:
NONE

Does not allow users to access the data set.
Attention: Anyone who has READ, UPDATE, CONTROL, or ALTER authority to a protected data set can create a copy of it. As owner of the copied data set, that user has control of the security characteristics of the copied data set, and can downgrade it. For this reason, you might want to initially assign a UACC of NONE, and then selectively permit a small number of users to access your data set, as their needs become known. (See Permitting an individual or a group to use a data set for information on how to permit selected users or groups to access a data set.)

READ

Allows users to access the data set for reading only. (Note that users who can read the data set can copy or print it.)

UPDATE

Allows users to read from, copy from, or write to the data set. UPDATE does not, however, authorize a user to delete, rename, move, or scratch the data set.

CONTROL

For VSAM data sets, CONTROL is equivalent to the VSAM CONTROL password; that is, it allows users to perform control-interval access (access to individual VSAM data blocks), and to retrieve, update, insert, or delete records in the specified data set.
For non-VSAM data sets, CONTROL is equivalent to UPDATE.

ALTER

ALTER allows users to read, update, delete, rename, move, or scratch the data set.
When specified in a discrete profile, ALTER allows users to read, alter, and delete the profile itself including the access list. However, ALTER does not allow users to change the owner of the profile.

When specified in a generic profile, ALTER gives users no authority over the profile itself.

When specified in a generic profile, ALTER allows users to create new data sets that are covered by that profile.

EXECUTE

For a private load library, EXECUTE allows users to load and execute, but not read or copy, programs (load modules) in the library.
Note: In order to specify EXECUTE for a private load library, you must ask for assistance from your RACF® security administrator.
NOTIFY user ID.
The NOTIFY user ID is sent a message whenever someone tries to use a data set, and RACF denies the access.

For example, if your user ID is specified on the NOTIFY keyword, and a user with READ access attempts to update a protected data set, you receive a message identifying the user who attempted the access and what kind of access was attempted.
Note: If you do not specify a user ID on the NOTIFY keyword, your user ID is the default NOTIFY user ID.
Erase-on-scratch.
You might want to specify that the data set protected by this profile be physically erased when the data set is deleted (scratched) or released for re-use. Erasing the data set means overwriting all allocated extents with binary zeros. To use erase-on-scratch, specify the ERASE operand on the ADDSD command.
WARNING option.
Specifying WARNING allows unauthorized users to access a data set. RACF issues a warning message to the user requesting access, then allows the access.

Attention: WARNING is generally used only during a transition period when RACF is first installed. If you use WARNING, it is equivalent to no protection.
Your installation might have other security requirements for protecting data, including audit type, level, and security label. See your RACF security administrator for specific information.