Protecting a Data Set When You Define It

When you define a non-VSAM data set in a catalog, the data set is not protected with passwords in its catalog entry.

Two levels of protection options for your data set are available. Specify these options in the LABEL field of a DD statement with the parameter PASSWORD or NOPWREAD. See z/OS MVS JCL Reference.

Password protection (specified by the PASSWORD parameter) makes a data set unavailable for all types of processing until a correct password is entered by the system operator, or for a TSO/E job by the TSO/E user.
No-password-read protection (specified by the NOPWREAD parameter) makes a data set available for input without a password, but requires that the password be entered for output or delete operations.

The system sets the data set security indicator either in the standard header label 1, as shown in z/OS DFSMS Using Magnetic Tapes, or in the data set control block (DSCB). After you have requested security protection for magnetic tapes, you cannot remove it with JCL unless you overwrite the protected data set.