In addition to requesting password protection in your JCL, you must enter at least one record for each protected data set in a data set named PASSWORD. The PASSWORD data set must be created on the system-residence volume. The system-residence volume contains the nucleus of the operating system. The system programmer should also request password protection for the PASSWORD data set itself to prevent both reading and writing without knowledge of the password.

For a data set on direct access storage devices, place the data set under protection when you enter its password in the PASSWORD data set. Use the PROTECT macro or the IEHPROGM utility program to add, change, or delete an entry in the PASSWORD data set. Using either of these methods, the system updates the DSCB of the data set to reflect its protected status. Therefore, you do not need to use JCL whenever you add, change, or remove security protection for a data set on direct access storage devices. For information about maintaining the PASSWORD data set, including the PROTECT macro, see z/OS DFSMSdfp Advanced Services. For information about the IEHPROGM utility, see z/OS DFSMSdfp Utilities.