You will need to configure whether to use a direct TCP/IP connection between the storage devices and the Encryption Key Manager (out-of-band) or configure to use the in-band proxy. Under z/OS the in-band proxy is defined using the IECIOSxx PARMLIB member (or the SETIOS EKM command).

For z/OS tapes, you can configure whether to encrypt or not based on data class definitions. Furthermore, for z/OS you may specify the key labels through data class or through the DD statement (JCL, dynamic allocation, or TSO ALLOCATE). In addition to this, Encryption Key Manager assigned defaults can also be used if the key labels are not provided through z/OS.

For tapes that will be encrypted or decrypted, you must define and keep track of the key information to be used. For information on key management and the role of the Encryption Key Manager (EKM), refer to IBM® System Storage Tape Encryption Key Manager, Introduction, Planning, and User Guide, GA76-0418.