Ensure ALTER access to zSecure installation data sets is restricted to systems programmers, and all failures and successful UPDATE and higher access is logged. READ access can be permitted to auditors, security administrators (domain level and decentralized), batch jobs that perform ESM maintenance, and trusted STC users. The installing systems programmer will identify and document the product data sets and categorize them according to who will require UPDATE and higher access and if required that all successful UPDATE and higher access is logged. The installing systems programmer will identify if any additional groups need READ access for specific zSecure installation data sets, and once documented will work with the information system security officer (ISSO) to ensure they are properly restricted to the ESM active on the system. The following commands are provided as a RACF sample for implementing zSecure installation data set controls. Please convert these commands for any other ESM: ad 'hlq.zsec.inst.dsn' uacc(none) owner(zSecure owner) - audit(success(update) failures(read)) pe 'hlq.zsec.inst.dsn' id(AUDTAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ) pe 'hlq.zsec.inst.dsn' id(SYSPAUDT) access(ALTER)