Configuring CA-Top Secret security

You can use CA-Top Secret to secure XBM by defining resource profiles for access to XBM functions.

To configure CA-Top Secret security

Ensure that SAF is enabled on your MVS system.
XBM issues a RACROUTE macro to SAF to determine if a request can be approved.
Add the XBM resource profile BMCXBM and the XBM subsystem (indicated by the ssid ):
```
TSS ADD(departmentACID) IBMFAC(BMCXBM)
TSS ADD(departmentACID) IBMFAC(ssid)
```
Note

The resource profile must be named BMCXBM.
Permit access to the XBM resource profile BMCXBM and the XBM subsystem:
```
 TSS PER(userID or profile) IBMFAC(BMCXBM.ssid.action.object) 
 ACCESS(Control or higher)
 TSS PER(userID or profile) IBMFAC(ssid) ACCESS(UPDATE)
```
Resource profiles for XBM require the following form:
```
BMCXBM.ssid.action.object
```
The variables represent the following values:
- ssid represents the XBM subsystem ID.
- action represents the XBM action.
- object represents the XBM object or resource name.
For more information about the XBM resource profile, including values for action and object, see RACF resource profiles. For more information about CA-Top Secret, see the vendor-provided user documentation for that product.