When selecting a vendor, make sure they can keep up with you. The ongoing development, security, is an ever-changing item and they need to have sufficient development staff and capabilities to keep up with the industry. That is an area where I have a concern, because I don't see them keeping pace with what we're doing. Admittedly, we're at the forefront of a lot of stuff. It's all about the configuration. It's how you use it. There are only three players in mainframe security. There is RACF from IBM, there's ACF2 and Top Secret from CA. Each has its strengths and weaknesses. RACF is very robust at this point in time, but it takes third-party tools or an extreme knowledge of the z/OS operating system to use it properly. Top Secret is probably one of the easiest to use, but it's not quite as easy to customize. ACF2 is very, very easy to customize, it takes less technical knowledge than RACF but more than Top Secret. It's really a matter of finding a product that is suited to the way your organization does business. If it's a small organization with little in-depth security expertise, I would recommend Top Secret. If it's a very, very large organization, I would recommend something like RACF or ACF2.
