IBM Tivoli zsecure V1.9 suite extends compliance and audit capabilities on the mainframe while simplifying administration

Transcription

1 IBM United States Announcement , dated December 11, 2007 IBM Tivoli zsecure V1.9 suite extends compliance and audit capabilities on the mainframe while simplifying administration Key prerequisites...2 Description...2 Product positioning... 4 Education support...5 Offering Information...5 Publications... 6 Technical information...6 Ordering information...13 Terms and conditions Prices...23 Order now...26 At a glance IBM Tivoli zsecure V1.9 suite can help you enhance the security of mainframe systems by: Automating routine administrative tasks to help reduce costs and improve productivity Monitoring and auditing incidents to help detect and prevent security exposures Seamlessly integrating with an enterprise-wide view of audit and compliance efforts Tivoli zsecure V1.9 suite also provides: Currency with z/os V1.9, including SMF Logger Stream Input and Digital Certificate enhancements Key RAS function, including error log integrity and data collection resiliency For ordering, contact: Your IBM representative, an IBM Business Partner, or the Americas Call Centers at 800-IBM-CALL Reference: YE001 Overview The IBM Tivoli zsecure V1.9 for z/os suite consists of multiple modular components designed to help you administer your mainframe security server, monitor for threats, audit usage and configurations, and enforce policy compliance. Administration, provisioning, and management components can significantly reduce administration time, effort, and costs through decentralized administration. These offerings include: IBM Tivoli zsecure Admin IBM Tivoli zsecure Visual IBM Tivoli zsecure CICS Toolkit Audit, monitoring and compliance components help ease the burden of compliance audits, improve security and incident handling, and increase overall operational effectiveness. Offerings include: IBM Tivoli zsecure Audit IBM Tivoli zsecure Alert IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 1

2 IBM Tivoli zsecure Command Verifier Tivoli zsecure v1.9 also includes: Currency with z/os V1.9, including SMF Logger Stream Input and Digital Certificate enhancements Key reliability, availability, and serviceability (RAS) function, including error log integrity and data collection resiliency Additional offerings include: IBM Tivoli Compliance Insight Manager Enabler for z/os The Tivoli zsecure suite allows you to submit mainframe security information into an enterprise audit and compliance solution, through the seamless integration with IBM Tivoli Compliance Insight Manager. Combining mainframe data with that from other operating systems, applications, and databases, Tivoli Compliance Insight Manager provides the ability to capture comprehensive log data, interpret that data through sophisticated log analysis and communicate results in an efficient, streamlined manner for full enterprise-wide audit and compliance reporting. Tivoli Compliance Insight Manager Enabler for z/os provides the event source connection to supply the mainframe information into the enterprise tool. Key prerequisites For details, refer to the Software requirements section. Planned availability date December 14, 2007 Description Helps free administrators to focus on security While preventing security breaches is paramount, administrators are frequently bogged down with tedious, time-consuming day-to-day tasks that divert their attention from security issues. The Tivoli zsecure suite offers a range of products designed to help reduce administration time, and enable valuable mainframe resources to focus on improving security quality. Tivoli zsecure Admin is a leading security software program that enables efficient and effective IBM Resource Access Control Facility (RACF ) administration, typically using significantly less resources. By putting a user-friendly layer over your RACF databases, you can quickly enter and process administrative commands, generate custom reports, and clean up databases. And by implementing a repeatable process for security management, Tivoli zsecure Admin can help you reduce errors and improve the overall quality of services. Tivoli zsecure Visual can reduce the need for expensive, RACF-trained expertise through a Microsoft Windows -based GUI for RACF administration. With the ability to establish a secure connection directly with RACF, Tivoli zsecure Visual is ideal for decentralizing RACF administration or enabling central security administration from outside Interactive System Productivity Facility/Time Sharing Option (ISPF/TSO). Tivoli zsecure CICS Toolkit allows you to perform mainframe administrative tasks from an IBM Customer Information Control System (CICS) environment, helping free scarce native RACF resources from basic administrative routines and enabling decentralized administration. Track security events and prevent exposures to help ease compliance requirements Over the past decade, the number of requirements with which organizations must comply has increased dramatically. Keeping up with the demands for audit and controls documentation, while also trying to prevent security breaches, can be overwhelming. The Tivoli zsecure suite delivers auditing, monitoring, and compliance solutions designed to help reduce security exposures. Tivoli zsecure Audit delivers a mainframe compliance management and audit solution that enables you to quickly analyze and report on mainframe events, and automatically detect security exposures through extensive status auditing. The technology lets you create standard IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 2

3 and customized reports, that can be generated in Extensible Markup Language (XML) format, and used in databases and reporting tools. Tivoli zsecure Audit also allows you to send Simple Network Management Protocol (SNMP) messages to an enterprise management console for policy exceptions or violations that indicate a security breach or weakness. This capability is provided for RACF and CA Top Secret environments. Key RAS improvements are now included in zsecure v1.9, including error log integrity and data collection resiliency. These provide enhanced visibility into log information needed for debug activity. Tivoli zsecure Alert offers a real-time mainframe threat monitoring solution that allows you to efficiently monitor intruders and identify misconfigurations that could hamper your compliance efforts. It goes beyond conventional intrusion detection solutions to support intrusion prevention by taking countermeasures via automatically generated commands. In addition, Tivoli zsecure Alert enables you to quickly determine unauthorized logons and attempts, user behavior that violates security policy, and when your core systems are at risk. With this information readily in hand, you can help identify misconfigurations before they can be exploited, while staying one step ahead of the auditors. This capability is provided for RACF and CA ACF2 environments. Tivoli zsecure Command Verifier is a robust policy enforcement solution that can help enforce mainframe compliance to company policies by preventing erroneous commands. As a result, it helps increase control and decrease security risks and cleanup costs. Running in the background, Tivoli zsecure Command Verifier verifies RACF commands against your company's policies and procedures. When commands are entered, it verifies whether the commands comply with security policies and blocks or, optionally, adjusts the ones that do not comply. To ensure currency with the latest releases of z/os and RACF, Tivoli zsecure V1.9 includes support for SMF Logger Stream Input and Digital Certificate enhancements. zsecure uses SMF records extensively, and supports the streaming capability provided for SMF records, which can specify that different SMF record types can be written to separate log streams, and that the same SMF record type can be written to multiple log streams, providing flexibility in logging SMF data. Tivoli zsecure V1.9 also accepts and reports on the new command operands provided for the Digital Certificate enhancements in z/os and RACF V1.9. Tivoli Compliance Insight Manager Enabler for z/os provides a link from zsecure Audit to the Tivoli Compliance Insight Manager tool, so that the mainframe audit information is included in the enterprise dashboard view. Bringing it all together The Tivoli zsecure suite is a valuable part of managing mainframe security as a process that helps meet the needs of regulators, auditors, and the business itself. These offerings are the result of a long-term commitment to innovation on the mainframe and to enabling you to improve and simplify mainframe security audit and administration. Through a broad range of offerings, the Tivoli zsecure suite helps you address your key mainframe challenges. Audit and compliance: Report on questionable system options and dangerous settings of privileged users. Measure and verify the effectiveness of mainframe security and security policies. User and security administration: Centrally manage and provision users, profiles, and resources. Constantly monitor crucial users and data for misuse. Security risk detection and avoidance: Can reduce operational costs and achieve faster incident detection. Generate alerts with instant reports about RACF, IBM System Management Facilities (SMF), IBM z/os, IBM DB2, and the UNIX subsystem. Accessibility by people with disabilities A U.S. Section 508 Voluntary Product Accessibility Template (VPAT) containing details on accessibility compliance can be requested at Value Unit-based pricing IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 3

4 Value Unit pricing for eligible IBM System z IBM International Program License Agreement (IPLA) programs enables a lower cost of incremental growth and enterprise aggregation. Each System z IPLA product with Value Unit pricing, has a single price per Value Unit and a conversion matrix, called Value Unit Exhibit, for converting from some designated measurement to Value Units. Most commonly, Millions of Service Units (MSUs) is the measurement designated by IBM to be converted to Value Units. Some other measurements are engines or messages. Since MSUs are the most common measurement, that measurement will be used for the remainder of this description. Value Unit pricing offers price benefits for you. For each System z IPLA program with Value Unit pricing, the quantity of that program needed to satisfy applicable IBM terms and conditions is referred to as the required license capacity. Each of the various Value Unit Exhibits stipulate that the larger your required license capacity, the fewer Value Units per MSU you will need. Value Unit Exhibits are uniquely identified by a three digit code and referred to using the nomenclature VUExxx, where xxx is the three digit code. Subsequent acquisitions of Value Unit priced programs offer additional price benefits. The quantity of each System z IPLA program that you have acquired is referred to as entitled license capacity. If you wish to grow your entitled license capacity for a System z IPLA program, the calculation to determine additional needed Value Units is based upon the number of Value Units already acquired. For each System z IPLA program with Value Unit pricing, you should: Determine the required license capacity, in MSUs Aggregate the MSUs across the enterprise Convert the total MSUs to Value Units, using the applicable Value Unit Exhibit Multiply the price per Value Unit by the total number of Value Units to determine the total cost To simplify conversion from the designated measurement to Value Units or vice-versa, use the Value Unit Converter Tool. For additional information or to obtain a copy of the Value Unit Converter Tool, visit the Value Unit Converter Tool Web site Note that Value Units of a given product cannot be exchanged, interchanged, or aggregated with Value Units of another product. To determine the required license capacity for the System z IPLA program you selected, refer to the Terms and conditions section. Product positioning Positioning zsecure with Tivoli Compliance Insight Manager Tivoli zsecure suite leverages the capabilities of Tivoli Compliance Insight Manager to enable inclusion of mainframe reporting on RACF, CA ACF2, and CA Top Secret into Tivoli Compliance Insight Manager enterprise-wide compliance dashboard and reporting, so that users can view the status of their enterprise security hub along with the rest of their environment. For more details, refer to Software Announcement , dated July 3, Positioning zsecure with Tivoli Security Operations Manager Tivoli Security Operations Manager and zsecure Alert tools are companions to provide a comprehensive view of the mainframe threats and incidents. Security Information and Event Management with Tivoli Security Operations Manager For information technology managers and information security managers who need to efficiently correlate, analyze, and respond to security events for intruders from perimeter and network devices in a real-time security operations dashboard, Tivoli Security Operations Manager offers a real-time Security Information and Event Management (SIEM) dashboard and reporting engine, with support for virtually all leading network and security devices, and hundreds of pre-defined correlation rules, enabling effective incident management. Tivoli Security Operations Manager collects and analyzes information in real-time from security devices across the network. Through advanced correlation capabilities, it is able to identify and prioritize security incidents, and enables your organization to respond to these incidents automatically. Integration of Tivoli Security Operations Manager with zsecure Alert allows you to IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 4

5 feed the security incident information from RACF into the Tivoli Security Operations Manager dashboard and reports. Positioning zsecure with RACF Your investment in RACF may be enhanced with the addition of zsecure, which provides integrated security audit and compliance monitoring and administration for z/os and RACF. Mainframe auditing For data center auditors, security managers, system programmers, and IT managers who need to monitor mainframe events and incidents, help reduce security vulnerabilities, and help enforce security policy compliance and generate audit reports, Tivoli zsecure suite offers a mainframe audit solution that provides analysis and reporting of mainframe events and automatic detection of exposures through extensive status auditing. Mainframe security administration For RACF administrators and IT managers who need to simplify and automate routine administrative tasks, and decentralize administration control, Tivoli zsecure suite offers a mainframe administration suite that enables efficient and effective RACF administration, typically using less resources and providing richer functionality, and helping address compliance initiatives. And by implementing a repeatable process for security management, Tivoli zsecure suite can help you reduce errors and improve the overall quality of services. Positioning zsecure with legacy Consul clients Tivoli zsecure V1.9 suite offers additional functionality for existing Consul customers. Contact your IBM representative or Business Partner for more information on migrating to the latest zsecure version. Business Partner information If you are a Direct Reseller - System Reseller acquiring products from IBM, you may link directly to Business Partner information for this announcement. A PartnerWorld ID and password are required (use IBM ID). BP Attachment for Announcement Letter Trademarks System z is a trademark of International Business Machines Corporation in the United States or other countries or both. z/os, Tivoli, CICS, RACF, DB2, and eserver are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Microsoft and Windows are registered trademarks of Microsoft Corporation. UNIX is a registered trademark of the Open Company in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others. Education support Comprehensive education for IBM Tivoli products is offered through Worldwide Tivoli Education Delivery Services. A wide range of training options are available, including classes led by instructors, learning on demand, on-site training, and blended learning solutions. For additional information, visit Offering Information Product information is available via the Offering Information Web site IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 5

6 Publications No publications are shipped with these programs. The following English publications for IBM Tivoli zsecure V1.9 can be downloaded from the following Web site at general availability Title IBM Tivoli zsecure Audit for ACF2 Getting Started Alert User Reference Manual Visual Client Manual Visual Server Manual Command Verifier User's Guide CICS(R) Toolkit User's Guide Form number GI SC SC SC SC SC IBM Tivoli zsecure Suite Admin and Audit for RACF(R) Getting Started CARLa-Driven Components Installation and Configuration Manual Quick Reference in A4 Fold Format Booklet Quick Reference Booklet in Letter Fold Format Quick Reference Booklet in Standard Format GI SC SC SC SC The following English publications for Tivoli zsecure V1.9 are only available to licensed users and must be ordered from the IBM Publications Center. These publications cannot be downloaded from the Web. IBM Tivoli zsecure Audit for ACF2 User Reference Manual Admin User Reference Manual Audit for RACF User Reference Manual LC LC LC IBM Tivoli zsecure Suite Admin and Audit for RACF User Reference Manual LC Admin and Audit User Reference Manual LC All publications are available from the IBM Publications Center. The Publications Center is a worldwide central repository for IBM product publications and marketing material with a catalog of 70,000 items. Extensive search facilities are provided. Payment options for orders are via credit card (in the U.S.) or customer number for 20 countries. A large number of publications are available online in various file formats, and they can all be downloaded by all countries, free of charge. To order licensed publications from the IBM Publications Center, click the customer support link, supply a valid IBM customer number, and request the desired publications. Technical information Specified operating environment Hardware requirements: Minimum and recommended processor, disk space, and memory requirements for the IBM Tivoli zsecure V1.9 suite are: Minimum Recommended Processor z800 IBM System z9(tm) or Enterprise Class (EC) z9 Business Class (BC) IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 6

7 Disk space 300 MB 450 MB Memory 1 GB 2 GB Software requirements: The IBM Tivoli zsecure V1.9 suite is supported in the following environments: z/os V1R7 z/os V1R8 z/os V1R9 The zsecure products that include features for CA ACF2 and CA Top Secret support the following versions: CA ACF2 V8 and V9, and CA Top Secret V8 and V9 Limitations: For additional information, refer to Usage restrictions in the Terms and conditions section of this announcement, or to the license information document that is available on the IBM Software License Agreement Web site Planning information Packaging: IBM Tivoli zsecure products are distributed with: International Program License Agreement (Z ) License Information document Tape Publications (refer to the Publications section) This program, when downloaded from a Web site, contains the applicable IBM license agreement, and License Information, if appropriate, and will be presented for acceptance at the time of installation of the program. For future reference, the license and License Information will be stored in a directory such as LICENSE.TXT. Security, auditability, and control The IBM Tivoli zsecure suite uses the security and auditability features of the operating system software. The customer is responsible for evaluation, selection, and implementation of security features, administrative procedures, and appropriate controls in application systems and communication facilities. Software Services IBM Software Services has the breadth, depth, and reach to manage your services needs. You can leverage the deep technical skills of our lab-based, software services team and the business consulting, project management, and infrastructure expertise of our IBM Global Services team. Also, we extend our IBM Software Services reach through IBM Business Partners to provide an unmatched portfolio of capabilities. Together, we provide the global reach, intellectual capital, industry insight, and technology leadership to support any critical business need. To learn more about IBM Software Services or to contact a Software Services sales specialist, visit IBM Tivoli Enhanced Value-Based Pricing IBM Tivoli software products are priced using IBM Tivoli Enhanced Value-Based Pricing. The Enhanced Value-Based Pricing system is based upon the IBM Tivoli Environment-Managed Licensing Model, which uses a managed-environment approach whereby price is determined by what is managed rather than the number and type of product components installed. IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 7

8 For example, all servers monitored with IBM Tivoli's monitoring product (IBM Tivoli Monitoring) require entitlements sufficient for those servers. Other Tivoli products may manage clients, client devices, agents, network nodes, users, or other items, and are licensed and priced accordingly. Unlike typical systems management licensing models that require entitlements of specific software components to specific systems, the IBM Tivoli Environment-Managed Licensing Model provides the customer flexibility to deploy its IBM Tivoli software products within its environment in a manner that can address and respond to the customer's evolving architecture. That is, as the architecture of a customer's environment changes, the customer's implementation of IBM Tivoli software can be altered, as needed, without affecting the customer's license requirements (as long as the customer does not exceed its entitlements to the software). Under Enhanced Value-Based Pricing, licensing and pricing of server-oriented applications are determined based upon the server's use in the customer's environment. Typically, such applications are licensed and priced in a manner that corresponds to each installed and activated processor of the server managed by the IBM Tivoli application to help correlate price to value while offering a simple solution. Where a server is physically partitioned, this approach is modified. This partitioning technique is the approach used with systems that have either multiple cards or multiple frames, each of which can be configured independently. For servers capable of physical partitioning (for example, IBM System p Scalable POWERparallel Systems servers, Sun Ultra servers, and HP Superdome servers), an entitlement is required for each processor in the physical partition being managed by the Tivoli application. For example, assume that a server has 24 processors installed in aggregate. If this server is not partitioned, entitlements are required for all 24 processors. If, however, it is physically partitioned into three partitions, each containing eight processors, and Tivoli products were managing only one of the three partitions, then entitlements would be required for the eight processors on the physical partition managed by the IBM Tivoli application. For servers with virtual or logical partitions, entitlements are required for all installed and activated processors on the server. For each IBM Tivoli application managing a clustered environment, licensing is based on the cumulative number of installed and activated processors on each server in the cluster. Where the cluster includes physically partitioned servers, the considerations described above concerning physically partitioned servers apply as well. Enhanced Value-Based Pricing recognizes the convergence of RISC and UNIX, and Microsoft Windows and Intel technologies, in order to simplify your licensing requirements, and to provide a smoother, more scalable model. Pricing and licensing does not differentiate between non-system z server platforms or operating systems. For some products, this platform neutrality extends to System z and other host servers as well. IBM Tivoli Enhanced Value-Based Pricing terminology definitions Authorized user An authorized user is one and only one individual (named or unnamed) within or outside your enterprise. A Proof of (PoE) must be obtained for each individual user accessing the program in any manner. A program licensed under an authorized user PoE may be installed on a single computer or server, and accessed by multiple users, provided that a PoE has been obtained for each individual user accessing the program either directly or indirectly (via a multiplexing program, device, or application server) through any means on behalf of the user. Note that authorized users have unique specific identity and IDs cannot be shared. An ID can establish one or more connections and count as a single authorized user. Specific information to security products are: An authorized user of IBM Tivoli Federated Identity Manager is any ID that accesses an application or service managed or protected by IBM Tivoli Federated Identity Manager. An authorized user of IBM Tivoli Directory Integrator is one whose identity can be synchronized by IBM Tivoli Directory Integrator or that can access a connected system that can be synchronized by IBM Tivoli Directory Integrator. An authorized user of IBM Tivoli Identity Manager is any ID whose identity is recorded in the Tivoli Identity Manager identity store. An authorized user of IBM Tivoli Access Manager for e-business is any ID that accesses an application or service managed or protected by IBM Tivoli Access Manager for e-business. Client device or client A client device is a computing device that requests the execution of a set of commands, procedures, or applications from another computer system that is typically referred to as a IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 8

9 server. Multiple client devices may share access to a common server. A client device generally has some processing capability or is programmable to allow a user to do work. Examples include, but are not limited to, notebook computers, desktop computers, desk side computers, technical workstations, appliances, automated teller machines, point-of-sale terminals, tills and cash registers, and kiosks. Engine An engine is also referred to as a central processor (CP) or processor. Engines for traditional workloads are called General Purpose CPs. Engines for Linux workloads are called Integrated Facility for Linux (IFL) engines or Linux-only engines. Engines for Coupling Facility workloads are called Integrated Coupling Facility (ICF) engines. Enterprise An enterprise is a person or single entity and those subsidiaries with more than 50% ownership. External user An external user is an authorized user who is not part of the enterprise. IBM IFL This optional facility enables additional processing capacity exclusively for Linux workload, with no effect on the model designation of a System z or OS/390 server. Consequently, executing Linux workload on the IFL will not, in most cases, result in any increased IBM software charges for z/os, OS/390, VM, VSE, or TPF operating systems and applications. There is, as indicated, a charge associated with the IFL, and there may also be a charge for applications which run on the IFL. The IFL may be dedicated to a single Linux-mode logical partition or it may be shared by multiple Linux-mode logical partitions. Installations should note that the Linux workspace enabled by this facility will not support any of the traditional S/390 operating systems (OS/390, TPF, VSE, or VM). Only Linux applications or Linux operating in conjunction with the Virtual Image Facility, an environment that operates within a logical partition or in native S/390 mode and provides the capability to create multiple Linux images, are supported by IBM S/390 IFL. IBM Tivoli Directory Integrator connected system A connected system is any directory, database, application, or file integrated or merged by IBM Tivoli Directory Integrator. IBM Tivoli Storage Manager HSM for Windows terabyte (TB) capacity IBM Tivoli Storage Manager HSM for Windows includes primary HSM disk storage pool size combined with the amount of utilized HSM removable media storage pool. Storage pools are configured on the IBM Tivoli Storage Manager server. IBM System Storage Archive Manager TB capacity IBM System Storage Archive Manager includes primary disk storage pool size combined with the amount of utilized primary removable media storage used by the IBM System Storage Archive Manager server. Capacity does not include: Copy storage pools for the space-managed data that reside on disk. Copy storage pools for the space-managed data that reside on removable media. Space used on the IBM Tivoli Storage Manager server for any purpose other than the primary storage of space-managed data. Disk on the host being space managed. A virtual tape library (VTL) is considered a removable media device, so capacity is based on utilization. The minimum amount of capacity that can be purchased is 1 TB. Partial capacity will be rounded up to the next whole number of TBs. Additional capacity must be added in increments of 1 TB. IBM TotalStorage Productivity Center TB capacity A TB capacity is each individual TB of storage capacity managed by the IBM TotalStorage IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 9

10 Productivity Center products. Managed capacity for the IBM TotalStorage Productivity Center for Replication and IBM TotalStorage Productivity Center for Replication Two Site BC is defined as the source device capacity. Only the source device capacity is included in this pricing definition (not the target device). Managed processor (charging under full capacity in the managed environment) Charges are based on the active processors on the machines in the computing environment affiliated with the program rather than on the server where the program is run. The managed processors which require PoEs are defined in the License Information's program-unique terms. Notes: 1. IBM defines a physical processor in a computer as a functional unit that interprets and executes instructions. A physical processor consists of at least an instruction control unit and one or more arithmetic and logic units. 2. Multicore technology allows two or more processors (commonly called cores) to be active on a single silicon chip. With multicore technology, IBM considers each core to be a physical processor. For example, in a dual-core chip, there are two physical processors residing on the single silicon chip. 3. The program may not run on some or all of the processors for which PoEs are required by the program's valuation method. 4. In the System z IFL environment, each IFL engine is considered a single physical processor. 5. Threading, a technique which makes a single processor seem to perform as two or more, does not affect the count of physical processors. 6. Where blade technology is employed, each blade is considered a separate server and charging is based upon the total number of processors on the blades with which the program is affiliated. 7. Not all processors require the same number of Value Unit entitlements. To determine the number of Value Unit entitlements required, refer to the processor Value Unit conversion table on the Passport Advantage Web site Millions of Service Units (MSUs) MSUs is defined as Millions of Service Units (MSUs) per hour. Units of workload capacity of an eligible machine. The number of MSUs per machine type/model is published by IBM and can be viewed online at rver/zseries/library/swpriceinfo/ For more detailed information about System z software pricing, go to eries/library/refguides/sw_pricing.html Network node or node Network nodes include routers, switches, hubs, and bridges that contain a network management agent. A single network node may contain any number of interfaces or ports. Partitions A server's resources (CPU, memory, I/O, interconnects, and buses) may be divided according to the needs of the applications running on the server. This partitioning can be implemented with physical boundaries (Physical Partitions) or logical boundaries (Logical Partitions). Physical Partitions are defined by a collection of processors dedicated to a workload and can be used with systems that have either multiple cards or multiple frames, each of which can be configured independently. In this method, the partitions are divided along hardware boundaries and processors, and the I/O boards, memory, and interconnects are not shared. Logical Partitions are defined by software rather than hardware and allocate a pool of processing resources to a collection of workloads. These partitions, while separated by software boundaries, share hardware components and run in one or more physical partitions. Port IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 10

11 A port is the physical connection between a device and the network. Processor (per processor charging under full capacity) In full capacity charging, PoE must be acquired for all activated processors (available for use) that are on the server where the program or a component of the program is run. Notes: 1. IBM defines a physical processor in a computer as a functional unit that interprets and executes instructions. A physical processor consists of at least an instruction control unit and one or more arithmetic and logic units. 2. Multicore technology allows two or more processors (commonly called cores) to be active on a single silicon chip. With multicore technology, IBM considers each core to be a physical processor. For example, in a dual-core chip, there are two physical processors residing on the single silicon chip. 3. In the System z IFL environment, each IFL engine is considered a single physical processor. 4. Threading, a technique which makes a single processor seem to perform as two or more, does not affect the count of physical processors. 5. Where blade technology is employed, each blade is considered a separate server and charging is based upon the total number of processors on the blade on which the program is run. 6. When a server is shipped with six processors, but two of them are inactive, four processors are active for the customer. 7. Not all processors require the same number of Value Unit entitlements. To determine the number of Value Unit entitlements required, refer to the processor value unit conversion table on the Passport Advantage Web Site Server A server is a computer system that executes requested procedures, commands, or applications to one or more user or client devices over a network. A PoE must be obtained for each server on which the program or a component of the program is run or for each server managed by the program. Where blade technology is employed, each blade is considered a separate server. Standby or backup systems For programs running or resident on backup machines, IBM defines three types of situations: cold, warm and hot. In cold and warm situations, a separate entitlement for the copy on the backup machine is normally not required and typically no additional charge applies. In a hot backup situation, the customer needs to acquire other license or entitlements sufficient for that server. All programs running in backup mode must be solely under the customer's control, even if running at another enterprise's location. As a practice, the following are definitions and allowable actions concerning the copy of the program used for backup purposes. Cold: A copy of the program may reside, for backup purposes, on a machine as long as the program is not started. There is no additional charge for this copy. Warm: A copy of the program may reside for backup purposes on a machine and is started, but is idling, and is not doing any work of any kind. There is no additional charge for this copy. Hot: A copy of the program may reside for backup purposes on a machine, is started, and is doing work. The customer must acquire a license or entitlements for this copy and there will generally be an additional charge. Doing work includes, for example, production, development, program maintenance, and testing. It also could include other activities such as mirroring of transactions, updating of files, synchronization of programs, data or other resources (for example, active linking with another machine, program, database or other resource, and so on), or any activity or configurations that would allow an active hot switch or other synchronized switch over between programs, databases, or other resources to occur. In the case of a program or system configuration that is designed to support a high availability environment by using various techniques (for example, duplexing, mirroring of files, or transactions, maintaining a heartbeat, active linking with another machine, program, database, or other resource), the program is considered to be doing work in the hot situation and a license or IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 11

12 entitlement must be purchased. Terabyte (T/TB) 1 terabyte of managed storage = 2 to the power of 40 bytes = 1,099,511,627,776 bytes, trillion bytes. Tivoli Management Points A Tivoli Management Point is a metric used to compute license quantities and is program specific. Value Units A Value Unit is a pricing charge metric for program license entitlements, which is based upon the quantity of a specific designated measurement used for a given program. Each program has a designated measurement. The most commonly used designated measurements are processor cores and MSUs. However, for select programs, there are other designated measurements such as servers, users, client devices, and messages. The number of Value Unit entitlements required for your specific implementation of the given program must be obtained from a conversion table associated with the program. You must obtain a PoE for the appropriate number of Value Unit entitlements for your implementation. The Value Unit entitlements of a given program cannot be exchanged, interchanged, or aggregated with Value Unit entitlements of another program. Whenever the designated measurement is a processor core, not all processors require the same number of Value Unit entitlements. To determine the number of Value Unit entitlements required, refer to the processor Value Unit conversion table on the Passport Advantage Web site. /sw-lotus/services/cwepassport. nsf/wdocs/pvu_table_for_customers Product and licensing Web sites A complete list of IBM Tivoli products is available at IBM Tivoli product licensing documents are available at System z software pricing examples (MSU based) The pricing example below should be used to determine required license entitlements for the following software products for System z: Product Value Unit Exhibit (VUE) IBM Tivoli Compliance Insight Manager Enable for z/os IBM Tivoli zsecure Admin IBM Tivoli zsecure Alert IBM Tivoli zsecure Audit IBM Tivoli zsecure CICS Toolkit IBM Tivoli zsecure Command Verifier IBM Tivoli zsecure Visual System z server 1,000 MSU System z server with 25 engines VUE020 VUE020 VUE020 VUE020 VUE020 VUE020 VUE020 All products for this example listed above employ Value Unit slope Value Unit Exhibit 020 (VUE020). Translation from MSUs to Value Units: VUE020 MSUs Value Units/MSU Base Tier A Tier B IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 12

13 Tier C Tier D If the customer has installed 1,000 MSUs, the applicable number of Value Units will be: Value Value Level MSUs Units/MSU Units Base Tier A Tier B Tier C Tier D Total 1, When calculating the total number of Value Units, the sum is rounded up to the next integer. In this example, the customer will need to license 46 Value Units. Note: IBM RACF for z/os (a separate IBM MLC offering) or a comparable competitive offering (CA ACF2 or CA Top Secret) is a prerequisite for the IBM Tivoli zsecure suite. For more information on RACF, refer to Scenario 1: MSU-based pricing Transaction 1 Enterprise ABC initially wants to work with the following system configuration: On one System z server with 1,000 MSUs, they want to run IBM Tivoli zsecure Audit and zsecure Alert. The same calculation applies to both Audit and Alert components: Value Value Level MSUs Units/MSU Units Base Tier A Tier B Tier C Tier D Total 1, The customer must purchase 46 Value Units for Audit and 46 Value Units for Alert. Transaction 2 After the initial purchase, enterprise ABC wants to expand their use of the zsecure suite to include the IBM Tivoli zsecure Command Verifier, Admin, Visual, and CICS Toolkit, along with the IBM Tivoli Compliance Insight Manager Enabler for z/os. IBM Tivoli Compliance Insight Manager is sold separately through distributed pricing structures. Refer to the separate software announcement and pricing example for Tivoli Compliance Insight Manager. The same calculation applies to each of these components: Value Value Level MSUs Units/MSU Units Base Tier A Tier B Tier C Tier D Total 1, The customer must purchase 46 Value Units for each of Command Verifier, Admin, Visual, CICS Toolkit, and Tivoli Compliance Insight Manager Enabler. Ordering information IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 13

14 Ordering z/os through the Internet ShopzSeries provides an easy way to plan and order your z/os ServerPac or CBPDO. It will analyze your current installation, determine the correct product migration, and present your new configuration based on z/os. Additional products can also be added to your order (including determination of whether all product requisites are satisfied). ShopzSeries is available in the U.S. and several countries in Europe. In countries where ShopzSeries is not available yet, contact your IBM representative (or IBM Business Partner) to handle your order via the traditional IBM ordering process. For more details and availability, visit the ShopzSeries Web site at bapp/shopzseries/shopzseries.jsp The products in this announcement have one charge unit Value Units. Translation from MSUs to Value Units example using VUE001 MSUs Value Units/MSU Base Tier A Tier B Tier C Tier D Note: For the actual translation from MSUs to Value Units for this product, refer to the table that follows. Ordering example: The total number of Value Units is calculated according to the following example. If the customer has installed 1,000 MSUs, the applicable Value Units would be: Translation from MSUs to Value Units (VUE001) MSUs * Value Units/MSU = Value Units Base 3 * 5.25 = Tier A 42 *.83 = Tier B 130 *.35 = Tier C 140 *.26 = Tier D 685 *.20 = Total 1, When calculating the total number of Value Units, the sum is to be rounded up to the next integer. Value Units for non-msu-based S/390 processors using VUE001: MP3000 models H30 = Value Units per machine H50 = Value Units per machine H70 = Value Units per machine ESL models = 9.00 Value Units per machine Basic license Single version charging: To elect single version charging, you must notify and identify to IBM the prior program and replacement program, and the machine the programs are operating on. Current licensees Current licensees, with support in effect, will receive instructions on how to order this update. Current licensees of IBM Tivoli zsecure V1.8.1 must place a new order to obtain the new IBM Tivoli zsecure V1.9 distribution medium. New licensees IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 14

15 Orders for new licenses will be accepted now. Shipment will begin on the planned availability date. Basic license This table should be used for all zsecure PIDs. Value VUE020 MSUs Units/MSU Base Tier A Tier B Tier C Tier D To order, specify the program product number and the appropriate license or charge option. Also, specify the desired distribution medium. To suppress shipment of media, select the license-only option in CFSW. Program name: IBM Tivoli zsecure Admin Program PID: 5655-T01 S01471B zsecure Admin Basic OTC, per Value Unit supply ID Language Distribution medium S01472B English 3480 tape cartridge Subscription and Support PID: 5655-T03 S01471M zsecure Admin S&S Basic ALC, per Value Unit SW S&S no charge, decline SW S&S per MSU SW S&S registration supply ID Language Distribution medium S01472L English Hardcopy publication Ordering information for On/Off Capacity on Demand (CoD) IBM Tivoli zsecure Admin is eligible for On/Off CoD with a temporary use charge calculated based on MSUs per-day usage. Program name: IBM zsecure Admin Program PID: 5655-T01 S01471B zsecure Admin Basic OTC, per MSU-day TUC Program name: IBM Tivoli zsecure Audit Program PID: 5655-T02 S01471C S01471D S01471F RACF ACF2 Top Secret Basic OTC, per Value Unit IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 15

16 supply ID Language Distribution medium English 3480 tape cartridge S01472G RACF S01472J ACF2 S Top Secret Subscription and Support PID: 5655-T04 S01471N S01471P S01471R RACF S&S ACF2 S&S Top Secret S&S Basic ALC, per Value Unit SW S&S no charge, decline SW S&S per MSU SW S&S registration supply ID Language/Description Distribution medium English Hardcopy publication S01472N S01480L S01474H RACF ACF2 Top Secret Ordering information for On/Off CoD IBM Tivoli zsecure Audit is eligible for On/Off CoD with a temporary use charge calculated based on MSUs per-day usage. Program name: IBM zsecure Audit Program PID: 5655-T02 S01471C S01471D S01471F RACF ACF2 Top Secret Program name: IBM Tivoli zsecure CICS Toolkit Program PID: 5655-T05 Basic OTC, per MSU-day TUC S01471S zsecure CICS Toolkit Basic OTC, per Value Unit supply ID Language Distribution medium S01472R English 3480 tape cartridge Subscription and Support PID: 5655-T06 S01472T zsecure CICS Toolkit Basic ALC, per Value Unit SW S&S S&S no charge, decline SW S&S per MSU SW S&S registration supply ID Language Distribution medium S01472V English Hardcopy publication Ordering information for On/Off CoD IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 16

17 IBM Tivoli zsecure CICS Toolkit is eligible for On/Off CoD with a temporary use charge calculated based on MSUs per-day usage. Program name: IBM Tivoli zsecure CICS Toolkit Program PID: 5655-T05 S01471S zsecure CICS Basic OTC, per MSU-day TUC Toolkit Program name: IBM Tivoli zsecure Command Verifier Program PID: 5655-T07 S01471T zsecure Command Verifier Basic OTC, per Value Unit supply ID Language Distribution medium S01472X English 3480 tape cartridge Subscription and Support PID: 5655-T08 S01471V zsecure Command Basic ALC, per Value Unit SW S&S Verifier no charge, decline SW S&S per MSU SW S&S registration supply ID Language Distribution medium S English Hardcopy publication Ordering information for On/Off CoD IBM Tivoli zsecure Command Verifier is eligible for On/Off CoD with a temporary use charge calculated based on MSUs per-day usage. Program name: IBM zsecure Command Verifier Program PID: 5655-T07 S01471T zsecure Command Basic OTC, per MSU-day TUC Verifier Program name: IBM Tivoli zsecure Visual Program PID: 5655-T09 S01471X zsecure Visual Basic OTC, per Value Unit supply ID Language Distribution medium S01471Z English 3480 tape cartridge Subscription and Support PID: 5655-T10 S zsecure Visual S&S Basic ALC, per Value Unit SW S&S IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 17