① Journal · Renewal negotiation
RACF rarely shows up as a line you negotiate on its own. It is a priced feature riding the z/OS Monthly License Charge stack, so the number moves with the peak, not with a discount. Five factors decide what you pay, and the buyers who win read the stack before they read the quote.
RACF is priced on the peak it rides, not the product alone.
RACF, the Resource Access Control Facility from IBM (International Business Machines), is the external security manager that guards access to the entire mainframe, alongside the Broadcom (CA) products ACF2 and CA Top Secret. It is an optional priced feature of the z/OS Security Server, and in most estates its charge sits inside the z/OS Monthly License Charge stack, metered against the rolling four hour average peak and reported each month through the Sub-Capacity Reporting Tool. That is the detail most renewal conversations miss: there is rarely a standalone RACF discount to chase, because the charge moves with the managed peak and the structure of the MLC stack it rides on.
That reframes the exercise. The buyers who win arrive having validated the sub-capacity peak and the way the stack aggregates, understood what Tailored Fit Pricing would do to the security feature, and decided whether a costed alternative is worth building at all on a product this sticky. The five factors below run roughly in order of how much they move, the peak and the stack first, the alternative and timing last. Read this with our IBM publisher hub and our explainer on the Sub-Capacity Reporting Tool.
Each factor and which direction it moves the RACF charge
| Factor | What it moves | When it pays most |
|---|---|---|
| The R4HA peak | The sub-capacity charge the MLC feature is billed against | Where peaks run unmanaged and soft capping is absent |
| MLC stack structure | How the feature aggregates with the rest of the z/OS stack | Across a Parallel Sysplex eligible for aggregation |
| Tailored Fit Pricing | Whether the feature folds into a committed annual baseline | Before the baseline is locked, not after |
| A costed alternative | Whether the vendor prices an implausible exit or a real one | Rarely, given how hard an ESM is to displace |
| Timing and the term | The leverage window and the consumption protections | At the term boundary, before the baseline sets |
Pricing model names and feature structures change; verify the current ones on your own z/OS agreement at the time of negotiation. The order is the durable part: the peak and the stack set the floor, and Tailored Fit Pricing and timing price what is left.
As an MLC feature, RACF is billed against the rolling four hour average peak of the LPARs it runs in, not against a separate security metric. The single largest lever is therefore peak discipline: soft capping, smoothing batch and online so they do not collide in the same hour, and routing eligible work to specialty engines. Shave the peak and you shave the feature, because the security charge moves with the stack it sits in.
The peak you do not manage is the peak you pay for.
Where the estate runs an actively coupled Parallel Sysplex, the MLC stack aggregates across the images and the base is charged once, which changes what the security feature contributes to the bill. Confirm how your stack aggregates before the renewal, because the same RACF footprint costs differently depending on whether it is priced per machine or across the sysplex.
Aggregation decides what the feature really costs.
Under the container model the security feature stops being a peak line and folds into a committed annual MSU baseline. That can simplify the bill, but a baseline set from an inflated historic year becomes the floor every future year builds on. Stress test the baseline before it locks and model it forward across the full term, because the commitment is far easier to set high than to bring back down.
A baseline set high once is paid high every year.
An external security manager is among the hardest products to displace, because moving from RACF to ACF2 or CA Top Secret touches every protected resource and is multi year work. A costed exit view is worth building where the wider security strategy already points to a change, but on a stable estate the alternative rarely carries a RACF negotiation the way it carries a tools renewal. Spend the leverage where it actually moves the number.
Know which levers are real before you reach for them.
Leverage exists in a window before the term ends and, for Tailored Fit Pricing, before the baseline is committed. Start early enough to validate the peak, confirm the aggregation, and model the container scenario, then write consumption protections and review points into the close so a flat estate does not carry a compounding charge for standing still.
Start before the baseline becomes the floor.
④ The order that wins
RACF is priced by the stack it rides, not the product. Read the peak first, then the baseline. Shave the peak, stress the baseline, and price what is left.
Typical reduction negotiated on renewal spend
Mainframe spend negotiated on the buyer side
Engagements delivered since 2019
The capacity peak it rides. RACF is an optional priced feature of the z/OS Security Server, and its charge typically sits inside the MLC stack, metered against the rolling four hour average peak through SCRT. Managing that peak and reading the stack structure, not chasing a standalone discount, is where the recoverable cost sits.
Yes, which is why the alternative rarely carries the negotiation. A security manager touches every protected resource, so migrating to ACF2 or CA Top Secret is multi year work. A costed exit view matters where the security strategy already points to change, but on a stable estate the peak and the stack move the number.
It folds the feature into a committed annual baseline rather than a separate peak line. That can simplify the bill, but the baseline becomes the floor every future year builds on, so stress testing it before it locks and modeling it across the full term is the work that protects the cost.
Early enough to validate the peak, confirm aggregation, and model the container scenario before the term boundary or the baseline commitment. See our IBM mainframe cost optimization and MSU optimization service.
Related: IBM publisher hub · ACF2 renewal · IBM Z Workload Scheduler renewal · SCRT explained
Audit notice or renewal under 18 months out? We mobilize within 48 hours.
Get expert help →