Home / IBM / zSecure Licensing
① Product · IBM
IBM Security zSecure is an IPLA Value Unit product, not an MLC line. That changes where the cost sits and which levers move it. Here is how the metric works and what to pull at renewal, from the buyer side.
Audit notice or renewal under 18 months out? We mobilize within 48 hours.
Get expert help →IBM Security zSecure is a suite of mainframe security and compliance tools that administer and audit the External Security Managers on IBM Z, namely RACF, ACF2, and Top Secret. The suite spans administration, automated audit and compliance reporting, real time alerting, and command verification. It does not replace the security manager, it sits over it to make administration faster and to evidence compliance. Because it is priced against the capacity it protects, its cost tracks the size of the z/OS estate, not its own footprint.
zSecure is licensed under IBM's International Program License Agreement, or IPLA, not the Monthly License Charge model. That means a one time charge for the license plus an annual Subscription and Support stream that is the part you renew. Capacity is measured in MSU and converted to Value Units through the applicable Value Unit Exhibit, where the per MSU rate falls as capacity rises. Where sub-capacity terms apply, the basis can be the sub-capacity MSU rather than full machine capacity.
| Element | How zSecure is treated |
|---|---|
| Charge model | IPLA one time charge plus annual Subscription and Support |
| Metric | MSU converted to Value Units |
| Conversion | Value Unit Exhibit (regressive curve) |
| Capacity basis | Full capacity, or sub-capacity where eligible |
| Renewable element | Subscription and Support, annual |
Directional summary. The exact Value Unit Exhibit and capacity basis depend on machine model and contract terms.
Three drivers set the zSecure number. The licensed MSU capacity, because the Value Unit charge is converted from the capacity the suite is entitled against, which usually tracks the protected z/OS environment rather than zSecure's own workload. The component set, because Admin, Audit, Alert, Visual, Command Verifier, and the CICS and adapter pieces are entitled separately, so scope creep across modules lifts the bill quietly. And the annual Subscription and Support stream, which compounds year over year and is the line that actually shows up at every renewal even though the license was a one time charge.
The recurring traps are structural. Licensing against full machine capacity when a sub-capacity basis would apply, which can overstate the Value Units materially on a large frame. Capacity growth from a hardware refresh that is never rebaselined, so the entitlement quietly inflates with the box. And component sprawl, where Audit, Alert, or Command Verifier get switched on beyond the entitled set. Because IPLA capacity is a stated figure rather than a metered monthly peak, an estate that has consolidated or shrunk often keeps paying for Value Units it no longer uses, and only a review surfaces it.
The structural lever is the capacity basis: rebaseline the licensed MSU and Value Units against the capacity zSecure actually protects today, and move to a sub-capacity basis where eligible. The scope lever is component consolidation, paying only for the modules in genuine use. The contract levers are a cap on the annual Subscription and Support uplift and aligning the renewal term with the wider IBM negotiation, so the security suite is one lever in a larger deal rather than an isolated renewal the vendor controls. Credible third party RACF administration and compliance tools exist, and naming a real alternative is itself leverage even when migration is not the plan. This is the buyer side work we do on IBM cost optimization.
zSecure is licensed under IBM's International Program License Agreement, or IPLA, not the Monthly License Charge model. It carries a one time charge plus an annual Subscription and Support stream. Capacity is measured in MSU and converted to Value Units through the applicable Value Unit Exhibit, so the larger the licensed capacity, the fewer Value Units per MSU you pay at the margin.
No. As an IPLA product zSecure is licensed against a capacity figure in MSU, converted to Value Units, rather than billed each month on the peak rolling four hour average the way MLC products are. Where sub-capacity terms apply the capacity basis can be the sub-capacity MSU rather than full machine capacity, which is the main structural lever on the number.
The common traps are licensing against full machine capacity when a sub-capacity basis would apply, capacity growth from a hardware refresh that is never rebaselined, and deploying additional zSecure components such as Audit, Alert, or Command Verifier beyond the entitled set. Because IPLA capacity is a stated figure, an estate that has shrunk or consolidated often keeps paying Value Units it no longer needs.
Rebaseline the licensed MSU and Value Units against the capacity zSecure actually protects today, consolidate components down to what is in use, cap the annual Subscription and Support uplift, and align the renewal term with the wider IBM negotiation so the security tool is one lever in a larger deal rather than an isolated line.
Publisher hub: IBM mainframe licensing. Related products: z/OS licensing and z/VM licensing. Related metric: MSU explained. Put it to work: IBM cost optimization.