① Comparison · z/OS security
Broadcom (CA) Top Secret and IBM RACF are two of the three external security managers for z/OS. Top Secret is a separate Broadcom line item priced on MSU. RACF rides inside the z/OS stack you already own. As Broadcom renewal uplifts climb, more buyers ask whether to migrate. The security manager is the deepest switch on the platform, so the answer turns on leverage and program risk, not the feature sheet.
If the only driver is the Broadcom (CA) renewal number, prepare the RACF migration as a credible, costed alternative and use it to discipline the Top Secret renewal before you commit to moving. Top Secret and RACF both secure z/OS to the same standard, and the external security manager mediates every access decision through rules and exits built up over years, so a migration is a staged security program with real operational risk, not a cost exercise. Migrate when consolidation into the IBM stack is happening anyway, when Broadcom support direction makes the incumbent untenable, or when a fully scoped RACF program clears its own risk bar. Otherwise the prize is usually a better deal on Top Secret, won because the RACF option is real and ready.
The function is close. The differences that decide cost and effort sit in ownership, the licensing vehicle, and the migration path:
| Dimension | CA Top Secret | IBM RACF |
|---|---|---|
| Vendor | Broadcom (CA) | IBM |
| Delivery | Standalone external security manager | IBM Security Server component of z/OS |
| Licensing metric | MSU capacity | z/OS MLC, sub-capacity via SCRT |
| Contract vehicle | Broadcom portfolio agreement or MCL | Inside the z/OS stack entitlement (IPLA / MLC) |
| Negotiated as | Named Broadcom line item | Bound into the z/OS position |
| Renewal pattern | Uplifts of 30 to 80 percent commonly observed on uncapped portfolios | Moves with z/OS capacity and sub-capacity reporting |
| Migration direction | Source: rules, exits, and profiles to translate out | Target: RACF database, profiles, and exits to build |
| Switching cost | Very high either way; the security manager is the deepest dependency on z/OS | |
Directional and pattern level. Delivery, components, and consumption terms evolve, so confirm the current Top Secret packaging, your Broadcom agreement terms, and the z/OS SCRT position before modeling a renewal or a migration.
For most estates this is a renewal and leverage question first, and a migration question only when the program clears its own bar. Use it this way:
Stay on Top Secret and negotiate if
Genuinely plan the move to RACF if
Either way, treat the migration as a security program with its own risk governance, never as a line on a cost spreadsheet, and use the RACF option primarily to discipline the Top Secret renewal you actually face.
The switch you can credibly make is the leverage. Build it, then decide.
Related comparison: ACF2 vs Top Secret vs RACF for the full three way view, and BMC vs Broadcom. Explainers: MSU explained and the MSU baseline. Hubs and commercial: the Broadcom (CA) buyer side guide, the IBM buyer side guide, and Broadcom (CA) license negotiation. If a renewal uplift is already on the table, see responding to a Broadcom renewal uplift.
Audit notice or renewal under 18 months out? We mobilize within 48 hours.