Dual control function for DASD Config

Within the DS8K there is protection in place that a (malicious) person is not able to delete/alter devices that are part of safeguarded copies.

We have a cybervault LCP setup to ensure we have immutable backups of our systems, and activated Dual Control function for additional protection within GDPS LCP itself.

So changes to the LCP profiles and/or safeguarded devices within these profiles are protected to be altered by 1 single person.

This way 1 single person is not able to get you in a situation where you end up with less immutable backups then there are supposed to be (by decreasing retention time), or that you have incomplete captures because devices have been excluded from new captures.

In our shop we have a Metro Mirror 2 Site, expanded with a GM physical airgap solution for LCP. By default this is a cascaded setup, so MM from RS1-RS2 and GM from RS2-RS3.

We need the next step in protecting the immutable backups by bringing the DASD config under a dual control function as well. Because a single person can now still remove a device from MM dasd config causing GDPS MM to not care about this device anymore.
After that the person can execute DELPAIR command, causing LCP to take captures of a device that is not being updated anymore.

As long as devices are under GDPS supervision, then GDPS can warn about any undesired status of those devices for us to act upon. Therefor changes to dasd config should be under dual control function as well.

Changes to the DASD Config for GM/LCP (in our setup) are being checked to see that no devices are removed that do not have Save2Delete status. But dual control on this could might be desired for other sites to protect GM config.