RACF is IBM’s Resource Access Control Facility, an access control system for mainframe resources and users. Security teams use it to enforce who can sign on, access datasets, run jobs, and administer the system, and they review privileged profiles, authority changes, and suspicious access attempts.
What RACF Does in Mainframe Security
RACF sits at the centre of z/OS access control, so its job is not just to authenticate a user, but to decide whether that user, job, or service identity can reach a dataset, transaction, command, or administrative function. On mainframes, that makes it a core enforcement point for both business access and system protection.
Because RACF controls access to sensitive resources at scale, it often becomes the policy layer where organisations separate ordinary use from privileged administration. That separation matters most when a profile grants broad authority, when access is inherited through groups, or when legacy permissions were granted long before current governance practices existed.
How RACF Enforces Access on z/OS
RACF works by binding identities to permissions and then checking those permissions whenever a protected resource is requested. The practical effect is a controlled gate around datasets, started tasks, commands, and other mainframe assets, with rule sets that can be as broad or as precise as the organisation designs them to be.
In day-to-day operations, this means RACF policies can support both routine access and strict segregation of duties. A well-designed profile structure helps prevent a user from signing on, reading data, or running a job unless that action has been explicitly allowed through the access model in force.
For teams that manage broader mainframe identity architecture, the useful comparison is with adjacent controls such as ACF2 or Top Secret, because the security objective is the same even when implementation details differ. Mainframe Identity and RACF Security Guide is the best starting point when you need to connect RACF to the wider z/OS access model.
Common RACF Administrative and Audit Concepts
RACF is not only about allowing or denying access. Administrators also have to manage privileged profiles, authority changes, group structure, resource ownership, and audit evidence, all of which affect whether access decisions remain trustworthy over time.
Those operational details matter because many mainframe security failures come from drift rather than from a single bad rule. A dormant privileged profile, an overbroad group assignment, or an exception that was never removed can create a long-lived exposure even when the original system design was sound.
Audit review is therefore part of the control itself. Organisations typically look for who changed authority, what resources were touched, and whether access attempts match expected behaviour for a user, batch job, or privileged operator.
Why RACF Still Matters in Modern Mainframe Environments
RACF remains important because mainframes still host high-value workloads, regulated records, and long-lived operational processes. In that environment, access control is not a niche administrative function, it is part of the system’s trust boundary and often the last line between ordinary processing and privileged misuse.
Modern risk comes from the same basic pattern across many environments: excessive privilege, weak review of inherited access, and incomplete visibility into who can do what. On a mainframe, those weaknesses can be especially consequential because one profile or authority change may affect a large amount of data and processing capacity.
Teams should think of RACF as both a runtime gate and a governance record. If the policy model is accurate, it supports clean separation of duties, auditable control, and predictable access behaviour. If it drifts, it can quietly accumulate broad authority that is difficult to spot until something goes wrong.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | RACF governs user and privileged access assignments across mainframe resources. |
| AC-6 — Least Privilege | RACF access rules should limit each user or job to only the rights it needs. | |
| AU-2 — Event Logging | RACF decisions and authority changes are security events that need auditable records. | |
| Recommendation — Review RACF accounts and group memberships regularly and remove unnecessary access promptly. Constrain RACF profiles and default access to the minimum authority required for each role. Log RACF changes and privileged access attempts so reviewers can trace who did what and when. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | RACF is a primary technical mechanism for enforcing access-control policy on mainframe assets. |
| A.8.5 — Secure authentication | RACF sign-on controls rely on secure authentication before access is granted. | |
| A.8.15 — Logging | RACF authority changes and access attempts should be recorded for review and investigation. | |
| Recommendation — Define and enforce RACF access rules that match the organisation’s access-control policy. Use strong authentication requirements for RACF-protected mainframe access paths. Retain and review RACF logs to support detection of suspicious access and privilege changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | RACF administration is fundamentally account and privilege governance on a mainframe. |
| CIS-6 — Access Control Management | RACF is the enforcement layer for who can reach protected datasets and administrative functions. | |
| Recommendation — Inventory RACF accounts, privileged profiles, and group assignments, then remove stale access. Use RACF rules to enforce least privilege and limit access to approved mainframe resources. | ||