To optimize performance you can define the
CSFOWH (hash) and
CSFRNG (random number) profiles in the
XFACILIT class. This will disable SAF/RACF checks for these profiles. ICSF uses CPACF instructions for these anyway and CPACF instructions cannot be protected by SAF/RACF. Consult your security team to make sure this is acceptable.
Example: RACF instructions
RDEFINE CSF.CSFSERV.AUTH.CSFOWH.DISABLE CLASS(XFACILIT) UACC(READ) RDEFINE CSF.CSFSERV.AUTH.CSFRNG.DISABLE CLASS(XFACILIT) UACC(READ) SETROPTS CLASSACT(XFACILIT) SETROPTS RACLIST(XFACILIT) REFRESH