Master keys: dual control, annual rotation - Data encryption keys: ICSF CKDS, quarterly rotation, RACF CSFKEYS protection - TLS certificates: RACF keyrings, annual renewal - Never embed keys in COBOL source or copybooks