RACF was active with PROTECTALL(FAILURES) — no unprotected datasets - CICS transaction security was enabled for the primary claims processing transactions - DB2 connection control via RACF DSNR class was properly configured - SMF recording was active for types 30, 80, and 102