It is a good product. It has been used for years. As long as it is configured correctly, it is a very stable product. It depends on how an institution or a company configures it. It depends on an institution's risk appetite. You need to make sure it is configured as per the concept of least privilege, and the logging features, detection and control mechanism, and other things like that are enabled. If you configure it to give access to the public, then there could be compromises. You should also have someone who independently checks it to make sure that it is configured keeping security in mind.

If it has been configured for a while, when there are enhancements to the product or when you enhance it, you need to make sure that security is also looked at, and it is configured according to an institution's security policies.

I would rate it a nine out of 10.

Capture your intentions as requirements and do not lose the requirements. Test the resulting implementation to confirm it meets requirements as documented. Any changes based on test-driven development need to be properly documented and approved.

I rate the product about eight out of ten considering the wealth of automated processes. Removing the need for human intervention makes the product valuable. It is only an eight and not a ten because there is still room for improvement.

Make sure that your people are well trained so that they understand the product properly, before they implement it.

Reliability, responsiveness and quality are important criterias to look for when selecting a vendor.

ACF2 was installed here in 1985, probably because MVS security, at that time, was very limited.

Know that this tool is a great tool. It is a good tool to use. You can quickly automate, quickly provision, and deprovision new users, which is essential when you are bringing new people onboard. We have people coming and going all the time. So, you need a tool like this. CA ACF has a similar tool that we are trying to adopt, by the way, which would help us to quickly assign rules to users and remove rules from users.