By using TKE 9.0, key material can be copied from smart cards in one TKE zone to smart  cards in another zone. You might have old 1024-bit strength TKE zones, and might want to  move or copy the key material in those zones into a new, stronger TKE zone. To use this  new feature, you create TKE or EP11 smart cards on your TKE 9.0 system. You then  enroll the new TKE or EP11 smart cards in an alternative zone. This process allows you to  copy smart card content from a smart card that is enrolled in the alternative zone. TKE data can be saved to, or restored from, removable media in the same directory  structure they were found on the TKE. Administrators can now use the TKE application to create key parts without opening a  host. This ability allows the key administrator to create key parts while being offline or  before any hosts are defined. This feature can be found in the TKE application under the  Utilities Create CCA key parts  pull-down menu. A new TKE Audit Log application is available for the Privileged Mode Access ID of  AUDITOR. This application provides an easy-to-use interface to view the TKE workstation  security audit records from the TKE workstation. TKE workstations cut an audit record when the TKE starts or when no audit events  occurred during a client-configured duration. The record shows the serial number of the  TKE local crypto adapter and indicates whether the local crypto adapter was changed  since the last check. Depending on the size of a domain group, you might experience performance  improvements with CCA version 5.3 when a Load, Set, or Clear operation is performed  from inside a domain group. For example, if you group all 85 domains on a Host Crypto  Express 5 and issue a Clear New Master Key register operation, the number of commands  that is issued to the module drops from 85 to 1. TKE 9.0 EP11 smart card applet now supports secure key entry of EP11 master key parts. Every domain now can manage a set of parent X.509 certificates for validating operating  X.509 certificates that are used by applications that are running in the domain.  The following features are related to support for the Crypto Express6S with CCA 6.0. The  Crypto Express6S with CCA 6.0 is designed to meet the PCI-HSM PIN Transaction Security  v3.0, 2016 standard: With CCA 6.0, individual domains are in one of the following modes: 246  IBM z15 (8561) Technical Guide GLYPH<SM590000> Key material copy to alternative zone The TKE 9.0 LIC (FC 0879) includes the following features: GLYPH<SM590000> Save TKE data directory structure with files to USB GLYPH<SM590000> Create key parts without opening a host GLYPH<SM590000> New TKE Audit Log application GLYPH<SM590000> Heartbeat audit record GLYPH<SM590000> Performance improvements for domain groups GLYPH<SM590000> Secure key entry on EP11 GLYPH<SM590000> New certificate manager for domains GLYPH<SM590000> Domain mode management – Normal Mode –I m p r i n t  M o d e – Compliant Mode