4.7 Cryptographic functions 4.7.1 CPACF functions (FC 3863) 4.7.2 Crypto Express6S feature (FC 0893) 4.7.3 Crypto Express5S feature (FC 0890) Cryptographic functions are provided by the CP Assist for Cryptographic Function (CPACF)  and the PCI Express cryptographic adapters. z14 ZR1 servers support the Crypto Express6S  feature. FC 3863$^{11}$ is required to enable CPACF functions. Crypto Express6S is a new feature on z14 ZR1 servers. On the initial configuration, a  minimum of two features are installed. The number of features then increases one at a time  up to a maximum of 16 features.  Each Crypto Express6S feature holds one PCI Express cryptographic adapter. Each adapter  can be configured by the installation as a Secure IBM Common Cryptographic Architecture  (CCA) coprocessor, as a Secure IBM Enterprise Public Key Cryptography Standards (PKCS)  #11 (EP11) coprocessor, or as an accelerator. The tamper-resistant hardware security module, which is contained on the Crypto Express6S  feature, conforms to the Federal Information Processing Standard (FIPS) 140-2 Level 4  Certification. It supports User Defined Extension (UDX) services to implement cryptographic  functions and algorithms (when defined as an IBM CCA coprocessor). The following CCA compliance levels are available: The following EP11 compliance levels are available (Crypto Express6S and Crypto  Express5S): Each Crypto Express6S feature occupies one I/O slot in the PCIe I/O drawer, and features no  CHPID assigned. However, it includes one PCHID. Crypto Express5S was introduced from z13 servers. On the initial configuration, a minimum  of two features are installed. The number of features then increases one at a time up to a  maximum of 16 features.  Each Crypto Express5S feature holds one PCI Express cryptographic adapter. Each adapter  can be configured by the installation as a Secure IBM CCA coprocessor, as a Secure IBM  Enterprise Public Key Cryptography Standards (PKCS) #11 (EP11) coprocessor, or as an  accelerator. GLYPH<SM590000> Non-compliant (default) GLYPH<SM590000> PCI-HSM 2016 GLYPH<SM590000> PCI-HSM 2016 (migration, key tokens while migrating to compliant) GLYPH<SM590000> FIPS 2009 (default) GLYPH<SM590000> FIPS 2011 GLYPH<SM590000> BSI 2009 GLYPH<SM590000> BSI 2011 11 Subject to export regulations. Chapter 4. Central processor complex I/O system structure  159