Mainframe expert and commentator Andy McCandless recently penned an insightful article on a fresh challenge for the insurance industry – namely IT’s obligations regarding new ISO regulations. The article highlights emerging trends in support of data compliance and security requirements. Referencing ISO 27002:2022 Controls 8.25 through 8.34, he introduces the emerging critical best practice of segregating production and non-production activities in IT delivery, as the sector strives to meet increasing regulatory obligations.

And, while not a legal requirement (ISO is a voluntary international standard), national laws (e.g. DORA, GDPR) and increasing contractual mandates across the sector are increasing the pressure for transparent compliance of best practices.

Segregation sensibly attempts to remove any potential sharing of critical, confidential information (the most evident of which would be customer data), where it shouldn’t happen. Primarily, this means protecting live customer data to only be used in a production context.

Practical Challenges

However, segregation is not without inherent challenges. As he explains, “Many organisations recognise the importance of segregated development and testing environments, but implementation can become challenging in traditional mainframe estates where infrastructure resources are finite. Not every insurer or financial institution has access to unlimited LPAR capacity or dedicated non-production environments that can remain permanently available”.

One option in those cases where processing loads see variable spikes, he notes that some organizations, “reduce or temporarily suspend development and test workloads during peak production periods”.

This echoes the findings of the 2025 Mainframe Market Survey, which reported that 88% of respondents had “material concerns about the availability of mainframe environments”. With shared LPARs, limited or sporadic access, and tighter mandates on processes, this has the potential to slow down mainframe delivery teams at a time when pressures to accelerate the delivery of valuable services is at a premium.

For many organizations, the seemingly impossible trade-off between cost, speed of delivery and risk looms ever larger.

Time To Go On-Demand?

McCandless then ventures, “Organisations struggle with the availability of non-production environments, which is why virtualised, instantly available z/OS environments are becoming increasingly important”.

Such virtualized mainframe environments can represent a genuine option for those caught in this position. The PopUp Mainframe solution has provided the insurance and other industries a level of unparalleled flexibility in terms of virtualized z/OS access across a range of non-production activities (dev, test, training, R&D).

He adds, “The [environments] provide the flexibility organisations need to support faster delivery cycles, regulatory compliance activities, and more resilient development processes”.

Fully Featured, Virtually Delivered

It is easy to argue for a virtual mainframe in principle, but a segregated environment must also meet the practical requirements of modern mainframe teams. For today’s mainframe technician, that would usually mandate the following capabilities.

• It looks and feels like the user’s mainframe. From z/OS 2.5 onwards, PopUp Mainframe provides a fully compatible environment that behaves like a physical mainframe running the same operating system.
• It supports the same tools the user relies on today. As a fully compatible environment, PopUp Mainframe runs the system and vendor software expected in a mainframe estate, including Db2, CICS, COBOL, and development tools such as IDZ.
• It is available on demand. The underlying technology allows the user to start a PopUp Mainframe instance in minutes and shut it down just as quickly, making it a genuinely flexible non-production environment.
• It shields the user from the constraints of a shared LPAR. Because shared environments can allow one person’s error to disrupt others, PopUp Mainframe can provide a dedicated instance when isolation is needed.
• It still supports collaboration when required. For shared activities such as collaborative development, system testing, or integration testing, PopUp Mainframe can also provide a common instance for teams to work together.
• It must remain secure and low risk. PopUp Mainframe behaves like z/OS on a physical mainframe, so it works with the installed security environment, TSO credentials, and other controls. Data masking capabilities also help keep non-production activity compliant. In addition, PopUp’s FastTrack feature allows the user to roll back to a previous known state after a serious error, enabling rapid recovery after a failed test, for example.

Learn More

Embracing change with modern innovation is business-as-usual for mainframe organizations across all sectors. With customers from the insurance industry and beyond, PopUp Mainframe is a road-tested answer to a variety of topical challenges. Learn more about our latest products here. Also, join us at our new series of webinars, targeting various functions in the mainframe team. Learn more about the series and register to attend here.