diff --git a/src/pkcs15init/setcos.profile b/src/pkcs15init/setcos.profile
index 24c6a9bd..1aa2d5a7 100644
--- a/src/pkcs15init/setcos.profile
+++ b/src/pkcs15init/setcos.profile
@@ -7,6 +7,30 @@ cardinfo {
     pin-pad-char	= 0x00;
 }
 
+# Addtional default settings
+option default {
+    macros {
+        protected	= *=$SOPIN, READ=NONE;
+        mf_prot     = *=NONE, CREATE=$SOPIN;  # Allow to delete the MF
+        p15_prot    = *=$SOPIN, SELECT=NONE, FILES=NONE, CREATE=NONE;
+        pin_prot    = *=NEVER, WRITE=$SOPIN, UPDATE=$SOPIN; # WATCH OUT IF YOU CHANGE THESE!!
+        prkey_prot  = *=NEVER, ERASE=$SOPIN, READ=NONE, CRYPTO=$PIN, UPDATE=$SOPIN;
+        exkey_prot  = *=NEVER, ERASE=$SOPIN, READ=$PIN, UPDATE=$SOPIN;
+    }
+}
+
+# Addtional onepin option settings
+option onepin {
+    macros {
+        protected	= *=$PIN, READ=NONE;
+        mf_prot     = *=NONE, CREATE=$PIN;  # Allow to delete the MF
+        p15_prot    = *=$PIN, SELECT=NONE, FILES=NONE, CREATE=NONE;
+        pin_prot    = *=NEVER, WRITE=$PIN, UPDATE=$PIN; # WATCH OUT IF YOU CHANGE THESE!!
+        prkey_prot  = *=NEVER, ERASE=$PIN, READ=NONE, CRYPTO=$PIN, UPDATE=$PIN; # READ: only applies on public key
+        exkey_prot  = *=NEVER, ERASE=$PIN, READ=$PIN, UPDATE=$PIN;
+    }
+}
+
 # Define reasonable limits for PINs and PUK
 PIN user-pin {
     attempts	= 3;
@@ -24,7 +48,7 @@ PIN so-pin {
 # main profile.
 filesystem {
     DF MF {
-        ACL    = *=NONE, CREATE=$SOPIN;  # Allow to delete the MF
+        ACL    = $mf_prot;
         size   = 42;  # size = 2 + 2*(number of sub-files) -> 20 sub-files
 
 		# There's 1 pin/key file
@@ -33,7 +57,7 @@ filesystem {
             structure     = 0x22;  # ISF key-file, Setcos V4.4 specific
             record-length = 28;
             size          = 112;   # 28 * 4 = 112 -> 1 SO + 3 user pins/puks
-            ACL           = WRITE=$SOPIN, UPDATE=$SOPIN; # WATCH OUT IF YOU CHANGE THESE!!
+            ACL           = $pin_prot;
         }
 
         DF PKCS15-AppDF {
@@ -43,54 +67,54 @@ filesystem {
             EF PKCS15-PrKDF {
                 file-id     = 4402;
                 size        = 480;
-                acl         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
 
             EF PKCS15-PuKDF {
                 file-id     = 4403;
                 size        = 480;
-                acl         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
 
             EF PKCS15-CDF {
                 file-id     = 4404;
                 size        = 960;
-                acl         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
 
             EF PKCS15-DODF {
                 file-id     = 4405;
                 size        = 480;
-                acl         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
 
             EF template-private-key {
                 file-id     = 5100;
                 type        = internal-ef;
                 size        = 512;    # enough for a 1024 bit RSA key
-                ACL         = *=NEVER, READ=NONE, CRYPTO=$PIN, UPDATE=$SOPIN; # READ: only for public key
+                ACL         = $prkey_prot;
             }
             EF template-extractable-key {
                 file-id     = 5300;
                 type        = internal-ef;
                 size        = 512;    # enough for a 1024 bit RSA key
-                ACL         = *=NEVER, READ=$PIN, UPDATE=$SOPIN;
+                ACL         = $exkey_prot;
             }
 
             EF template-public-key {
                 file-id     = 5200;
-                ACL         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
 
             EF template-certificate {
                 file-id     = 5500;
-                ACL         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
 
             EF template-data {
                 file-id     = 5000;
                 structure   = transparent;
-                ACL         = *=$SOPIN, READ=NONE;
+                acl         = $protected;
             }
         }
     }