Is it safe to write a KSDS that CICS is also updating?

Not without RLS or DFSMStvs. SHAREOPTIONS(3,3) is not enough when CICS is also updating the same KSDS. Treat concurrent writes from Z Gateway and CICS as unsafe unless the file is under record-level sharing or transactional VSAM.