IBM i Security Architecture Guide
IBM i security is not one control, it is a stack. Each layer below depends on the ones before it: authentication is worthless if authority is unmanaged, and authority is worthless if there is no auditing to catch misuse.
The stack below reflects the order we recommend addressing IBM i security architecture in, not an arbitrary list. Multi-factor authentication establishes who is on the system. Privileged access management controls what elevated profiles can do once signed on. Authority management right-sizes what every other profile can touch. Encryption and database security protect the data itself. Auditing and logging catch what the earlier layers miss. Each guide below covers requirements, implementation, and the vendors that cover that layer well.
Multi-Factor Authentication
Options, requirements, and implementation for MFA on IBM i, including 5250 and exit-point coverage.
Privileged Access Management
Controlling and logging use of elevated authority profiles.
Authority Management
Object authority, special authorities, and adopted authority done right.
Auditing & Logging
Journal-based audit configuration and what to actually monitor.
Encryption
Field-level and full-database encryption at rest and in transit.
Database Security
Row and column access control and Db2 for i-specific protections.