Operations

IBM i Security Checklist

One item per control, organized by architecture layer. Use this alongside the Security Assessment and Hardening Guide, not as a replacement for either.

Last verified

This checklist is organized to match the architecture stack: identity, privileged access, authority, encryption, database security, auditing, and network security. It is deliberately concrete, each item is something you can verify as done or not done, rather than a vague best-practice statement.

Identity & MFA

  • MFA deployed on 5250 sign-on
  • MFA deployed on FTP, ODBC, JDBC, and remote command exit points
  • Service account MFA exemptions documented and reviewed
  • Break-glass emergency access path tested

Privileged Access

  • Every profile with *ALLOBJ or *SECADM inventoried
  • QSECOFR password rotated and not shared for daily use
  • Elevated access time-boxed and logged, not standing
  • Privileged session logs forwarded to SIEM

Authority Management

  • Authority collection run within the last 12 months
  • *PUBLIC authority reviewed on production libraries
  • Group profiles used for role-based authority, not one-off grants
  • Adopted authority used for application elevation instead of widening user profiles

Encryption

  • Sensitive fields (PII, payment data) encrypted at rest
  • Encryption keys stored separately from the encrypted data
  • TLS enforced (not just available) for 5250 and FTP sessions
  • SSH used instead of Telnet for administrative access

Database Security

  • RCAC evaluated for sensitive tables (IBM i 7.2+)
  • View-based restriction confirmed to not be bypassable via base file authority
  • ODBC/JDBC access to sensitive tables reviewed

Auditing & Logging

  • QAUDCTL / QAUDLVL configured, not disabled
  • Object-level journaling enabled on sensitive application files
  • QAUDJRN output reviewed on a defined schedule with a named owner
  • Security events forwarded to a SIEM

Network Security

  • Exit-point programs registered on FTP, ODBC, DDM, remote command
  • Exit-point rules tested against real traffic before enforcement
  • Unused or forgotten network server access disabled