Plan IBM i security work around application reality
IBM i security services is an MMC enquiry for assessing and improving an agreed part of the environment using suitable Fortra capabilities and delivery arrangements. The starting point is current authority, access paths, application dependencies and the customer’s control objectives. A broad security label is not a substitute for specifying the work.
Discovery should distinguish configuration evidence, monitoring gaps and proposed preventive changes. Confirm supported product versions and the platform release. Involve the application owner where historical profiles, shared identities or special authorities affect business operations. Record uncertainty rather than claiming every retained configuration is unnecessary.
Prioritise and validate approved remediation
Review findings with system and risk owners, then agree which changes can proceed and which require application testing or another project. Pilot relevant policies using safe accounts and representative workloads. A reduction in authority is useful only when necessary business tasks still work through an approved access model.
Handover should include the assessed boundary, baseline, decisions, exceptions and evidence from selected tests. For UAE requirements, the customer’s authorised governance team should determine applicable controls and required assurance. MMC can scope named assessment and configuration tasks; certification, unlimited remediation and a continuously staffed SOC need separate commitments.
Evidence to request for this scope
- Agree the IBM i systems, access paths and security controls included in the engagement.
- Validate proposed changes with application owners and an approved recovery method.
- Retain findings, exceptions, tested settings and the owner of each remaining risk.