Security and compliance are often among the first concerns IT managers have when considering moving an IBM i environment to the cloud. IBM i has a strong reputation for built-in security, so it is natural to ask whether that security changes when the system moves from an organization’s data center to a cloud or hosted environment.
The short answer: Moving IBM i to the cloud does not automatically make the environment more or less secure. Instead, security responsibilities change.
Some responsibilities move to the cloud provider, while others remain with the customer. New considerations also arise around identity management, network security, encryption, backups, compliance, and monitoring.
Understanding exactly who is responsible for each security control is the foundation of a strong IBM i cloud security strategy.
The Shared Responsibility Model for IBM i Cloud Security
The shared responsibility model is the starting point for understanding security in a cloud or hosted IBM i environment.
In general:
The cloud provider is responsible for security of the cloud, including:
- Physical data center security
- Underlying hardware
- Network infrastructure
- Hypervisor and virtualization infrastructure
The customer remains responsible for security in the cloud, including:
- IBM i operating system configuration
- User profiles and permissions
- Object-level authorities
- Application security
- Data access
- How data is used
The exact division of responsibilities depends on the type of arrangement. An infrastructure-as-a-service environment, fully managed hosting arrangement, and other hosted models may have different responsibility boundaries.
Get Security Responsibilities in Writing
One of the most important conversations to have with an IBM i cloud provider is who is responsible for each security control.
Do not rely on assumptions.
A clearly documented division of responsibility can help identify gaps before they become security problems.
Does IBM i Security Change in the Cloud?
Moving an IBM i partition to a cloud or hosted environment does not inherently weaken IBM i’s core security architecture.
Features such as:
- Object-level security
- System values
- Exit points
- IBM i’s integrated security model
remain properties of the operating system and its configuration, regardless of where the hardware is located.
A properly configured IBM i LPAR in a cloud environment can maintain a strong security posture just as an on-premises system can.
At the same time, cloud migration does not correct existing security problems.
Instead, moving to the cloud often creates an opportunity to identify and address existing security weaknesses because the environment is being reviewed more closely by providers, auditors, and compliance teams.
Identity and Access Management Is Critical
Identity and access management can become more complicated in a hybrid or cloud environment.
An organization may have to manage IBM i user profiles alongside separate identity systems for:
- Cloud infrastructure
- VPN access
- Management consoles
- SaaS applications
- Other systems connected to IBM i
The challenge is not necessarily a weakness in any individual system. Inconsistency between systems can create security exposure.
Cloud providers may offer or support controls such as:
- Multi-factor authentication for privileged users
- SSH and remote-access restrictions
- Exit point monitoring
- Tightly controlled user profile swapping
However, customers still need to make sure security controls are consistently applied across every system that interacts with the IBM i environment.
Encryption: Look Beyond the Checkbox
Encryption should be considered a baseline security requirement for cloud environments.
IBM i data should be protected both at rest and in transit, including:
- Production database data
- Backup images
- Data moving across networks
- Data transferred to integration points
- Data accessed by end users
However, simply asking whether a provider offers encryption is not enough.
IT managers should also ask:
- Who manages the encryption keys?
- Who has access to those keys?
- Does key management meet the organization’s compliance requirements?
- Is encryption applied to primary storage?
- Are backups encrypted?
- Are disaster recovery replicas encrypted?
Encryption needs to be considered across the entire environment—not just the production system.
Network Security and Segmentation
Network security determines how exposed an IBM i environment is to the internet and other systems within a cloud infrastructure.
Important considerations include:
- Using private network connections rather than exposing interfaces directly to the public internet
- Establishing tightly controlled firewall rules
- Using VPN or dedicated connectivity for administrative access
- Monitoring exit points
- Controlling what data can leave the IBM i environment
Ask About Multi-Tenant Isolation
If IBM i is hosted in a multi-tenant environment, ask the provider how customer workloads are isolated from one another.
That isolation may be logical rather than physical, but it is still an important part of the overall security model.
This is an area that may not always be fully explained during a standard cloud provider sales conversation, so it is worth asking specific questions before migration.
Auditing, Logging, and Monitoring
IBM i already provides strong auditing capabilities through journal-based auditing, including QAUDJRN and related journals.
Moving IBM i to the cloud does not eliminate those capabilities.
The challenge is making IBM i auditing work alongside the organization’s broader cloud and hybrid-environment monitoring tools.
Organizations should consider:
- Real-time security alerts
- Centralized log collection
- Log correlation
- SIEM integration
- Monitoring IBM i activity alongside cloud infrastructure events
- Monitoring network activity
Centralized visibility becomes increasingly important when a security incident could involve both IBM i and cloud infrastructure.
If logs are isolated in separate systems, identifying activity that crosses those environments can become more difficult.
Secure Backups and Disaster Recovery
Backup and disaster recovery security deserve special attention because backups can become a target during a ransomware attack.
One important security practice is the use of immutable backups—copies that cannot be altered or deleted, even if an administrator account has been compromised.
Organizations should also consider access isolation between production and backup environments.
When evaluating a provider, ask:
- How is backup infrastructure isolated from production credentials?
- Are backups immutable?
- How quickly can a verified-clean backup be restored?
- Has the recovery process actually been tested?
- How often is disaster recovery tested?
A documented disaster recovery plan is important, but a plan that has never been tested remains unproven.
IBM i Cloud Compliance: What Certifications Really Mean
Cloud providers may reference certifications and frameworks such as:
- ISO 27001
- SOC 1
- SOC 2
- PCI-DSS
- HIPAA
- GDPR
- NIST 800-53
These certifications and frameworks can provide useful information about a provider’s security controls and processes.
However, a provider’s certification does not automatically make the customer’s IBM i environment compliant.
For example, a provider’s PCI-DSS alignment does not automatically make an organization’s cardholder data environment compliant. The applications, configurations, access controls, and other components layered on top of the infrastructure also matter.
Questions to Ask About Compliance
Instead of relying solely on compliance logos or marketing claims, ask the provider for specific documentation.
Questions should include:
- Can we review the applicable audit reports?
- Does the provider have a SOC 2 Type II report?
- Which specific controls are covered?
- Which compliance responsibilities remain with the customer?
- What documentation is available for our auditors?
- If HIPAA applies, is a Business Associate Agreement required?
- How does PCI scope apply to our specific application and environment?
Understanding the scope of a certification is just as important as knowing that a certification exists.
IBM i Cloud Security Checklist
Before moving an IBM i environment to the cloud or a hosted environment, IT managers should verify:
- Shared responsibility: Are provider and customer security responsibilities clearly documented?
- Identity management: Are user access and privileged accounts properly controlled across all connected systems?
- Encryption: Is data encrypted at rest and in transit, including backups and DR replicas?
- Key management: Who controls and manages encryption keys?
- Network security: Are private connections, firewalls, VPNs, and exit point controls properly configured?
- Workload isolation: How are systems isolated in a multi-tenant environment?
- Monitoring: Can IBM i audit data be integrated with centralized monitoring or SIEM tools?
- Backups: Are backups protected from unauthorized modification or deletion?
- Disaster recovery: Has the recovery process actually been tested?
- Compliance: What certifications does the provider maintain, and which controls are actually covered?
- Customer responsibilities: Which security and compliance controls remain the organization’s responsibility?
Final Thoughts: IBM i Cloud Security Is a Shared Responsibility
Security and compliance do not simply become the cloud provider’s responsibility when an IBM i environment moves off premises.
Instead, IBM i cloud security is a partnership between the provider and the customer, with responsibilities divided across the infrastructure, operating system, applications, users, and data.
The most important steps are to:
- Document the shared responsibility model.
- Verify security certifications with actual audit documentation.
- Maintain consistent identity and access controls.
- Protect data through encryption and network security.
- Integrate IBM i auditing with broader monitoring tools.
- Protect backups from compromise.
- Test disaster recovery procedures.
- Clearly identify which compliance controls belong to the provider and which remain with the customer.
Most of these practices are not fundamentally different from what a well-managed IBM i environment should already be doing on premises. The difference is that cloud and hosted environments require organizations to explicitly verify responsibilities and controls rather than assume someone else is handling them.
If you’d like to talk more about this or any other topic, we’d love to hear from you! Contact us today!
Enjoy more from our series of IBM i Cloud Migration
- Article 1: What Are the Actual Costs of Running IBM i Applications in the Cloud?
- Article 2: How Is Security and Compliance Handled in an IBM i Cloud Environment?
- Article 3: Moving IBM i Applications to the Cloud – Beneficial or Just Expensive?
- Article 4: Coming Soon!
- Article 5: Coming Soon!