We implement IBM PowerSC on AIX, IBM i and Linux.
PowerSC applies security profiles such as CIS, STIG or PCI DSS to your Power servers and produces the reports your auditor asks for. We are an IBM Business Partner and we tune it to the standard you have to meet.
If you are still on PowerSC 2.2, it went out of support on 30 September 2026.
Every audit asks you to prove that each server still meets the standard.
Security settings on AIX, IBM i or Linux can be tuned by hand, but every patch, every new partition and every urgent change moves them a little, and by the time the audit comes round nobody is sure which ones are still as they were left.
PowerSC turns the standard into a profile, checks rule by rule what each server complies with and produces the report as CSV or PDF, or emails it to you as often as you choose.
What PowerSC does
Compliance
You choose a profile, apply it to a group of servers and PowerSC tells you rule by rule what passes. Since 2.3 it supports custom rules and exceptions marked in the interface.
Limit A profile changes dozens of settings at once, and one of them may affect an application.Multi-factor authentication
PowerSC MFA accepts RSA SecurID, TOTP codes (IBM Verify, Google Authenticator or Duo), YubiKey, PIV/CAC certificates and RADIUS, and it runs on its own server, so it can be deployed before, after or without the rest of PowerSC.
Limit If the MFA server goes down and has no replica, nobody can log in.Integrity
On AIX it alerts as soon as a monitored file changes, Trusted Execution blocks anything not on the allow list and Trusted Boot uses a vTPM to check that the boot image has not been tampered with.
Limit The Trusted features are AIX only. On Linux it relies on fapolicyd and auditd, and on IBM i on the system's own auditing.Anti-malware and patches
It includes ClamAV for AIX, Linux and IBM i, plus intrusion detection. On AIX it manages TL, SP and iFix levels by server group, and on Linux and IBM i it checks every eight hours which patches are missing.
Limit It only sees what happens on the Power servers.Cryptographic inventory
The quantum-safe scan inventories algorithms, certificates, keys and PGP, and since 2.3.0.6 it also checks open TLS ports.
Limit It takes the inventory. Moving to post-quantum algorithms is a separate project.Compliance profiles in version 2.3
Each profile turns a standard into operating system configuration rules.
There are also profiles for NERC and for the HMC.
PowerSC 2.3 technical summary
A central server with a web interface and an agent on each partition. The server can run on AIX, Linux or IBM i.
- Version
- 2.3.0.6
- AIX
- 7.3, 7.2 TL4 and TL5, and 7.1 TL5 SP5
- IBM i
- 7.4, 7.5 and later
- Linux
- RHEL 8, 9 and 10, and SLES 15 SP4 or later, on Power and on Intel
- Network
- Interface on port 443 and agents on port 11125
- Requirements
- 64-bit Java 8, which is not included, and the same OpenSSL level on the server and the agents
PowerSC alongside Wazuh or QRadar
To relate what happens on the Power servers to the rest of the network, PowerSC usually works with a SIEM, and which one depends more on what you already have than on PowerSC itself.
| PowerSC | Wazuh | IBM QRadar | |
|---|---|---|---|
| What it is for | Hardening and monitoring Power servers | Open source SIEM and XDR | IBM's SIEM for large-scale correlation |
| Where it works | AIX, IBM i and Linux | Agents on Linux, Windows, macOS and AIX, among others | Events from almost any source |
| Compliance | Applies the profile and remediates | Checks configuration without remediating | Reports on the events it collects |
| Licence | IBM, paid | Free | IBM, paid |
More detail in EDR for Linux, AIX and IBM i: Wazuh and alternatives.
How we implement it
We don't touch production until the profile has been tested, and we work with your team, who will run it afterwards.
- 1
Inventory and standard
Which partitions you have, on which version of AIX, IBM i or Linux, and what you are asked for: PCI DSS, NIS2 or an internal audit.
- 2
Server and agents
Java, the same OpenSSL level everywhere, the ports opened in the firewall and an agent on each partition.
- 3
Profile in pre-production
We apply the profile to a test partition, roll back whatever breaks and document each exception and the reason for it.
- 4
MFA in phases
Administrators first, with a replica of the MFA server and an emergency account kept safe.
- 5
Production and reports
Profile in production, scheduled reports and your team trained. If you need it, we carry on with IBM Power support.
PowerSC training
The official IBM PowerSC Workshop (AN80G) course lasts three days and covers file integrity, allow and block lists, anti-malware and MFA, with exercises on real systems. We deliver it as official IBM training.
Frequently asked questions
Is PowerSC included with AIX or IBM i?
No, it is an IBM product licensed separately. Before quoting we check what you already have, because some older Power editions and bundles did include it.
We are still on PowerSC 2.2. What should we do?
Move to 2.3. Version 2.2 went out of support on 30 September 2026, and since 2.3.0.5 the server and the agents must run the same OpenSSL level (1.1.x is no longer valid), so it makes sense to upgrade them all at once.
Does MFA cover SSH connections?
Yes. PowerSC MFA works through PAM, which is how SSH authenticates on AIX and Linux, and on IBM i it is configured over SSH.
Which systems do you have and which standard applies?
With that we can tell you which profile fits, which parts of PowerSC you need and where to start.
