"Total" data security for a BPM / BAW installation is a stack of measures; what the platform gives you at each layer:
In transit - TLS everywhere: HTTPS on the web tier and between IHS and the members (plug-in over SSL), TLS to databases (Db2 SSL, Oracle TCPS - JDBC data source properties), LDAPS, TLS on JMS / MQ channels, TLS for every outbound integration (signers in the truststore), and inside CP4BA the service mesh / route TLS. Disable TLS 1.0/1.1 and weak ciphers in the SSL configuration; HSTS on IHS.
At rest - database encryption (Db2 native encryption, Oracle TDE) covers instance data, documents in the BPM document store and the PDW; file systems for logs, SIBus file stores and FileNet storage areas on encrypted volumes; backups encrypted; WebSphere's keystores with strong passwords and the LTPA key rotated; secrets in CP4BA as Kubernetes secrets (with a KMS / sealed secrets). Application-level: encrypt specific fields before they enter tw.local (question 122) so that even DBAs see ciphertext, and keep sensitive documents in FileNet with content encryption and object-store security rather than in process variables.
In memory / in use - no product encrypts a running JVM heap; what you can do: never log sensitive values (SystemOut, coach console), keep them out of the PDW / tracking groups and out of search indexes (do not expose as business data), minimise the retention (instance deletion policies), mask in coaches (render masked values, decrypt only on demand), use short-lived tokens instead of passwords in integrations, restrict heap dumps / core files (they contain data) and who can take them, and on the JVM level use -Xdump settings and file permissions.
Access - SSO with MFA at the identity provider (SAML / OIDC on CP4BA, SPNEGO / SAML TAI on traditional), least-privilege groups (tw_admins only for operators), team-based task security, Process Admin access limited, audit logging (WebSphere security audit, BAW's audit of admin actions), and regular scans (question 118).
# examples: JDBC over TLS (Db2), WebSphere data source custom properties
sslConnection = true
sslTrustStoreLocation = /opt/ibm/BAW/java/jre/lib/security/cacerts
# LDAP over TLS: ldaps://ldap.example.com:636 in the federated repository + signer in the truststore
References