Answer
The Integrated File System is the piece most commonly shortchanged, because it holds things that do not look like traditional IBM i objects: web application code, Java class files, configuration files for open source components, SSL certificates, and integration scripts that a modern IBM i shop increasingly depends on. A backup strategy built around SAVLIB alone will miss all of it, and the gap only becomes visible during an actual disaster recovery test, which is the worst time to discover it.
Authorization lists and user profiles deserve equal attention because a restore that recreates every library and file but drops the security layer leaves the business with a technically working but functionally unusable system; nobody can sign on, or worse, everyone can access everything because authority defaulted open. Buyers should ask vendors specifically how their product handles SAVSECDTA-equivalent coverage and whether it captures authorization list relationships, not just the objects themselves. Job scheduler definitions and any custom exit programs registered against exit points are easy to forget because they are configuration rather than data, yet losing them means the restored environment behaves differently from the one that failed. A strong evaluation question is simply: after a full restore, what manual reconfiguration steps remain, and how long do they take?