vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can learn more about how Key Protect processes and protects personal data by reviewing the following addendums.



* [IBM Key Protect for IBM Cloud Data Sheet Addendum (DSA)](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=180A0EC0658B11E5A8DABB56563AC132)
* [IBM Data Processing Addendum (DPA)](https://ibm.com/support/customer/csol/terms/?cat=dpa)







 HIPAA support 

Key Protect does not process, store, transmit, or otherwise interface with personal health information (PHI). Therefore, the service can be integrated with any HIPAA offering without impact to its HIPAA readiness. As such, you can use Key Protect to generate and manage keys for HIPAA ready applications. Those keys are protected by the Key Protect trust anchor, which is backed by a hardware security module (HSM) that is tamper-resistant and FIPS-140-2 level 3 certified.

If you or your company is a covered entity as defined by HIPAA, you can enable the HIPAA Supported setting for your IBM Cloud account. To find out more, see [Enabling the HIPAA Supported setting](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedenabling-hipaa).





 ISO 27001, 27017, 27018 

Key Protect is ISO 27001, 27017, 27018 certified. You can view compliance certifications by visiting [Compliance on the IBM Cloud](https://ibm.com/cloud/compliance).





 Service Organization Controls (SOC) 

Key Protect meets Service Organization Control (SOC) compliance for the following types:



* SOC 1 Type 2
* SOC 2 Type 1
* SOC 2 Type 2
* SOC 3



For information about requesting an IBM Cloud SOC report, see [Compliance on the IBM Cloud](https://ibm.com/cloud/compliance).





 PCI DSS 

Key Protect meets controls for the Payment Card Industry (PCI) data security standards to protect cardholder data.
Key Protect supports key rings
: You can now use the Key Protect REST API to manage access to a specific set of keys that are bundle a collection called a key ring. You can manage and restrict access to key rings to via IAM policies. To find out more, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys).





 06 January 2021 

Restore key process is now improved
: If you have Manager access permissions, you can now use the the Key Protect UI to restore all unexpired-deleted keys. For more information, see [Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keysrestore-ui). You can now use the Key Protect REST API to initiate a manual data synchronization request to to synchronize your service's key records with what is in Key Protect's database records. For more information, see [Sync associated resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-sync-associated-resources).

This API is available only for users if a cloud service has enabled the key registiation feature as part of its integration with Key Protect. To learn if an [integrated service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services) supports key registration, refer to its service documentation for more information.







 December 2020 



 11 December 2020 

Key Protect supports operational metrics
: If you have Manager IAM access permissions, you can now use the Key Protect UI to create a metrics policy that allows you to view the operational metrics for your Key Protect instance. To find out more, see [Managing metrics](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-monitor-metricsenable-metrics-instance-policy-ui).





 01 December 2020 

Announcing support for key aliases
: If you have Writer or Manager access permissions, you can now use the Key Protect REST API to create a key alias.
By default (if no scopes are provided), the search is performed in both name and alias scopes.

Not seeing the full list of keys that are stored in your Key Protect instance? Verify with your administrator that you are assigned the correct role for the applicable Key Protect instance or individual key. For more information about roles, see [Roles and permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).



 Retrieving keys by state 

By filtering on the state of specific keys in your Key Protect instance, you can retrieve keys that are in the states that you specify.

For example, you might have keys in your Key Protect instance that are in the active, suspended, and destroyed states, but you only want to retrieve keys in the active state when you look through a list of keys.

For more information on key states, see [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).

[After you create or import your existing keys into the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys), you have two options to view your keys. The first option, [View keys through the resource list](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysfilter-key-state-gui-resource-list), works for all keys except those you have assigned [fine-grained access to](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-key-level). For information about how to view keys with fine-grain access, check out [Viewing fine-grain access keys IAM](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysfilter-key-state-gui-iam).



 Viewing keys through the resource list 



1.
Risk Assessment (RA) [RA-5 Vulnerability Scanning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-5) 







 11. Encrypt consumer data at rest and in transit 

Requirement: Encrypt all consumer data whether at rest or in transit.

Purpose & value: Consumers do not want their data to be accessible to bad actors. Protecting consumer data against unauthorized disclosure, modification, or destruction throughout the data lifecycle is of paramount importance in the IBM Cloud for Financial Services. Cryptographic controls must be in place in all regions and availability zones to protect the confidentiality and integrity of data.

Data at rest is to always be encrypted, and you must use [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) to manage encryption keys. Hyper Protect Crypto Services allows you to take the ownership of the cloud HSM to fully manage your encryption keys and to perform cryptographic operations using [Keep Your Own Key (KYOK)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptskyok-concept). This means you have full control and authority over encryption keys. No one except you (not even IBM) has access to your encryption keys. You should ensure that all Financial Services Validates services which support integration with Hyper Protect Crypto Services are properly configured.

Data in transit should always be encrypted using TLS 1.2 or higher. This includes all traffic in your deployment such as between virtual server instances and between pods in Red Hat OpenShift on IBM Cloud.

Use Hyper Protect Crypto Services for TLS offload for all data that is that is requested from outside of IBM Cloud (inbound traffic to IBM Cloud) and protected by a certificate which is signed by a public Certificate Authority. Configure any web servers to use TLS offload to set up the session, so that the private key never leaves Hyper Protect Crypto Services.

More detailed guidance can be found in the Cryptographic Requirements appendix of the Control Implementation Overview Template for whichever reference architecture you are using.
Securing your assistant 

IBM is committed to providing our clients and partners with innovative data privacy, security, and governance solutions.

Notice: Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation (GDPR). Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients’ business and any actions the clients may need to take to comply with such laws and regulations.

The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

If you need to request GDPR support for IBM Cloud® Watson resources that are created



* In the European Union, see [Requesting support for IBM Cloud Watson resources created in the European Union](https://cloud.ibm.com/docs/watson/getting-started-gdpr-sar?topic=watson-gdpr-sarrequest-EU).
* Outside the European Union, see [Requesting support for resources outside the European Union](https://cloud.ibm.com/docs/watson/getting-started-gdpr-sar?topic=watson-gdpr-sarrequest-non-EU).





 European Union General Data Protection Regulation (GDPR) 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions to assist them on their journey to GDPR compliance.

Learn more about IBM's own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey [here](https://www.ibm.com/data-responsibility/gdpr/).





 Health Insurance Portability and Accountability Act (HIPAA) 

US Health Insurance Portability and Accountability Act (HIPAA) support is available for Enterprise plans that are hosted in the Washington, DC or Dallas locations. For more information, see [Enabling HIPAA support for your account](https://cloud.ibm.com/docs/account?topic=account-enabling-hipaa).
SELinux profiles can't be changed by the user or owner of the machine.

SSH disabled
: By default, SSH access is disabled on the worker node to protect your cluster from malicious attacks. When SSH access is disabled, access to the cluster is forced via the Red Hat OpenShift API server. The Red Hat OpenShift API server requires every request to be checked against the policies that are set in the authentication, authorization, and admission control module before the request is executed in the cluster.
: If you have a standard cluster and you want to install more features on your worker node, you can choose between the add-ons that are provided by Red Hat OpenShift on IBM Cloud or use [Kubernetes daemon sets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) for everything that you want to run on every worker node. For any one-time action that you must execute, use [Kubernetes jobs](https://kubernetes.io/docs/concepts/workloads/controllers/job/).







 Network 

The classic approach to protect a company's network is to set up a firewall and block any unwanted network traffic to your apps. While this is still true, research shows that many malicious attacks come from insiders or authorized users who misuse their assigned permissions.



 Network segmentation and privacy for classic clusters 

To protect your network and limit the range of damage that a user can do when access to a network is granted, you must make sure that your workloads are as isolated as possible and that you limit the number of apps and worker nodes that are publicly exposed.





 What network traffic is allowed for my Classic cluster by default? 

All containers are protected by [predefined Calico network policy settings](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesdefault_policy) that are configured on every worker node during cluster creation. By default, all outbound network traffic is allowed for all worker nodes. Inbound network traffic is blocked with the following exceptions:
You can



* view encryption details. Encryption at rest is enabled for all Databases for MySQL deployments. If you brought your own encryption key from [Key Protect](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-key-protect), the panel provides a link to your Key Protect instance, and the Encryption Key field has the name of the key.
* [Change the admin password](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-admin-password)
* [Implement or modify an IP allowlist](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-allowlisting)







 Service Credentials 

You can generate a new set of credentials for cases where you want to manually [connect an app](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-ibmcloud-app) or [external consumer](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-external-app) to an IBM Cloud service. [Learn more](https://cloud.ibm.com/docs/account?topic=account-service_credentials).





 Connections 

Shows connected resources. You can use the Create connection button to bind this service to another resource.





 View docs 

The View docs link from the Actions drop list opens the main documentation page for Databases for MySQL in a new tab.
By default (if no scopes are provided), the search is performed in both name and alias scopes.

Not seeing the full list of keys that are stored in your Key Protect instance? Verify with your administrator that you are assigned the correct role for the applicable Key Protect instance or individual key. For more information about roles, see [Roles and permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).



 Retrieving keys by state 

By filtering on the state of specific keys in your Key Protect instance, you can retrieve keys that are in the states that you specify.

For example, you might have keys in your Key Protect instance that are in the active, suspended, and destroyed states, but you only want to retrieve keys in the active state when you look through a list of keys.

For more information on key states, see [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).

[After you create or import your existing keys into the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys), you have two options to view your keys. The first option, [View keys through the resource list](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys&interface=apifilter-key-state-gui-resource-list), works for all keys except those you have assigned [fine-grained access to](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-key-level). For information about how to view keys with fine-grain access, check out [Viewing fine-grain access keys IAM](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys&interface=apifilter-key-state-gui-iam).



 Viewing keys through the resource list 



1.
All data is encrypted in IBM COS, but Key Protect provides a service for generating, rotating, and controlling access to encryption keys using a centralized service.



 Before You Begin 

The following items are necessary in order to create a bucket with Key-Protect enabled:



* A Key Protect service [provisioned](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-provisionprovision)
* A Root key available (either [generated](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-create-root-keys) or [imported](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-import-root-keys))







 Retrieving the Root Key CRN 



1. Retrieve the [instance ID](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-retrieve-instance-IDretrieve-instance-ID) for your Key Protect service
2. Use the [Key Protect API](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-set-up-apiset-up-api) to retrieve all your [available keys](https://cloud.ibm.com/apidocs/key-protect)



* You can either use curl commands or an API REST Client such as [Postman](https://cloud.ibm.com/docs/services/cloud-object-storage?topic=cloud-object-storage-postman) to access the [Key Protect API](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-set-up-apiset-up-api).



3. Retrieve the CRN of the root key you will use to enabled Key Protect on the your bucket. The CRN will look similar to below:
Information security 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions.

Notice: Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients’ business and any actions the clients may need to take to comply with such laws and regulations.

The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

If you need to request GDPR support for IBM Cloud® Watson resources that are created



* In the European Union (EU), see [Requesting support for IBM Cloud Watson resources created in the European Union](https://cloud.ibm.com/docs/watson?topic=watson-gdpr-sarrequest-EU).
* Outside of the EU, see [Requesting support for resources outside the European Union](https://cloud.ibm.com/docs/watson/?topic=watson-gdpr-sarrequest-non-EU).





 European Union General Data Protection Regulation (GDPR) 

IBM is committed to providing our clients and partners with innovative data privacy, security and governance solutions to assist them on their journey to GDPR compliance.

Learn more about IBM's own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey [here ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/icons/launch-glyph.svg)]( [http://www.ibm.com/gdpr](http://www.ibm.com/gdpr)){: new_window}.





 Labeling and deleting data in Natural Language Understanding 

Users should not input any sensitive or personal information when using customization features. Beta releases may not be compatible with legislation such as GDPR.
Data at rest encryption with KYOK 

Keys are protected by customer-managed dedicated HSMs, which means, only you have access to your data. The cryptographic capabilities of Hyper Protect Crypto Services are built on top of a FIPS 140-2 Level 4 Certified Hardware Security Module. You can benefit from the cryptographic capabilities of Hyper Protect Crypto Services for both your new and existing workloads. The IBM Key Protect for IBM Cloud API is integrated for generating and protecting encryption keys.

Refer to [Apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security) and [Create secure microservices that write to a consolidated database](https://developer.ibm.com/patterns/create-a-secured-microservices-and-deploy-it-to-a-consolidated-database/) for tutorials on how to encrypt cloud applications by using the key management service API of Hyper Protect Crypto Services.

Zoom

![data at rest encryption with KYOK](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/byok.svg)

Figure 1. Data at rest encryption with KYOK





 VMware image protection with KYOK 

Organizations that use the VMware® environment in IBM Cloud to process and store personal information demands the highest level of security. As a user of Hyper Protect Crypto Services, you get your own dedicated slot that you set up on your own to ensure that no body else can access. Because Hyper Protect Crypto Services and VMware do not contact the same interfaces, the Key Management Interoperability Protocol for VMware component acts as an intermediary to allow the VMware environment to store and use keys from Hyper Protect Crypto Services.

As a single-tenant service, Hyper Protect Crypto Services offers dedicated control of the Hardware Security Module for VMware images for each customer.
Key Protect supports a centralized access control system, governed by IBM Cloud® Identity and Access Management, to help you manage users and access for your encryption keys and allow the principle of least privilege. If you are a security admin for your service, you can assign [IBM Cloud IAM roles that correspond to the specific Key Protect permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) you want to grant to members of your team.

One way this is possible is by grouping keys into "key rings", allowing an account owner to assign access to a particular group of keys to a particular group of users. For more information, check out [Grouping keys together using key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys).





 What are differences between the Reader and ReaderPlus roles? 

Both the Reader and ReaderPlus roles help you assign read-only access to Key Protect resources.



* As a Reader, you can browse a high-level view of keys and perform wrap and unwrap actions. Readers cannot access or modify key material.
* As a ReaderPlus, you can browse a high-level view of keys, access key material for standard keys, and perform wrap and unwrap actions. The ReaderPlus role cannot modify key material.







 How do I monitor API calls to Key Protect? 

You can use the IBM Cloud Activity Tracker service to track how users and applications interact with your Key Protect instance. For example, when you create, import, delete, or read a key in Key Protect, an Activity Tracker event is generated. These events are automatically forwarded to the Activity Tracker service in the same region where the Key Protect service is provisioned.

To find out more, check out [IBM Cloud® Activity Tracker events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events).





 How can I check what data is encrypted by which root key?