vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest).<br> * Ensure that data in transit is always encrypted by using TLS 1.2 or higher, including all traffic within your deployment and pods in your Red Hat OpenShift on IBM Cloud workload clusters.<br> * For any workloads hosted in IBM Cloud (not the Satellite location), use Hyper Protect Crypto Services for TLS offload for all data that is requested from outside of IBM Cloud (inbound traffic to IBM Cloud) and protected by a certificate that is signed by a public certificate authority. Configure any web servers to use TLS offload to set up the session so that the private key never leaves HPCS. For more information, see [Encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit).<br><br><br> <br><br> * Ensure data at rest in your IaaS / data center environment is always encrypted. For example, ensure that all physical storage is encrypted by using keys that are managed by a hardware security module (HSM) in your IaaS / data center.<br> * Ensure that data in transit is always encrypted by using TLS 1.2 or higher, including all traffic within your IaaS / data center environment.<br> * Use TLS offload for firewalls / load balancers that perform TLS termination for requests from outside of your IaaS / data center environment and protected by a certificate that is signed by a public certificate authority.<br><br><br> 
 [Implement business continuity and disaster recovery](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-bcdr) <br><br> * Implement a system for business continuity and disaster recovery (BCDR).
Storing and encrypting data in Security and Compliance Center 

To ensure that you can securely manage your data when you use IBM Cloud® Security and Compliance Center, it is important to know exactly what data is stored and encrypted, and how you can delete any stored personal data.

For more information about how IBM Cloud platform secures your data, see [How do I know that my data is safe?](https://cloud.ibm.com/docs/overview?topic=overview-security)



  How is my configuration data obtained? 

To evaluate your account for compliance, Security and Compliance Center gathers resource configuration information from your targeted environment through an internal service-to-service authorization. The policy allows for Security and Compliance Center to read the configuration but the service is unable to change it in any way. Collected data includes the properties and configurations for supported services, network objects, hosts, databases, Kubernetes platforms, and virtual machines.





  How is data stored? 

The results data that is generated by the service is stored in a Cloud Object Storage bucket that is owned by the customer. For help configuring storage, see [Storing data in Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-storage).





  Deleting your data 

When you work with Security and Compliance Center, you own the data that is generated. It is automatically forwarded to a Cloud Object Storage bucket that you connect. Managing the removal of data is your responsibility.
You are responsible for the security and compliance of your application data.



Table 4. Responsibilities for security and regulation compliance

 Task IBM responsibilities Your responsibilities 

 Applications Maintain controls that are commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancecompliance-ready). Set up and maintain security and regulation compliance for your apps and data. For example, you can enable extra security settings to meet your compliance needs by choosing how and when to [import](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-importing-keysplan-ahead), [wrap](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-wrap-keys), [rotate](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-importing-keysplan-ahead), [rewrap](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rewrap-keys), and [delete](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys) keys. 
 Encryption IBM is responsible for the encryption of keys. Keep your root of trust, the master key parts, on either your workstation or smart cards. 
 Master key backups IBM never touches your master key. Backup your master key in a regular basis to your smart card or workstation. 







 Disaster recovery 

Disaster recovery includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events. IBM is responsible for the recovery of Hyper Protect Crypto Services components in case of disaster. You are responsible for the recovery of the workloads that run Hyper Protect Crypto Services and your application data.



Table 5. Responsibilities for disaster recovery

 Task IBM responsibilities Your responsibilities
[Key Protect](https://cloud.ibm.com/docs/key-protect) and [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) support this deployment pattern. You can configure access to an entire instance or, for enhanced security, to individual [key rings - a collection of keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). [Hyper Protect Crypto Services with Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-overview&interface=ui) even enables you to orchestrate encryption keys across key stores at different cloud providers.





 Security and Compliance Center 

The [Security and Compliance Center](https://cloud.ibm.com/security-compliance/overview) features Posture Management and Configuration Governance functionality. It helps to monitor deployed environments for security and assess them against compliance goals. Moreover, it can provide configuration defaults or even enforce settings of newly deployed resources. While the latter only applies to the current account, you can [utilize Security and Compliance Center to monitor and assess multiple accounts](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-scanning-multiple-accounts-from-a-single-account) from a central instance. With custom collectors in place, the current security posture of multiple cloud accounts can be assessed and necessary actions taken.





 Activity Tracker 

All IBM Cloud services produce events for security-related actions. They are logged into Activity Tracker instances. By utilizing Activity Tracker Event Routing, the security records can be centralized to one or few instances with either event search (logdna) or Object Storage as storage options. By aggregating all records in one location, security events can be easily correlated and thereby increasing insights into incidents or even allowing an early detection.





 Log Analysis 

IBM® Log Analysis allows managing operating system logs, application logs, and platform logs and provides search and filtering capabilities.
<br><br> * Encrypt and protect your data<br><br><br> You can choose from various secrets management and data protection products that help you to protect your sensitive data and centralize your secrets. Review [Which data protection service is best for me?](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manage-secrets-ibm-cloudwhich-data-protection-service) to better understand the different offerings that you can use with IBM Cloud to protect your application secrets. Use the following guides to create and configure your Secrets Manager instance:<br><br><br><br> * [Store your secrets in a Secrets Manager instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance).<br> * [Encrypt your data with Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision).<br> * [Encrypt your data with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision).<br><br><br> 
 <br><br> * Security and compliance<br><br><br> IBM Cloud provides a secure cloud platform that you can trust. IBM Cloud compliance results from a platform and services that are built on best-in-industry security standards, including GDPR, HIPAA, ISO 9001, ISO 27001, ISO 27017, ISO 27018, PCI, SOC2, and others. For more information, see [Understanding compliance in IBM Cloud](https://cloud.ibm.com/docs/overview?topic=overview-compliance). 







 Manage billing and usage 

Account owners and users with the administrator role on the [billing account management service](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uibilling-acct-mgmt) have access to monitor and manage billing, usage, invoices, payments, and more.
For example, KSPM can detect misconfigurations in a Kubernetes RBAC role definition that grants users permissions that they should not have. For example, the ability to create new pods. Or, a KSPM tool can alert you to an insecure Kubernetes network configuration that allows communication between pods in different namespaces. Communication between pods in different namespaces would not be a typical setting.





 Why is Kubernetes security posture management important? 

As part of a broader Kubernetes security strategy, KSPM addresses several important security considerations.



 Identifying possible human errors and oversights 

KSPM is a solution for checking the security of the configurations that you use to govern Kubernetes resources. The risk that human error or oversight can result in configurations that are not as secure as they ideally would be.

KSPM helps teams find and fix these mistakes before they lead to breaches.





 Managing security as clusters evolve 

Kubernetes is a rapidly evolving technology, and configurations that are secure for one version of Kubernetes might stop being secure if you upgrade to a new version.

For instance, Kubernetes announced in 2021 that pod security policies, which were a critical resource for enforcing certain types of access control over pods, are deprecated. Current versions of Kubernetes still enforce pod security policies, but support ends with version 1.25. If you are still using pod security policies when you upgrade to version 1.25, a KSPM tool, such as IBM Cloud Security and Compliance Center Workload Protection, can alert you to the fact that Kubernetes is ignoring your policies. KSPM can alert you to replace outdated policies with tools such as Kubernetes security contexts or custom admissions controllers.





 Validating third-party configurations 

Kubernetes is a system where teams routinely borrow or import resources from upstream. For example, you can pull container images from a public Docker Hub registry or apply a deployment file from GitHub. The third-party developers who create those resources might or might not follow the same security conventions as your own team.

KSPM offers a way of scanning third-party resources for possible security issues.
Security best practices for z/OS virtual server instances 

To secure your z/OS virtual server instance and identify any security vulnerabilities, you must refer to the following security information and industry standard security reports.

Products and services in the z/OS stock images are periodically reviewed and updated. IBM continues to follow the standard security guidance and provides differentiating technologies in security and data privacy, focusing on but not limited to the following areas:



*  Security patch management
*  Firmware currency
*  Setup of suggested products and services
*  Configuration of hardware and software (operating systems, middleware, third-party applications, open source, network cards, and so on)
*  Integration and monitoring of software, hardware, and end-points
*  Cybersecurity:



*  Least access privilege
*  Separation of duties
*  Defense-in-depth
*  Authentication strength
*  End-to-end encryption





For this release, you need to follow the security best practices for your z/OS virtual server instance:



*  If you want to apply the latest service for your instance, it is suggested that you wait until the next month’s refresh stock image to provision a new z/OS virtual server instance.
*  Ensure that you follow the password policy, see [Configuring the password](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_zosconfigure-password).
*  For more information about various security topics, see the following references:



*  [What is zero trust?](https://www.ibm.com/topics/zero-trust)
*  [NIST Special Publication Security & Privacy Controls for Information Systems & Organizations](https://doi.org/10.6028/NIST.SP.800-53r5)
*  [IBM X-Force Threat Intelligence Report](https://www.ibm.com/security/data-breach/threat-intelligence/)
*  [IBM on Enterprise Security](https://www.ibm.com/it-infrastructure/z/capabilities/enterprise-security)
*  [PCI DSS v4.0](https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf)
*  [CIS Benchmarks for IBM Z](https://workbench.cisecurity.org/files/3877)
To find out more about the issues, click the link in the Security status column.

The Vulnerability Advisor dashboard provides an overview and assessment of the security for an image. If you want to find out more about the Vulnerability Advisor dashboard, see [Reviewing a vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_reviewing).

Encrypted images aren't scanned by Vulnerability Advisor.



 Data protection 

To scan images and containers in your account for security issues, Vulnerability Advisor collects, stores, and processes the following information:



* Free-form fields, including IDs, descriptions, and image names (registry, namespace, repository name, and image tag)
* Metadata about the file modes and creation timestamps of the configuration files
* The content of system and application configuration files in images and containers
* Installed packages and libraries (including their versions)



Do not put personal information into any field or location that Vulnerability Advisor processes, as identified in the preceding list.

Scan results, aggregated at a data center level, are processed to produce anonymized metrics to operate and improve the service. In version 3, a vulnerability report (scan result) is generated when the image is pushed to the registry (and is regenerated regularly thereafter). When Vulnerability Advisor is queried, a scan result is retrieved that might be up to 5 days old. Scan results are deleted 30 days after they are generated.

In version 4, the image is indexed when it is first pushed to Container Registry registry, and that index report is stored in the database. When Vulnerability Advisor is queried, the image index report is retrieved, and a vulnerability assessment is produced. This action happens dynamically every time Vulnerability Advisor is queried. Therefore, no pregenerated scan result exists that requires deleting. However, the image index report is deleted within 30 days of the deletion of the image from the registry.







 Types of vulnerabilities 



 Vulnerable packages 

Vulnerability Advisor checks for vulnerable packages in images that are using supported operating systems and provides a link to any relevant security notices about the vulnerability.

Packages that contain known vulnerability issues are displayed in the scan results.
Security IBM responsibilities:<br><br><br><br> * Provide the tools to lock a workspace and disable changes for a workspace.<br> * Automatically apply security and version updates to sample templates and the templates in the IBM Cloud catalog.<br> * Update operational IBM Cloud Schematics components, such as the IBM Cloud Provider Plug-in for Terraform, the Terraform command-line version, and other supported providers and provisioning engines.<br> * Provide access to Schematics log information for resource-related actions.<br> * Track workspace activities and automatically send events to IBM Cloud Activity Tracker.<br> * Encrypt workspace data in transit and at rest. <br> User responsibility:<br> * Use Cloud Identity and Access Management to control access to a Schematics Workspaces and related IBM Cloud resources.<br> * Secure the source repository for your Terraform template, including access control, security settings, collaboration, and version control.<br> * Secure the IBM Cloud resources that you create by using the security features that are provided by the resource offering.<br> * Use the provided tools of your IBM Cloud resources to apply security patches, access controls, and encryption to your resources.<br><br><br> 
 High availability, backup, and disaster recovery IBM responsibilities:<br><br><br><br> * Back up workspace data across IBM Cloud regions.<br> * Recover workspace data from the replicated region within 24 hours.<br> * Recover operational IBM Cloud Schematics components. <br> User responsibility:<br> * Design and provision your resources in a way that achieves high availability and resiliency, such as [multizone clusters](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters) or [multi-region VPCs](https://cloud.ibm.com/docs/vpc?topic=solution-tutorials-vpc-multi-regionvpc-multi-region).<br> * Set up a backup and recovery strategy for your resources and your workload data.<br><br><br>
Existing network configurations and security groups 

A security group augments any existing network configuration. Therefore, a security group cannot span across networks that cannot communicate with one another.

If virtual server instances cannot communicate with one another, adding them to a security group does not change that behavior. Gateways must allow the traffic that is defined by the selected security groups.

If your account is enabled for custom private addressing (CPA) as well as security groups, be aware that security groups are scoped to the account level, not the network level. Security groups are defined by IP addresses, not private networks.

Security groups are available in all data centers with virtual server instance provisioning.
Review the following frequently asked questions about Satellite Link network security. For more information about all security options for IBM Cloud Satellite, see [Security and compliance for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-compliance).



 Do I need to allow any unique inbound traffic from internet-facing ports through firewalls to my location? 

No. Satellite Link uses standard web security ports to originate encrypted communication from your location to IBM Cloud for location management. Satellite creates unique public DNS entries for each location and assigns ports from the 32768 - 52768 range for TCP so that destination addresses can be predictably resolved by IBM Cloud. Communication channels over Link endpoints between your Satellite location to IBM Cloud are permitted through your [existing outbound firewall policies for hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-reqs-host-network).





 If IBM owns the Link tunnel, how can I validate that our data is inaccessible? My organization's security policy does not allow tunnels from our networks. 

Satellite Link uses a zero-trust model; IBM Cloud has no access to your workloads by default. Any management of infrastructure in your location that is initiated by IBM Site Reliability Engineers over Satellite Link is isolated from your workloads and the network connections, such as the Link endpoints, that your workloads use. For more information about what kinds of access IBM Cloud has to your Satellite location, see [IBM operational access](https://cloud.ibm.com/docs/satellite?topic=satellite-complianceoperational-access). For any other connections into your location that your applications require, you can use Satellite Link to create layer 4 communications by setting up an endpoint for each destination resource in your location. All connections through your endpoints are always under your control, including completely disabling endpoints.





 How do I make my data secure in transit? 

Link endpoints between your location and IBM Cloud are secured through two levels of encryption: high-security encryption from the location’s connector to IBM Cloud that is provided by IBM , and an optional additional encryption layer between the source and destination resources.
Manage secrets <br><br> * Generate the necessary secrets (for example, IAM API keys, SSH keys) that are required for the deployable architecture.<br> * Manage generated secrets by following secure best practices.<br><br><br> 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



Table 4. Responsibilities for security and regulation compliance
The rows are read from left to right. The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities 

 Meet security and compliance objectives Provide a deployable architecture that complies with the set of of controls that are defined with the release of the deployable architecture. The controls in the deployable architecture do not necessarily cover the complete profile for the IBM Cloud Framework for Financial Services, as shown in the [Available predefined profiles](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-predefined-profiles). 
 Verify configuration changes Understand the effects on the security and compliance posture of any user-initiated changes to the default configuration. Run IBM Cloud Security and Compliance Center checks if needed to ensure that the deployable architecture remains in compliance. 







 Disaster recovery 

Disaster recovery includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events.

The landing zone deployable architectures do not identify specific responsibilities in this area.