vania-janet/multiturn-rag-retrieval-data huggingface dataset:
SC-13 - Cryptographic Protection 



 Control requirements 

SC-13 - 0
: The information system implements [IBM Assignment: the requirements in Supplemental Guidance for Cryptography Governance] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.





 Additional IBM Cloud for Financial Services specifications 

The organization must develop an overall cryptographic governance program that meets customer requirements and includes:



* Security requirements for cryptographic hardware and software modules
* Cryptographic key establishment and management requirements
* Cryptographic key management technology and processes used to produce, control, and distribute symmetric and asymmetric cryptographic keys
* Hash algorithms used
* Random, pseudo-random, and prime number generator algorithms used
* Cryptographic key sizes, operational lifecycles, storage, and distribution methods
* Reliance on cryptographic services including certificate authorities (CA)







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Data encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)
* [Data encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether VPN for VPC has IPsec policy authentication that is set to minimum "sha256"
* Check whether OS disks are encrypted with customer-managed keys
* Check whether VPN for VPC has an IPsec policy that does not have Perfect Forward Secrecy (PFS) disabled
* Check whether App ID email dispatchers are using HTTPS only
* Check whether Cloud Object Storage is accessible only through HTTPS
* Check whether App ID user data is encrypted
"<additional_data>",
"<additional_data>"
]
}'

Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to rewrap keys in Key Protect.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 keyID_or_alias Required. The unique identifier or alias for the root key that you used for the initial wrap request. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Key Protect will search for the key in every key ring associated with the specified instance. It is recommended to specify the key ring ID for a more optimized request. <br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. <br>For more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 correlation_ID The unique identifier that is used to track and correlate transactions.
Now that Key Protect on Satellite has been successfully deployed, you're ready to use Key Protect to encrypt your data at rest, which you can do using the the Key Protect endpoint through the APIs.



* For information about how envelope encryption works, check out [Protecting data with envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).
* To learn how to create root keys, check out [Creating root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys).
* If you added a root key to the service, learn more about using the root key to protect the keys that encrypt your data at rest by checking out [Wrapping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys).
* To find out more about authorizing other cloud services to integrate with Key Protect, check out the [Integrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services) documentation.
* To find out more about programmatically managing your keys, check out the [Key Protect API reference](https://cloud.ibm.com/apidocs/key-protect) documentation.
By monitoring for risks, you can identify security vulnerabilities and quickly work to mitigate the impact and fix the issue. By using Security and Compliance Center along with [external integrations](https://cloud.ibm.com/security-compliance/integrations) (such as, OpenShift Compliance Operator (OSCO), Tanium, NeuVector, and so on), you can build a robust approach for monitoring for security and compliance issues.







 Integration 



 IBM Event Streams for IBM Cloud (optional) 

[Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-about) is a high-throughput message bus built with Apache Kafka. It is optimized for event ingestion into IBM Cloud and event stream distribution between your services and applications.

You can use Event Streams to complete the following tasks:



* Offload work to back-end worker applications.
* Connect event streams to streaming analytics to realize powerful insights.
* Publish event data to multiple applications to react in real time.



Event Streams offers a fully managed Apache Kafka service, ensuring durability and high availability for our clients. By using Event Streams, you have support around the clock from our team of Kafka experts.







 Databases 



 IBM Cloud Hyper Protect DBaaS for MongoDB (optional) 

Moving confidential and mission-critical data to the cloud presents data confidentiality, security, and reliability concerns. [IBM Cloud® Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-overview) offers highly secure database environments that have technology-enforced protection and high availability.

Built on IBM LinuxONE technology, Hyper Protect DBaaS for MongoDB helps you to alleviate data security and compliance concerns with built-in encryption and tamper protection for data at rest and in flight. You can deploy your workloads with sensitive data and build compliant applications without having to be a security expert.





 IBM Cloud Hyper Protect DBaaS for PostgreSQL (optional)
AT-1 - Security Awareness and Training Policy and Procedures 



  Control requirements 

The organization:

AT-1 (a)
:   Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:



1.  A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2.  Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and



AT-1 (b)
:   Reviews and updates the current:



1.  Security awareness and training policy [IBM Assignment: at least annually]; and
2.  Security awareness and training procedures [IBM Assignment: at least annually].







  NIST supplemental guidance 

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AT family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
* Check whether Hyper Protect Crypto Services encryption keys that are generated by the service are rotated automatically at least every # months
* Check whether Hyper Protect Crypto Services instance is enabled with a dual authorization deletion policy







 NIST supplemental guidance 

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems.
* [Restoring a deleted key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys).



Added: Hyper Protect Crypto Services expands into the Washington DC region
: You can now create Hyper Protect Crypto Services resources in the Washington DC (US East) region. For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).





 30 June 2020 

Added: Support for quorum authentication
: Both the IBM Cloud Trusted Key Entry (TKE) command-line interface (CLI) plug-in and the Hyper Protect Crypto Services Management Utilities now support [quorum authentication](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsquorum-authenticaion-concept).

Quorum authentication is the way to approve an operation by a set number of crypto unit administrators. Some sensitive operations require a sufficient number of crypto unit administrators to enter their credentials. Setting the [signature thresholds](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptssignature-thresholds-concept) to a value greater than one enables quorum authentication.

For more information about how to initialize a service instance by using the TKE CLI and enable quorum authentication, see [Initializing service instances with the IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm).

For more information about how to initialize a service instance by using the Management Utilities and enable quorum authentication, see [Setting up smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilities) and [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities).
SA-5 - Information System Documentation 



  Control requirements 

The organization:

SA-5 (a)
:   Obtains administrator documentation for the information system, system component, or information system service that describes:



1.  Secure configuration, installation, and operation of the system, component, or service;
2.  Effective use and maintenance of security functions/mechanisms; and
3.  Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;



SA-5 (b)
:   Obtains user documentation for the information system, system component, or information system service that describes:



1.  User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;
2.  Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and
3.  User responsibilities in maintaining the security of the system, component, or service;



SA-5 (c)
:   Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and takes [Assignment: organization-defined actions] in response;

SA-5 (d)
:   Protects documentation as required, in accordance with the risk management strategy; and

SA-5 (e)
:   Distributes documentation to [Assignment: organization-defined personnel or roles].





  NIST supplemental guidance 

This control helps organizational personnel understand the implementation and operation of security controls associated with information systems, system components, and information system services. Organizations consider establishing specific measures to determine the quality/completeness of the content provided. The inability to obtain needed documentation may occur, for example, due to the age of the information system/component or lack of support from developers and contractors. In those situations, organizations may need to recreate selected documentation if such documentation is essential to the effective implementation or operation of security controls. The level of protection provided for selected information system, component, or service documentation is commensurate with the security category or classification of the system. For example, documentation associated with a key DoD weapons system or command and control system would typically require a higher level of protection than a routine administrative system. Documentation that addresses information system vulnerabilities may also require an increased level of protection. Secure operation of the information system, includes, for example, initially starting the system and resuming secure system operation after any lapse in system operation.
This offering includes single tenant Key Protect on Satellite that connects to two user-controlled HSMs, in contrast to the multi-tenant fully managed Key Protect in IBM Cloud.

This level of control is designed for users who want to promote internal best practices or satisfy relevant legal requirements. Users can use the same key management service on IBM Cloud Key Protect, on-prem Key Protect on Satellite, and in future hybrid cloud environments, depending on the use case. This level of control is designed for businesses and industries where closer control over infrastructure satisfies business or regulatory needs (for example, a banking consortium subject to data residency rules).

For information about pricing, check out [Pricing for Key Protect on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan-satellite).



 Before you begin 

Before deploying Key Protect in a Satellite location, you must first [deploy a Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-getting-started). Note that this location must be on-prem in a user-owned VM. It cannot be contained in IBM Cloud.

After your Satellite location has been created, create an IBM Cloud Activity Tracker instance using the process described in [Using IBM Cloud Activity Tracker with Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin-activity). You must also have deployed [a IBM Cloud Databases (ICD) that uses PostgreSQL](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-satellite-on-prem) service in your Satellite location, which is used by Key Protect to manage your keys. After your ICD for PostgreSQL instance has deployed, you need to share [several values about your ICD instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin-postgresql) with your service representative.
external-interface ge-0/0/1.0;
}
 show security ipsec
proposal IPSEC-PROP {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm aes-128-cbc;
lifetime-seconds 3600;
}
policy IPSEC-POL {
perfect-forward-secrecy {
keys group5;
}
proposals IPSEC-PROP;
}
vpn IPSEC-VPN {
bind-interface st0.1;
vpn-monitor;
ike {
gateway IKE-GW;
ipsec-policy IPSEC-POL;
}
establish-tunnels immediately;
}
 show security zone security-zone CUSTOMER_PRIVATE
security-zone CUSTOMER-PRIVATE {
interfaces {
ge-0/0/0.10 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
security-zone VPN {
interfaces {
st0.1;
}
}
 show security policies from-zone CUSTOMER-PRIVATE to-zone VPN
policy Custprivate-to-VPN {
match {
source-address any;
destination-address Network-A;
application any;
}
then {
permit;
}
}
 show security zones security-zone VPN
interfaces {
st0.1;
}
 show security policies from-zone VPN to-zone CUSTOMER-PRIVATE
policy VPN-to-Custprivate {
match {
source-address Network-A;
destination-address any;
application any;
}
then {
permit;
}
}
Show more





 Performance consideration 

In order to achieve the best IPSEC VPN performance, use AES-GCM as the encryption algorithm for both IKE and IPSEC proposals.

For example:

set security ike proposal IKE-PROP encryption-algorithm aes-128-gcm
Bringing your encryption keys to the cloud 

Encryption keys contain subsets of information, such as the metadata that helps you identify the key, and the key material that's used to encrypt and decrypt data.

When you use Key Protect to create keys, the service generates cryptographic key material on your behalf that's rooted in cloud-based hardware security modules (HSMs). But depending on your business requirements, you might need to generate key material from your internal solution, and then extend your on-premises key management infrastructure onto the cloud by importing keys into Key Protect.



Table 1. Describes the benefits of importing key material

 Benefit Description 

 Bring your own keys (BYOK) You want to fully control and strengthen your key management practices by generating strong keys from your on-premises hardware security module (HSM). If you choose to export symmetric keys from your internal key management infrastructure, you can use Key Protect to securely bring them to the cloud. 
 Secure import of root key material When you export your keys to the cloud, you want assurance that the key material is protected while it's in flight. Mitigate against man-in-the-middle attacks by [using an import token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysusing-import-tokens) to securely import root key material into your Key Protect instance. 



Imported keys cannot be [scheduled for automatic rotation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotation). They must be rotated manually.



 Planning ahead for importing key material 

Keep the following considerations in mind when you're ready to import root key material to the service.



 Review your options for creating key material 

Explore your options for creating 256-bit symmetric encryption keys based on your security needs.

For example, you can use your internal key management system, backed by a FIPS-validated, on-premises hardware security module (HSM), to generate key material before you bring keys to the cloud.
AT-2 - Security Awareness Training 



  Control requirements 

The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

AT-2 (a)
:   As part of initial training for new users;

AT-2 (b)
:   When required by information system changes; and

AT-2 (c)
:   [IBM Assignment: at least annually] thereafter.





  NIST supplemental guidance 

Organizations determine the appropriate content of security awareness training and security awareness techniques based on the specific organizational requirements and the information systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.
Securing your data in File Storage for Classic 

IBM Cloud® takes the need for security seriously, and understands the importance of being able to encrypt data to keep it safe. With provider-managed encryption, IBM Cloud® File Storage for Classic that is provisioned with either Endurance or Performance options, is secured by default at no additional cost and no impact on performance.

The provider-managed encryption-at-rest feature uses the following industry standard protocols:



* Industry-Standard AES-256 encryption.
* Keys are managed in-house with industry standard Key Management Interoperability Protocol (KMIP).
* Storage is validated for US Federal Information Processing Standard (FIPS) Publication 140-2, Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA). Storage is also validated for Payment Card Industry (PCI), Basel II, California Security Breach Information Act (SB 1386), and EU General Data Protection Regulation (GDPR) compliance.





 Securing your snapshots or replicated storage 

All snapshots and replicas of encrypted file storage are also encrypted by default. This feature can’t be turned off on a volume basis. All cluster-to-cluster traffic is encrypted with TLS.





 Provisioning storage with encryption 

The provider-managed encryption-at-rest feature is available in all [data centers](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-selectDC). All storage that is ordered in these data centers is automatically provisioned with encryption for data-at-rest.

When you order File Storage for Classic, select a data center that is marked with an asterisk (). You can see a lock icon to the right of the Volume Name field that indicates that the volume is encrypted. See Figure 1.

Zoom

![Figure 1. Example of the lock icon that indicates that the volume is encrypted.]
PM-8 - Critical Infrastructure Plan 



  Control requirements 

PM-8 - 0
:   The organization addresses information security issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.