vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Check whether all network interfaces of a virtual server instance have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Container Registry image pushes and pulls take place only over private endpoints
* Check whether Virtual Servers for VPC instance has the minimum # interfaces
* Check whether Virtual Private Cloud (VPC) has no subnet with public gateway attached
* Check whether Hyper Protect Crypto Services is accessible only through private endpoints
* Check whether Virtual Private Cloud (VPC) security groups have outbound ports that are open only to permitted IP addresses
* Check whether Virtual Private Cloud (VPC) is configured with public gateways that are provisionable only within permitted zones
* Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)
* Check whether a security group other than the default for Virtual Private Cloud is attached to all endpoints
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to RDP port
* Check whether App ID redirect URIs are not using localhost or 127.0.0.1
* Check whether Cloud Object Storage is accessible only by using private endpoints
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to SSH port
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port







 NIST supplemental guidance 

Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include, for example, keeping export-controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, restricting web requests to the Internet that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between information systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies.
Access Control 

Audit and Privileges view access should be secured. Security administrative access should only be given to authorized users. Audit policy defined and in use views should never be available to the PUBLIC. Privileges view should not be available to PUBLIC. The service will reinforce this with every update.

There may be certain use cases where you will need to deviate from the secured configuration. If you wish to keep this as a permanent setting, please contact IBM Support.
If you need to enable an allowed IP policy for your Key Protect instance, [get support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) or [create a case](https://cloud.ibm.com/unifiedsupport/cases/form) to request access to this feature.

Before you enable and allowed IP policy for your Key Protect instance, keep in mind the following considerations:



* If you are using a private endpoint, your private environment should be set up prior to enabling an allowed IP policy for your Key Protect instance. Before you create an instance policy for your Key Protect instance, ensure that you have [configured](https://cloud.ibm.com/docs/key-protect?topic=key-protect-private-endpointsconfigure-private-network) the private network on your server so that you will be able to assign the correct IP addresses to the policy.
* Allowed IP policies only support traffic from IPv4 addresses through private endpoint. Keep in mind that while both IPv4 and IPv6 subnets can be added to an allowed IP policy, an active allowed IP policy can only allow IPv4 private network gateway addresses to access Key Protect instances via a private endpoint.
* You will need to need to use a private port to access your Key Protect instance via private network. Once you create an allowed IP policy, your Key Protect instance will be assigned a private endpoint port. You will need to [retrieve](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-allowed-ipretrieve-allowed-ip-port) the port and [specify](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-allowed-ipsend-private-allowed-ip-traffic) the port number during each request via a private endpoint.
* There is limited allowed IP policy support for Key Protect instances that are integrated with other IBM Cloud services. Service to service calls will bypass allowed IP policy enforcement.
Learn more about IBM's own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey [here](https://www.ibm.com/data-responsibility/gdpr/).





 Health Insurance Portability and Accountability Act (HIPAA) 

US Health Insurance Portability and Accountability Act (HIPAA) support is available for Enterprise plans that are hosted in the Washington, DC or Dallas locations. For more information, see [Enabling HIPAA support for your account](https://cloud.ibm.com/docs/account?topic=account-enabling-hipaa).

Do not add personal health information (PHI) to the training data (entities and intents, including user examples) that you create. In particular, be sure to remove any PHI from files that contain real user utterances that you upload to mine for intent or intent user example recommendations.





 Opting out of log data use 

IBM uses log data, Enterprise plan data excluded, to continually learn from and improve the Watson Assistant product. The logged data is not shared or made public.

To prevent IBM from using your log data for general service improvements, complete one of the following tasks:



* If you are using a custom application, for each API /message request, set the X-Watson-Learning-Opt-Out header parameter to true.

For more information, see [Data collection](https://cloud.ibm.com/apidocs/assistant/assistant-v2data-collection).
* If you are using the web chat integration, add the learningOptOut parameter to the script that you embed in your web page, and set it to true.

For more information, see [Configuration](https://integrations.us-south.assistant.watson.cloud.ibm.com/web/developer-documentation/api-configuration).







 Labeling and deleting data in Watson Assistant 

Do not add personal data to the training data (actions and steps, including user examples) that you create. In particular, be sure to remove any personally-identifiable information from files that contain real user utterances that you upload to mine for user example recommendations.
Securing your data in VPC 

To ensure that you can securely manage your data when you use IBM Cloud® Virtual Private Cloud, it's important to know exactly what data is stored and encrypted and how you can delete any stored personal data. Data encryption with your own root keys is available by using a supported key management service (KMS).

VPN for VPC does not store any customer data other than what is required to configure VPN gateways, connections, and policies. Data that is transmitted through a VPN gateway is not encrypted by IBM. Data about your specific VPN and policy configurations are encrypted in transit and at rest. VPN configuration data is deleted upon your request through API or User Interface.



 How your data is stored and encrypted in VPC 

All block storage volumes are encrypted by default with IBM-managed encryption. IBM®-managed keys are generated and securely stored in a block storage vault that is backed by Consul and maintained by IBM Cloud® operations.

For more security and control, you can protect your data with your own root keys (also called a customer root key or CRK). This feature is commonly called Bring Your Own Key, or BYOK. Root keys encrypt the keys that safeguard your data. You can import your root keys to Key Protect or Hyper Protect Crypto Services, or have either key management service create one for you.

The KMS stores your key and makes it available during volume and custom image encryption. Key Protect provides FIPS 140-2 Level 3 compliance. Hyper Protect Crypto Services offers the highest level of security with FIPS 140-2 Level 4 compliance. Your key material is protected in transit (when it's transported) and at rest (when it is stored).

Customer-managed encryption is available for custom images, boot volumes, and data volumes. When an instance is provisioned from an encrypted custom image, its boot volume is encrypted by using the image’s root key. You can also choose a different root key. Data volumes are encrypted by using root keys when you provision a virtual server instance or when you create a stand-alone volume.
For more information, see [Enabling file share encryption in transit secure connections](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit).
* Is there support for security groups and network ACLs?

 Is there support for security groups and network ACLs? 

Yes. You can specify a security group access control mode to restrict mounting file shares to specific instances in your VPC. For more information, see [Granular authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-mount-access-mode).
* How is my data protected in a file share? Can I use my own encryption keys?

 How is my data protected in a file share? Can I use my own encryption keys? 

By default, your file share data is protected at rest with IBM-managed encryption. You can also bring your own keys to the IBM Cloud® and use them to encrypt your file shares. For more information, see [Creating file shares with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). By using the API, you can link a primary account that holds a root key to a secondary account, then use that key to encrypt new file shares in the secondary account. For more information, see [Cross-account encryption for multitenant storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).
* Is my data protected during transit?

 Is my data protected during transit? 

You can enable secure end-to-end encryption of your data when you use file shares with security-group-based access control mode and mount targets with virtual network interfaces. When such a mount target is attached and the share is mounted on a virtual server instance, the virtual network interface performs security group policy check to ensure only authorized instances can communicate with the share. The traffic between the authorized virtual server instance and the file share can be IPsec encapsulated by the client.
Managing encryption 

By default, segment data in App Configuration is encrypted at-rest using a randomly generated key. Although this default encryption model provides at-rest security, you might need a higher level of control. For these use cases, App Configuration supports customer-managed encryption with the following IBM Cloud® Key Management Services:



* IBM® Key Protect for IBM Cloud® (Bring Your Own Key - BYOK) helps you provision encrypted keys for apps across IBM Cloud services. As you manage the lifecycle of your keys, you can benefit from knowing that your keys are secured by FIPS 140-2 Level 3 certified cloud-based hardware security modules (HSMs) that protect against the theft of information. You can find out more about using Key Protect in the [Getting Started tutorial](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial).
* Hyper Protect Crypto Services (Keep Your Own Key - KYOK) is a single-tenant, dedicated HSM that is controlled by you. The service is built on FIPS 140-2 Level 4-certified hardware, the highest offered by any cloud provider in the industry. You can find out more about using Hyper Protect Crypto Services in the [Getting Started tutorial](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).



These services allow the use of a customer-provided key to control encryption. By disabling or deleting this key, you can prevent any further access to the data stored by the service, because it is no longer possible to decrypt it.

Consider using customer-managed keys if you require the following features:



* Encryption of data at-rest controlled by your own key.
* Explicit control of the lifecycle of data stored at rest.



Customer-managed keys is available on the Enterprise plan only.

Deletion of the customer-managed key is non-recoverable and will result in the loss of any data stored in your App Configuration instance.



 What is not covered by customer-managed encryption 

If customer-managed encryption feature is selected, the user should be aware that only segment data is covered by this encryption.
Understanding network protection 

The network protection methods explained here are to protect IBM data centers, and are not to be regarded as a specific customer service. As such, network protection is not available for use as a DDoS mitigation protection service, and its enablement cannot be requested for personal use. For DDoS protection for your internet-facing workloads, consider [IBM Cloud® Internet Services](https://cloud.ibm.com/catalog/services/internet-services).

For more information about personal services available to you to further protect your infrastructure, contact your IBM Sales representative to discuss your options.



 About network protection 

IBM protects the data centers that support your cloud infrastructure from malicious attacks. However, the potential remains for a volumetric DDOS attack on any of your public IP addresses. The following mitigation processes are in place to help protect cloud infrastructure.





 Null route protection 

Null route protection is triggered when traffic that is routed to your public IP goes beyond a certain threshold. A static null route is applied to your public IP that effectively stops all traffic from the internet to that IP address at the edge of the IBM network. This static null route remains in place for 24 hours, after which traffic to your IP is reassessed. If traffic continues to exceed the threshold, your IP remains in a null route for another 24 hours. If the traffic is below the threshold, the static null route is then removed, allowing normal traffic flow to your IP again.

During periods of null route protection, a ticket is generated with the subject “DDOS: Automated System Alert – Null Route”. See the ticket for more details about why your traffic is being diverted.

Null route protection only applies to public IP addresses. If you suspect that your public IP address is blocked or restricted, access your customer portal and review the tickets.





 Filtered protection 

Unlike null routing, filtered protection does not block or restrict your IP address from being reachable by the public internet. Protection devices analyze the traffic and use internal logic to determine if there is malicious traffic to filter. When triggered, filtered protection eliminates any suspicious traffic and allows legitimate traffic to flow to your host.

This protection remains in place until the traffic drops to appropriate levels within the threshold.
Private services and worker node options

 Security feature Description 

 Limit the number of exposed apps By default, your apps and services that run within the cluster are not reachable over the public internet. You can choose if you want to expose your apps to the public, or if you want your apps and services be reachable on the private network only. When you keep your apps and services private, you can leverage the built-in security features to assure secured communication between worker nodes and pods. To expose services and apps to the public internet, you can use Red Hat OpenShift routes, or leverage the [NLB and Ingress ALB support](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_network_planningopenshift_routers) to securely make your services publicly available. Ensure that only necessary services are exposed, and revisit the list of exposed apps regularly to ensure that they are still valid. 
 Limit public internet connectivity with edge nodes Every worker node is configured to accept app pods and associated load balancer or ingress pods. You can label worker nodes as [edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge) to force load balancer pods to be deployed to these worker nodes only. In addition, you can [taint your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_workloads) so that app pods can't schedule onto the edge nodes. With edge nodes, you can isolate the networking workload on fewer worker nodes in your cluster and keep other worker nodes in the cluster private. 







 What if I want to connect my cluster to an on-prem data center? 

To connect your worker nodes and apps to an on-prem data center, you can configure a [VPN IPSec endpoint with a strongSwan service, a Virtual Router Appliance, or with a Fortigate Security Appliance](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnvpn).





 Network segmentation and privacy for VPC clusters
[https://www.ibm.com/scripts/contact/contact/us/en/privacy/](https://www.ibm.com/scripts/contact/contact/us/en/privacy/)





 NIST 

IBM Maximo Application Suite Manage Servers (commercial public offerings) follow NIST guidelines and assess against NIST controls, but claim no specific NIST compliance(s).





 Data Leakage Prevention / Data Loss Prevention (DLP) 

IBM Cloud Delivery Services does not use DLP monitoring. Access controls are implemented on all databases restricted to privileged users only. Database auditing is enabled and logs are retained for 365 days. Customers configure and manage the data their users can view, update and export within the Maximo Application Sutie applications, as well as determine which of their users is permitted direct read-only access to their database(s).

IBM purchases Professional Errors and Omissions including cyber risk insurance (see below) for IBM's liability arising out of actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission committed in the conduct of IBM’s professional services. This includes coverage for loss of intangible property, such as customer data, due to IBM’s negligence. This coverage is global in scope.





 DDoS Protection 

IBM Cloud provides DDoS (Distributed Denial of Service) protection for its environment, designed to protect the entire network. IBM Cloud uses automated DDoS mitigation controls and an in-house Network Operations Center (NOC) team to monitor network performance and security 24x7.





 Media Sanitization 

IBM Cloud and AWS securely sanitizes physical media intended for reuse prior to such reuse, and will destroy physical media not intended for reuse, consistent with National Institute of Standards and Technology, United States Department of Commerce (NIST) guidelines for media sanitization (see links below)



* IBM Cloud: [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf)
Hyper Protect Crypto Services also supports industry standards such as Public-Key Cryptography Standards #11 (PKCS #11) for cryptographic operations like digital signing and Secure Sockets Layer (SSL) offloading.
* How is Keep Your Own Key different from Bring Your Own Key?

Bring Your Own Key (BYOK) is a way for you to use your own keys to encrypt data. The key management services that provide BYOK are typically multi-tenant services. With these services, you can import your encryption keys from the on-premises hardware security modules (HSM) and then manage the keys.

With Keep Your Own Key (KYOK), IBM brings industry-leading level of control that you can exercise on your own encryption keys. In addition to the BYOK capabilities, KYOK provides technical assurance that IBM cannot access the customer keys. With KYOK, you have exclusive control of the entire key hierarchy, which includes the master key.

The following table details the differences between KYOK and BYOK.



Table 1. Comparing BYOK with KYOK

 Cloud key management capabilities BYOK KYOK 

 Managing encryption key lifecycle Yes Yes 
 Integrating with other cloud services Yes Yes 
 Bringing your own keys from on-premises HSMs Yes Yes 
 Operational assurance - Cloud service providers cannot access keys. Yes Yes 
 Technical assurance - IBM cannot access the keys. No Yes 
 Single tenant, dedicated key management service. No Yes 
 Exclusive control of your master key. No Yes 
 Highest level security - FIPS 140-2 Level 4 HSM. No Yes 
 Managing your master key with smart cards. No Yes 
 Performing key ceremony. No Yes 



* What can I do with IBM Cloud Hyper Protect Crypto Services?

IBM Cloud Hyper Protect Crypto Services can be used for key management service and cryptographic operations.

Hyper Protect Crypto Services can integrate with IBM Cloud data and storage services as well as VMware® vSphere® and VSAN, for providing data-at-rest encryption. The managed cloud HSM supports industry standards, such as Enterprise Public-Key Cryptography Standards (PKCS) #11.
IBM Cloud and AWS securely sanitizes physical media intended for reuse prior to such reuse, and will destroy physical media not intended for reuse, consistent with National Institute of Standards and Technology, United States Department of Commerce (NIST) guidelines for media sanitization (see links below)



* IBM Cloud: [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf)
* AWS:

[https://aws.amazon.com/compliance/data-center/controls/#Device_Management](https://aws.amazon.com/compliance/data-center/controls/Device_Management)







 Cyber Insurance 

IBM carries standard cyber risk insurance under its Professional Errors & Omissions policy. PE&O insurance provides coverage for actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission, solely for acts or omissions committed by IBM in providing professional services to our client(s). Coverage includes network security, unauthorized access, unauthorized use, receipt or transmission of a malicious code, denial of service attack, unauthorized disclosure or misappropriation of private information, privacy liability, notification costs, credit card monitoring, and fine & penalties incurred by the customer.

The PE&O Policy itself is IBM Confidential information. Further details on this subject can be accessed (IBMers only) here:

[!https://w3-connections.ibm.com/wikis/home?lang=en-us#/wiki/Wc0a20474fb23_478a_8f6d_1c6dfd3d680f/page/IBM cyber insurance details](https://w3-connections.ibm.com/wikis/home?lang=en-us!/wiki/Wc0a20474fb23_478a_8f6d_1c6dfd3d680f/page/IBM%20cyber%20insurance%20details)





 Regulated Content