vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SA-15 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SA-15 (a) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br> * Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts<br> * Check whether DevSecOps Toolchain passes unit tests to validate all code changes<br> * Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment<br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 







 NIST supplemental guidance 

Development tools include, for example, programming languages and computer-aided design (CAD) systems. Reviews of development processes can include, for example, the use of maturity models to determine the potential effectiveness of such processes.
For more information about using Terraform for creating only a VPC for SAP, without the SAP architecture, see [Creating single-tier virtual private cloud for SAP by using Terraform](https://cloud.ibm.com/docs/sap?topic=sap-create-terraform-single-tier-vpc-sap).

SAP One Support Notes that apply to this document:



* [SAP Note 84555 - Windows Server, Linux®, and UNIX: Certified hardware](https://launchpad.support.sap.com//notes/84855)
* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2923773 - Linux® on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
For more information, see [Using Veeam Backup and Replication software](https://cloud.ibm.com/docs/vpc?topic=vpc-using-veeam-backup-replication-software). For more information on backing up SQL Server, see [Back Up Microsoft SQL Server](https://helpcenter.veeam.com/docs/agentforwindows/userguide/howto_sql_backup.html?ver=50)
* IBM Spectrum Protect Plus - IBM Spectrum Protect Plus is a data protection solution for virtual environments, vSphere or Hyper-V, and provides application data protection for many applications, included SQL Server, hosted on IBM Cloud VPC virtual servers. IBM Spectrum Protect Plus can be implemented as a standalone solution or can integrate with your IBM Spectrum Protect environment to offload copies for long-term storage and governance. IBM Spectrum Protect Plus can be installed automatically in IBM Cloud to an existing VMware environment, see [Spectrum Protect Plus Server](https://cloud.ibm.com/catalog/content/SPPserver-c7e2d4f2-35c4-44ca-8b43-6ff0d4a12aff-globalabout) for more information. For specific information on IBM Spectrum Protect Plus and SQL Server, see [Backing up and restoring SQL Server data](https://www.ibm.com/docs/en/spp/10.1.8?topic=databases-sql-server).









 IBM Cloud Security and Compliance Center 

IBM Cloud Security and Compliance Center enables the identify of security vulnerabilities so that you can work to mitigate the impact and fix the issue of the vulnerability. A Red Hat Enterprise Linux, CentOS, or Ubuntu virtual server cx2-2x4 profile (2 vCPUs, 4 GB RAM, and 4Gbps) is required to be deployed in the VPC to act as a collector host. A collector is a software module that is packaged as a Docker image.

A profile is a collection of related goals, or security checks, used to validate your resources against to internal and external regulations.
SAP One Support Notes that apply to this document:



* [SAP Note 84555 - Windows Server, Linux®, and UNIX: Certified hardware](https://launchpad.support.sap.com//notes/84855)
* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2923773 - Linux® on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2923773 - Linux® on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel® processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2923773 - Linux on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
The Terraform scripts create a complete solution and selectively modifying resources with the user interface might cause unexpected results.

If you need to remove your VPC, go to your project folder and run terraform destroy.





 Related information 

SAP One Support Notes that apply to this document:



* [SAP Note 84555 - Windows Server, Linux®, and UNIX: Certified hardware](https://launchpad.support.sap.com//notes/84855)
* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2923773 - Linux® on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* Create a custom dashboard. For more information, see [Working with dashboards](https://cloud.ibm.com/docs/monitoring?topic=monitoring-dashboardsdashboards).
* Learn about alerts. For more information, see [Working with alerts](https://cloud.ibm.com/docs/monitoring?topic=monitoring-monitoringmonitoring_alerts).
* Learn how to manage logs. See [Logging with bare metal servers](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-ubuntu_baremetal).
* Learn about the IBM Cloud Monitoring Workload Protection functionality to find and prioritize software vulnerabilities, detect and respond to threats, and manage configurations, permissions and compliance from source to run. See [Getting started with IBM Cloud® Security and Compliance Center Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started).
* Create a custom dashboard. For more information, see [Working with dashboards](https://cloud.ibm.com/docs/monitoring?topic=monitoring-dashboardsdashboards).
* Learn about alerts. For more information, see [Working with alerts](https://cloud.ibm.com/docs/monitoring?topic=monitoring-monitoringmonitoring_alerts).
* Learn how to manage logs. See [Logging with Linux VPC server instances](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-ubuntu).
* Learn about the IBM Cloud Monitoring Workload Protection functionality to find and prioritize software vulnerabilities, detect and respond to threats, and manage configurations, permissions and compliance from source to run. See [Getting started with IBM Cloud® Security and Compliance Center Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started).
"dateDisabled":1683550789329,
"limit":null,
"reservation":null,
"teamId":null
}
}







 Enabling an access key 

To enable an existing access key for an IBM Cloud Security and Compliance Center Workload Protection instance, complete the following steps:



1. Obtain the API Token from the IBM Cloud Security and Compliance Center Workload Protection UI. [Learn more](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-api_tokenapi_token_get).
2. Issue a curl POST request against the endpoint to enable the given access key.

curl -XPOST -H 'Authorization: Bearer SYSDIG_API_TOKEN' -H 'IBMInstanceID: GUID' https://ENDPOINT/api/customer/accessKeys/ACCESS_KEY/enable

Where



* ENDPOINT is the URL for the region where the instance is available. For more information, see [Endpoints](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-endpointsendpoints).
* SYSDIG_API_TOKEN is the API Token retrieved in step 1.
* ACCESS_KEY is the access key that you wish to enable.
* GUID is the GUID of the instance that is associated with the access key.





After you enable the access key, the agents will need to be manually restarted since an agent that connects with a disabled access key will be terminated.





 Viewing the available access keys 

To view all of the access keys for an IBM Cloud Security and Compliance Center Workload Protection instance, complete the following steps:



1. Obtain the API Token from the IBM Cloud Security and Compliance Center Workload Protection UI. [Learn more](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-api_tokenapi_token_get).
2. Issue a curl GET request against the regional endpoint to enable the given access key.
* Publish event data to multiple applications to react in real time.



Event Streams offers a fully managed Apache Kafka service, ensuring durability and high availability for our clients. By using Event Streams, you have support around the clock from our team of Kafka experts.







 Databases 



 IBM Cloud Hyper Protect DBaaS for MongoDB (optional) 

Moving confidential and mission-critical data to the cloud presents data confidentiality, security, and reliability concerns. [IBM Cloud® Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-overview) offers highly secure database environments that have technology-enforced protection and high availability.

Built on IBM LinuxONE technology, Hyper Protect DBaaS for MongoDB helps you to alleviate data security and compliance concerns with built-in encryption and tamper protection for data at rest and in flight. You can deploy your workloads with sensitive data and build compliant applications without having to be a security expert.





 IBM Cloud Hyper Protect DBaaS for PostgreSQL (optional) 

Moving confidential and mission-critical data to the cloud presents data confidentiality, security, and reliability concerns. [IBM Cloud® Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-overview) offers highly secure database environments that have technology-enforced protection and high availability.

Built on IBM LinuxONE technology, Hyper Protect DBaaS for PostgreSQL helps you to alleviate data security and compliance concerns with built-in encryption and tamper protection for data at rest and in flight. You can deploy your workloads with sensitive data and build compliant applications without having to be a security expert.









 Reference architecture components 

The following table provides a summary of the main features of the VPC reference architecture and associated IBM Cloud services.



Table 2. Services needed for different parts of the VPC reference architecture

 Architectural component Technology 

 Compute Virtual Servers for VPC <br>Dedicated hosts for VPC
* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2923773 - Linux® on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
Analyzing compliance postures from detection to remediation 

The IBM Cloud® Security and Compliance Center Workload Protection compliance feature persists environment compliance information in an inventory, which enhances resource visibility and full-context prioritization. This information helps you drive remediation and resolution of compliance violations. Workload Protection supports CSPM and KSPM.

Compliance lets you manage your risks by:



* Remediating.
* Accepting the risk.



The resources in your [zones](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-zones) are evaluated against compliance policies and any violations are collected as tiles on the Compliance page in the IBM Cloud® Security and Compliance Center Workload Protection UI. This evaluation is done once daily.

You can use IBM Cloud Security and Compliance Center Workload Protection policies or create custom policies.

When evaluating violations you can select the resource to see the associated list of violations.

You can also create reports that you can download from the UI or API.

You can use the IBM Cloud Security and Compliance Center Workload Protection Posture > Compliance view of the Workload Protection UI to review and analyze your environment's compliance posture.

The basic steps you will follow are:



1. Use the [compliance page](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-compliance-understanding) to see high-level posture performance indicators (PPIs) for each policy applied to your [zones.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-zones)
2. Select a policy in the view to see its results.
3. Select failing requirements to see the controls and associated failing resources.
4. [Remediate the issues.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-evaluate-remediate) The remediation flow lets you to understand the issue and review suggested patches that IBM Cloud Security and Compliance Center Workload Protection creates to resolve the problem. You can also choose to apply the patch manually or by using your Git repository.
* [SAP Note 84555 - Windows Server, Linux®, and UNIX: Certified hardware](https://launchpad.support.sap.com//notes/84855)
* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2923773 - Linux® on IBM Cloud (IaaS): Adaption of your SAP License](https://launchpad.support.sap.com//notes/2923773)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
* [SAP Note 2369910 - SAP Software on Linux®: General information](https://launchpad.support.sap.com//notes/2369910)
* [SAP Note 171380 - Released IBM hardware (Intel® processors) and IBM cloud services offers](https://launchpad.support.sap.com//notes/171380)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)



This document is referenced by:



* [SAP Note 2927211 - SAP Applications on IBM Cloud Virtual Private Cloud (VPC) Infrastructure environment](https://launchpad.support.sap.com//notes/2927211)
* [SAP Note 2588225 - SAP on IBM Cloud: Protect against speculative execution vulnerabilities](https://launchpad.support.sap.com//notes/2588225)
* [SAP Note 1380654 - SAP support in IaaS environments](https://launchpad.support.sap.com//notes/1380654)
* [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097)
[Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql) - Deprecated Hyper Protect DBaaS for PostgreSQL offers fully managed and highly secure PostgreSQL database environments that have technology-enforced protection and high availability. [Hyper Protect Crypto Services integration](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-hpcs-byok) 
 [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb) - Deprecated Hyper Protect DBaaS for MongoDB offers fully managed and highly secure PostgreSQL database environments that have technology-enforced protection and high availability. [Hyper Protect Crypto Services integration](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-hpcs-byok) 







 Compute service integrations 

Use Hyper Protect Crypto Services to bring your own keys to compute services.



Table 3. Supported compute services

 Service Description Integration instruction 

 [IBM Cloud image templates](https://cloud.ibm.com/docs/image-templates?topic=image-templates-getting-started-with-image-templatesgetting-started-with-image-templates) You can use IBM Cloud image templates to capture an image of a virtual server to quickly replicate its configuration with minimal changes in the order process. With the End to End (E2E) Encryption feature, you can bring your own encrypted, cloud-init enabled operating system image.