vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: When you create a rule by using the console, the flow now includes the attachment of a scope. To try out the new flow, see [the Security and Compliance Center UI](https://cloud.ibm.com/security-compliance/rules).

Quick start: Posture Management
: The Security and Compliance Center UI was updated to include more information in the overview page and a new Quick Start wizard for the Posture Management component of the service. To try it out, see [the Security and Compliance Center UI](https://cloud.ibm.com/security-compliance/overview).





 1 March 2022 

Create scope flow updates
: The create scope flow is now updated in the GUI to include the scheduling of scans as part of the creation of a scope. To try out the new flow, see [the Security and Compliance Center UI](https://cloud.ibm.com/security-compliance/scopes).





 17 February 2022 

New service available in Configuration Governance
: VPN for Virtual Private Cloud is now available as part of the Configuration Governance component. You can create guardrails for VPN for VPC such as enforcing specific IPsec and IKE policies for authentication and encryption.





 27 January 2022 

Add parameters during credential mapping
: When resources such as an instance of Kubernetes Service clusters are scanned, additional parameters must be provided in order for the collector to access all their configuration data. If so, additional fields are displayed in the Security and Compliance Center UI when you are mapping credentials.

Now available: New version of the IBM Cloud for Financial Services profile
: Version 0.1.3 of the IBM Cloud for Financial Services profile is now available with new goals and controls. For more information, see the [IBM Cloud for Financial Services profile change log](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-fs-change-log).





 21 January 2022 

New service available in Configuration Governance
: IBM Cloud App ID is now available as part of the Configuration Governance component. You can create guardrails for App ID such as enforcing whether monitoring of runtime activity that is made by application users is tracked.





 11 January 2022
The removal of Configuration Governance. Although rules will continue to exist in the new experience, we are temporarily removing the Configuration Governance component of the service which is currently used for enforcement. While there is no timeline in place for this functionality to return, we will keep you updated.





 21 September 2022 

Now available: New version of the IBM Cloud for Financial Services profile
: Version 0.6.0 of the IBM Cloud for Financial Services profile is now available with new goals and controls. For more information, see the [IBM Cloud for Financial Services profile change log](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-fs-change-log).





 1 September 2022 

New properties available for Virtual Private Cloud
: IBM Cloud Virtual Private Cloud now has additional properties available as part of the Configuration Governance component. You can create guardrails for virtual servers such as restricting the use of floating IPs and service metadata.

Removed: Credential passphrase
: As of today, 1 September 2022, the ability to use a passphrase to manage the security of your credentials is deprecated in favor of Bring Your Own Key (BYOK) functionality. If you did not disable your passphrase and return to IBM-managed, you must recreate all of your credentials to continue to scan your resources. For help enabling BYOK or to learn more about how your credentials are protected, see [Storing and encrypting data in Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-mng-data).





 11 August 2022 

Now available: New version of the IBM Cloud for Financial Services profile
: Version 0.5.0 of the IBM Cloud for Financial Services profile is now available with new goals and controls. For more information, see the [IBM Cloud for Financial Services profile change log](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-fs-change-log).





 9 August 2022 

New available: Longer default storage
: The data that is generated during a scan is now stored for 180 days. This is an increase from 30 days.
2016-02-11T16:46:56.842065025Z stdout: hello bob!

You might also see the logs for any actions that are run on your behalf in Cloud Functions in real time.







 Viewing activation details 

Cloud Functions actions can be invoked by other users, in response to various events, or as part of an action sequence. When an action is invoked, an activation record is created for that invocation. To get information about the result of the action invocation, you can get details about activations.

Activation data is only accessible through the Cloud Functions API (CLI or REST) for 24 hours after the action finishes processing. In addition, the activation data is also sent to logging and can be accessed there for a longer period of time, depending on the service plan that you chose for the logging instance. For more information, see [Viewing logs in IBM Log Analysis](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-logslogs_console).

You can get all activation record IDs in a namespace by running the following command.

ibmcloud fn activation list

You can get details about a specific activation record that resulted from an action invocation by running the following command. Replace <activation_ID> with the ID of the activation.

ibmcloud fn activation get <activation_ID>

See the following example for the ibmcloud fn activation get <activation_ID> command.

ok: got activation c2b36969fbe94562b36969fbe9856215
{
"namespace": "<namespace_ID>",
"name": "hello",
"version": "0.0.1",
"subject": "user@email.com",
"activationId": "c2b36969fbe94562b36969fbe9856215",
"start": 1532456307768,
"end": 1532456309838,
"duration": 2070,
"response": {
Managing connections 

IBM® Cloud Foundry is deprecated and no longer supported as of 1 June 2023. For more information, see the [deprecation details](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecationdep_details).

You can connect a service to an existing or new IBM Cloud® app from the Connections tab on your service dashboard. Connecting a Cloud Foundry service to a Cloud Foundry app creates a binding between them, and you can unbind, add additional connections, or delete connections from the Connections tab.

However, when you connect a service instance that is managed by IBM Cloud® Identity and Access Management (IAM) to a Cloud Foundry app, an alias of the service managed by IAM is automatically created in the corresponding Cloud Foundry space with the binding information that you specified. This alias is represented as a Cloud Foundry service instance of your IAM-managed service.



 What is an alias? 

An alias is a connection between your IAM-managed service within a resource group and a Cloud Foundry app within an org or a space. In the IBM Cloud console, the connection (alias) is represented as a Cloud Foundry service instance. You can manage your alias by modifying the service instance that represents your connection.

Aliases are like symlinks that hold references to remote resources and enable interoperability and reuse of an instance across the platform. For example, you can create an instance of a service in a resource group and then reuse it from any available Cloud Foundry region by creating an alias in an org or space in those regions.

The following rules apply to aliases:



* There is no extra charge for an alias, but each alias counts against your quota in your Cloud Foundry organization.
* You can create only one alias per Cloud Foundry space in the IBM Cloud console. However, more than one alias per space can be created using the IBM Cloud CLI. For more information, see [Working with resource groups and resources](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource).
CP-2 (3) - Resume Essential Missions / Business Functions 



  Control requirements 

CP-2 (3) - 0
:   The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.





  Additional IBM Cloud for Financial Services specifications 



*  Contingency plans should also include planning for the resumption of all missions and business functions within an organization-defined time period of contingency plan activation.
*  Recovery strategies must meet the RTOs (Recovery Time Objectives) and RPOs (Recovery Point Objectives) for a minimum of six (6) weeks.







  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Operational logging](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-operational)
*  [Operational monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-operational)







  NIST supplemental guidance 

Organizations may choose to carry out the contingency planning activities in this control enhancement as part of organizational business continuity planning including, for example, as part of business impact analyses. The time period for resumption of essential missions/business functions may be dependent on the severity/extent of disruptions to the information system and its supporting infrastructure.
Yes. Qiskit Runtime allows you to specify the system on which your Qiskit program should be run. But it is not necessary to do so. The service uses the least busy system if none is specified.





 Is there support provided for Qiskit Runtime and what is the Service Level Objective? 

Currently, the Qiskit Runtime cloud service is in beta status. Therefore, IBM provides best effort support for the service. IBM uses commercially reasonable efforts to respond to support requests; however, there is no specified response time objective for support.





 How can I open a support ticket if I encounter a problem with the service or my jobs? 

For help with Qiskit, access our Slack community: [Qiskit Slack](https://ibm.co/joinqiskitslack).





 Qiskit Runtime is in beta status. When will Qiskit Runtime be generally available in IBM Cloud®? 

The Qiskit Runtime beta service is constantly enhanced with new features and functions based on feedback from our users. Enhancements from quantum hardware and software might also contribute to more features and functions of the service. The integration of the service in IBM Cloud® creates many possibilities to interact with other services on IBM Cloud®. At the moment, no specific plan for a general availability exists.





 Today there are two primitive programs available to access IBM Quantum systems. Are there plans to provide more primitives? For instance, for more low-level access to IBM Quantum systems? 

We continue to evaluate the use of quantum hardware and expand the set of primitives to meet common needs. However, the Qiskit Runtime in IBM Cloud® is meant to serve algorithm or application development. If you require lower-level access, then your needs would be better served by the IBM Quantum channel.





 Can a Qiskit Runtime service instance be shared between users? 

Qiskit Runtime supports IBM Cloud® Identity and Access Management (IAM). With IAM, the user who deployed the service can enable users and groups to access the service. The user who deployed the service gets charged for the usage of all users who are enabled for that service instance.





 How long does it take to deploy Qiskit Runtime in IBM Cloud®?
SC-11 - Trusted Path 



 Control requirements 

SC-11 - 0
: The information system establishes a trusted communications path between the user and the following security functions of the system: [IBM Assignment: ISV-defined security functions to include at a minimum, information system authentication and re-authentication].





 Additional IBM Cloud for Financial Services specifications 



* This control is required for ISVs.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Connecting application provider to the management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management)
* [Consumer connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-workload)
* [Creating and connecting the management and workload VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-create-vpcs)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether App ID email dispatchers are using HTTPS only
* Check whether Cloud Object Storage is accessible only through HTTPS
* Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS
* Check whether App ID webhooks are using HTTPS only
* Check whether account has at least one VPN or Direct Link configured
* Check whether App ID redirect URIs are using HTTPS only
* Check whether Cloud Internet Services (CIS) has TLS mode set to End-to-End CA signed
* Check whether Application Load Balancer for VPC pool uses the HTTPS protocol for HTTPS listeners
* Check whether Application Load Balancer for VPC uses HTTPS (SSL & TLS) instead of HTTP







 NIST supplemental guidance
AC-14 - Permitted Actions Without Identification or Authentication 



  Control requirements 

The organization:

AC-14 (a)
:   Identifies [IBM Assignment: No access is permitted without identification or authentication] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and

AC-14 (b)
:   Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for AC-14 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID  Rules                                                                                                                                                                                                                                                                                                                                                 

 AC-14 (a)       <br><br> *  Check that no public access is granted via the IAM public access group<br> *  Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)<br> *  Check whether App ID anonymous authentication is disabled<br><br><br> 







  NIST supplemental guidance 

This control addresses situations in which organizations determine that no identification or authentication is required in organizational information systems. Organizations may allow a limited number of user actions without identification or authentication including, for example, when individuals access public websites or other publicly accessible federal information systems, when individuals use mobile phones to receive calls, or when facsimiles are received. Organizations also identify actions that normally require identification or authentication but may under certain circumstances (e.g., emergencies), allow identification or authentication mechanisms to be bypassed. Such bypasses may occur, for example, via a software-readable physical switch that commands bypass of the logon functionality and is protected from accidental or unmonitored use. This control does not apply to situations where identification and authentication have already occurred and are not repeated, but rather to situations where identification and authentication have not yet occurred. Organizations may decide that there are no user actions that can be performed on organizational information systems without identification and authentication and thus, the values for assignment statements can be none.
This field is named according to the entity; for example, the name requestData.actionName is used for actions.
: Additionally, the initiator.host.agent field contains information about the user agent that sent the request. If the action was initiated through the CLI, this field starts with CloudFunctions-Plugin, if it is initiated through the Cloud Console (UI), the value is IBM Cloud Functions UI.

Getting information for failures
: All events that are issued for failed actions display failure in the outcome field, and in addition provide more details as part of the reason field. Note that the reason.reasonForFailure field might be especially helpful, as it contains details of the failure.

Custom views
: For more information about generating custom views by using event fields, see [Creating custom views](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-views).
* Is there a way to connect Direct Link to VPC without using the classic infrastructure?

Yes, this is possible on Direct Link. The VRF created is local to the XCR versus global on the classic infrastructure. Route targeting to VPC then enables Direct Link to be used with VPC natively using the UI (without touching the classic infrastructure).

When routing on-premises subnets from the direct link through a VPC, you must create a route in the VPC routing table. For more information, see [Creating a route](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-route).
* Are there documented limitations for Direct Link?

Yes, they are listed in [Known limitations](https://cloud.ibm.com/docs/dl?topic=dl-known-limitations&interface=ui).
* How do I move from IBM Cloud Direct Link on Classic to the new Direct Link?

Direct Link has a new user interface and records system, requiring you to place a brand new Direct Link order.
* Are there any performance impacts affected by moving from IBM Cloud Direct Link on Classic?

The new Direct Link performs better as it's not required to exist inside your global VRF for classic IaaS. It is a true access platform to all of IBM Cloud.
* What are the tools for monitoring the consumption of resources associated with the service, as well as the costs and the quality of the service?

IBM Cloud Direct Link is integrated into the [IBM Cloud usage dashboard](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusage), which provides a summary of estimated charges for all services and resources that are used per month in your organizations. This includes the number of connections and the amount of traffic flowing across your direct links. IBM Cloud Direct Link usage is billed and reported as part of the [IBM Cloud invoice process](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-managing-invoices).
* How does IBM Cloud Direct Link work?
functions.rule.delete Delete a rule. 









 Viewing events 

Cloud Functions sends audit logs to the [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started) service of the same region as the Cloud Functions namespace. For example, audit logs of a Cloud Functions namespace in us-south are sent to a logging instance in us-south. For more information about setting up IBM Cloud Activity Tracker, see [Provisioning an instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision).





 Analyzing events 

After viewing events that are captured by IBM Cloud Activity Tracker, you can then analyze the events.

Identifying the Cloud Functions namespace that generates the event
: To identify the namespace for which the event was generated, look at the target.id field. You can use this field to filter events, for example, showing events for only a specific namespace.
: You can use the CLI to find details about your [namespaces](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespaceshow_list_namespace).

Getting the unique ID of a request
: Each action that you perform on a Cloud Functions namespace resource has a unique ID.
: To find the unique ID of a request, look at the requestData.requestId value that is set in the requestData field.

Getting request details
: The requestData field contains the name of the namespace entity such as action, package, trigger, or rule for which the event is generated. This field is named according to the entity; for example, the name requestData.actionName is used for actions.
: Additionally, the initiator.host.agent field contains information about the user agent that sent the request. If the action was initiated through the CLI, this field starts with CloudFunctions-Plugin, if it is initiated through the Cloud Console (UI), the value is IBM Cloud Functions UI.

Getting information for failures
You can now use the bulk_remove API endpoint to remove multiple users from an App ID instance at once. [Learn more](https://cloud.ibm.com/docs/appid?topic=appid-cd-usersdelete-users).





 15 December 2022 

New App ID API endpoints
: App ID added options to make it more efficient for you to migrate your users from one service instance to another. You can now use the [export_all](https://cloud.ibm.com/docs/appid?topic=appid-cd-userscd-export-all) or [import_all](https://cloud.ibm.com/docs/appid?topic=appid-cd-userscd-import-all) API endpoints to migrate all of your users (up to approximately 16,000).





 27 June 2022 

Swift Server SDK unsupported
: IBM Cloud no longer supports the Swift Server SDK for App ID. To continue to receive support for your App ID integration, you can move to directly calling the APIs.





 21 January 2022 

App ID availability in Configuration Governance
: IBM Cloud App ID is now available as part of the Configuration Governance component of the Security and Compliance Center. You can create guardrails for App ID such as enforcing whether monitoring of runtime activity made by application users is tracked.





 15 December 2021 

Logging enhancement
: As of 15 December 2021, App ID now logs email addresses from login attempts even if the user is unknown to the service. Previously, email addresses were logged only if the user was known to App ID.





 27 September 2021 

New region availability
: As of 27 September 2021, App ID is now available in the Sao Paulo region. For a detailed list of the regions in which the service is available, see [Regions and endpoints](https://cloud.ibm.com/docs/appid?topic=appid-regions-endpoints).





 12 July 2021 

New region availability
: As of 12 July 2021, App ID is now available in the Toronto and Osaka regions.