vania-janet/multiturn-rag-retrieval-data huggingface dataset:
However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps
rule-094495cf-c092-4dcb-96b8-3654c4bcf787 - Check whether Databases for PostgreSQL is accessible only by using private endpoints
rule-beb7b289-706b-4dc0-b01d-b1d15d4331e3 - Check whether Databases for MongoDB network access is restricted to a specific IP range
rule-04d856f1-68ce-4cba-b800-ba49f3c4f1a1 - Check whether Databases for Redis network access is restricted to specific IP range
rule-b5c06228-3f38-4d98-837f-2fe10d6ff9d5 - Check whether Databases for Elasticsearch network access is restricted to a specific IP range
rule-18540c4e-b96d-4ab9-a619-d541cc5a2824 - Check whether Databases for etcd network access is restricted to a specific IP range
rule-9b2d8054-bc93-44fd-901b-91f677287e84 - Check whether Databases for PostgreSQL network access is restricted to a specific IP range
rule-f6b7a692-8e48-4e74-b957-f5d591a7a15d - Check whether Key Protect has high availability
rule-d0725d07-27e6-4079-a3bc-746d5ccae00f - Check whether Hyper Protect Crypto Services instance is enabled with a dual authorization deletion policy
rule-da567ec9-8e24-4c65-993b-ad290bfdb855 - Check whether Cloud Object Storage buckets are enabled with IBM Activity Tracker
rule-0fb54bb2-773b-4cec-81b0-1ca7d8049ba0 - Check whether Cloud Object Storage buckets are enabled with IBM Cloud Monitoring
IBM is responsible for the security and compliance of Code Engine. You are responsible for the security and compliance of any Code Engine entities that run in the Code Engine environment and your associated data.



Table 5. Responsibilities for security and regulation compliance
The rows are read from left to right. The resource area of comparing responsibilities is in the first column, with the responsibilities of IBM in the second column and your responsibilities in the third column.

 Task IBM responsibilities Your responsibilities 

 General <br><br> * Maintain controls commensurate to various industry compliance standards.<br> * Monitor, isolate, and recover user projects.<br> * Provide highly available replicas of your projects and entities.<br> * Monitor and report the health of the project and entities in the various interfaces.<br> * Automatically apply security patch updates for infrastructure.<br> * Enable certain security settings, such as encrypted disks.<br> * Disable certain insecure actions, such as not permitting users to SSH into the host.<br> * Encrypt communication with TLS.<br> * Continuously monitor Code Engine projects and entities to detect vulnerability and security compliance issues.<br> * Provide options for network connectivity.<br> * Integrate Code Engine with IBM Cloud Identity and Access Management (IAM).<br><br><br> <br><br> * Set up and maintain security and regulation compliance for your Code Engine entities and data.<br> * As part of your incident and operations management responsibilities for Code Engine entities and data, apply any security updates.<br> * Do not include sensitive or private information in Code Engine resource metadata, including configuration values.<br><br><br> 
 Building from source <br><br> * Continuously update the build tools, including BuildKit, and Paketo buildpacks to the latest version.<br><br><br> <br><br> * Resubmit builds to pick up fixes in the base image of your Dockerfile-based builds and to pick up operating system and runtime environment fixes in your Buildpacks-based builds.<br><br><br> 







 Disaster recovery 

IBM is responsible for the recovery of Code Engine projects and entities in case of disaster.
Set preferences to [receive emails about platform notifications](https://cloud.ibm.com/docs/overview?topic=overview-uiemail-prefsl), and monitor the [IBM Cloud status page](https://cloud.ibm.com/status?selected=announcement) for general announcements. 







 Change management 

You and IBM share responsibilities for keeping IBM Key Protect service components at the latest version.

You are responsible for change management of your application data.



Table 2. Responsibilities for change management

 Task IBM Responsibilities Your Responsibilities 

 Applications Provide major, minor, and patch version updates for Key Protect interfaces. Use the API, CLI, or console tools to apply the provided updates, including version updates, new features, and security patches. 







 Identity and access management 

You and IBM share responsibilities for controlling access to your IBM Key Protect instances and resources.

You are responsible for identity and access management to your application data.



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Applications Provide the ability to restrict access to resources. Depending on your needs, restrict access to resources and service functionality by using Cloud IAM access policies. For more information, see [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access). 







 Security and regulation compliance 

IBM is responsible for the security and compliance of IBM Key Protect.

You are responsible for the security and compliance of your application data.



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Applications Maintain controls that are commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliancecompliance-ready), such as SOC and ISO. Set up and maintain security and regulation compliance for your apps and data.
[SC-22 - Architecture and Provisioning for Name / Address Resolution Service](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-22sc-22)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-22control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-22nist-supplemental-guidance)



[SC-23 - Session Authenticity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-23sc-23)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-23control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-23scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-23nist-supplemental-guidance)



[SC-28 - Protection of Information at Rest](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28sc-28)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28implementation-guidance)
(https://cloud.ibm.com/docs/openshift?topic=openshift-securitycan-i-use-security-groups)
* [How can I do TLS termination with LoadBalancer and Ingress services?](https://cloud.ibm.com/docs/openshift?topic=openshift-securitytls-termination-lb)



* [Persistent storage](https://cloud.ibm.com/docs/openshift?topic=openshift-securitystorage)
* [Monitoring and logging](https://cloud.ibm.com/docs/openshift?topic=openshift-securitymonitoring_logging)
* [Container runtime](https://cloud.ibm.com/docs/openshift?topic=openshift-securitycontainer-runtime)
* [Image and registry](https://cloud.ibm.com/docs/openshift?topic=openshift-securityimages_registry)
* [Container isolation and security](https://cloud.ibm.com/docs/openshift?topic=openshift-securitycontainer)



* [Should I set up a single-tenant or a multi-tenant cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-securitysingle-tenant-or-multi)



* [Storing personal information](https://cloud.ibm.com/docs/openshift?topic=openshift-securitypi)
* [Kubernetes security bulletins](https://cloud.ibm.com/docs/openshift?topic=openshift-securitysecurity_bulletins)



[Architecture and dependencies of the service](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-architecture)



* [Classic Red Hat OpenShift version 4 architecture](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-architecture-4)
[Regularly scan for open ports / protocols](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-network-threat-detection) <br><br> * Regularly scan to make sure the list of open ports / protocols reflects the minimum number of ports / protocols that are needed by your workloads.<br><br><br> <br><br> * Regularly scan to make sure the list of open ports / protocols reflects the minimum number of ports / protocols that are needed within your IaaS / data center environment.<br><br><br> 
 [Secure and manage secrets and certificates](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-secrets-management) <br><br> * Securely protect secrets through their entire lifecycle using tools like Hashicorp Vault. For more information, see [Handling and securing secrets](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets).<br><br><br> <br><br> * Securely protect secrets that are needed in your IaaS / data center environment through their entire lifecycle by using tools like Hashicorp Vault.<br><br><br> 
 [Tag all IBM Cloud resources with security attributes](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-security-attributes) <br><br> * Tag all IBM Cloud resources in your account should be tagged with security attributes you define. For more information, see [Tagging IBM Cloud resources and managing access with tags](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resources).<br><br><br> <br><br> * Tag all resources in your IaaS / data center environment based on security attributes that you define. Use tools of your choosing.<br><br><br>
* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-31-412)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-32-412)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-section-4-412)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-41-412)
* [4.2 Kubelet](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-42-412)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-section-5-412)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-51-412)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-52-412)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-53-412)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412cis-benchmark-54-412)
Access Control (AC) [AC-20 Use of External Information Systems](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-20) 
 Security Assessment and Authorization (CA) [CA-3 System Interconnections](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3) 
 System and Communications Protection (SC) [SC-2 Application Partitioning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2) <br>[SC-3 Security Function Isolation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-3) <br>[SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7
* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-31)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-32)



* [4 Worker Nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-4)
* [5 Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-5)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-51)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-52)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-53)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-54)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-55)
* [5.7 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-57)
Access Control (AC) [AC-20 Use of External Information Systems](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-20) 
 Security Assessment and Authorization (CA) [CA-3 System Interconnections](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3) 
 System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) 







 Next steps 



* [Completing operator actions through a bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-bastion)
* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-31-123)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-32-123)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-section-4-123)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-41-123)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-42-123)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-section-5-123)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-51-123)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-52-123)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-53-123)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-54-123)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-55-123)
Code Engine and security 

The [IBM Cloud® Code Engine architecture](https://cloud.ibm.com/docs/codeengine?topic=codeengine-architecture) is built with a security-first mindset. Code Engine components are [managed and owned by IBM](https://cloud.ibm.com/docs/codeengine?topic=codeengine-responsibilities-ce). Customers and their workloads are isolated from each other by using projects, which are based on Kubernetes namespaces. Role-based access controls are performed on a resource level to allow only authorized users to perform certain operations on project resources. User access is controlled by Cloud Identity and Access Management (IAM). Deployed apps are exposed through HTTPS and Code Engine creates and manages the underlying TLS certifications automatically for you. Code Engine provides out-of-the-box DDoS protection for your application. Code Engine's [DDoS protection](https://cloud.ibm.com/docs/codeengine?topic=codeengine-securesecure-ddos) is provided by Cloud Internet Services (CIS) at no additional cost to you.

Code Engine jobs cannot be accessed externally by definition. Jobs can still make external requests, though, and they can call Code Engine applications internally. For an example of a job that calls an application internally, see the [Samples for Code Engine GitHub repository](https://github.com/IBM/CodeEngine).

You can use the following security features to enhance your security.



Table 1. Security features

 Security feature Description 

 Authorize access with IAM Grant access to other users for Code Engine by using Cloud Identity and Access Management (IAM). IBM Cloud IAM provides secure authentication with the IBM Cloud platform, Code Engine, and all the resources in your account. Setting up proper user roles and permissions is key to limit who can access your resources. See [Managing user access](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iam).
* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-31)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-32)



* [4 Worker Nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-4)
* [5 Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-5)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-51)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-52)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-53)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-54)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-55)
* [5.7 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-57)
5.2.8 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.9 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies). 
 5.4.2 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 5.5.1 IBM Cloud Kubernetes Service can optionally [enable image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/seccomp). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a [pod or container securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.