vania-janet/multiturn-rag-retrieval-data huggingface dataset:
rule-7b210b18-f849-4fa8-bd92-8e47921de51d - Check whether Databases for MongoDB is accessible only by using private endpoints
rule-c58bb2b9-7942-45ab-b9d4-e39c8430f570 - Check whether Databases for Redis is enabled with encryption
rule-e3cad136-17a8-4227-b8af-0be609da1da0 - Check whether Databases for Redis is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-90e3908d-27c3-4050-bb12-413dfc606f5c - Check whether Databases for Redis is accessible only through HTTPS
rule-c48dfb73-ede0-4ebf-b912-214379cd4ce7 - Check whether Databases for Redis is accessible only by using private endpoints
rule-ac09e136-8581-416a-a865-e9fc35a758be - Check whether Databases for Elasticsearch is enabled with encryption
rule-871594ca-0a70-492b-8a42-6f9474445f01 - Check whether Databases for Elasticsearch is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-47ca5017-27e9-4b8b-95d3-c2529271fbb1 - Check whether Databases for Elasticsearch is accessible only through HTTPS
rule-026e6d36-6a15-4623-846d-cab6f3b789d9 - Check whether Databases for Elasticsearch is accessible only by using private endpoints
rule-d634caeb-e5a6-467a-a4ac-8da8fd39f9ef - Check whether Databases for etcd is enabled with encryption
rule-42612696-2b8e-4fa7-8c17-78f191d2e1a0 - Check whether Databases for etcd is accessible only through HTTPS
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 
 Isolation of resources and services per account ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 
 Isolation of account settings ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 
 IAM enabled ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) IP firewall only 
 Public Network Protection ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) !
Set preferences to receive email notifications. Monitor the IBM Cloud status page for general announcements. Use best practices and keep application operating systems and workload applications patched and secure with the most recent security patches. 







 Identity and access management 

Identity and access management includes tasks such as authentication, authorization, access control policies, and approving, granting, and revoking access.



Table 3. Responsibilities for identity and access management
The rows are read from left to right. The first column describes the task that a customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Item IBM responsibilities Your responsibilities 

 Identity and access Provide the function to restrict access to resources through the IBM Cloud console. Provide default access to the provisioned VMware environment. Manage access to resources through IAM (Identity and Access Management). Manage access to the VMware environment. 
 Observability Allow integration of IBM Cloud [Activity Tracker](https://cloud.ibm.com/docs/vmware-service?topic=vmware-service-vmaas-at-events) with your VMware environment to audit the actions that users take in the cluster. Set up IBM Cloud [Activity Tracker](https://cloud.ibm.com/docs/vmware-service?topic=vmware-service-vmaas-at-events) or other functions to track user activity. 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



Table 4. Responsibilities for security and regulation compliance
The rows are read from left to right. The first column describes the task that a customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Item IBM responsibilities Your responsibilities 

 Encryption Provide secure SSL connections to administration portals and replication endpoints. Workload can be deployed by using AES 256-bit encrypted data stores with unique key per customer instance. Backups are encrypted uniquely per customer.
rule-4d86c074-097e-4ff3-a763-ccff128388e2 - Check whether multifactor authentication (MFA) is enabled at the account level
rule-0704e840-e443-4781-b9be-ec57469d09c1 - Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
rule-d61c20c9-c0be-443b-af0c-0d900601e154 - Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)
rule-0244c010-fde6-4db3-95aa-8952bd292ac3 - Check whether permissions for service ID creation are limited and configured in IAM settings for the account owner
rule-ed64fa73-81e5-4920-8519-acfad845dd6c - Check whether Identity and Access Management (IAM) is enabled with audit logging
rule-b2232217-34a6-4fe8-a791-5903f1cc89ca - Check whether Cloud Shell is disabled in account settings
rule-10de7433-19e4-40a7-aebf-eddf1f75a68c - Check whether Cloud Object Storage is enabled with encryption
rule-7c86bb59-d677-422d-875c-0259053fad20 - Check whether Cloud Object Storage is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-222d6531-1fc7-4485-8771-35eb46c78877 - Check whether Cloud Object Storage is accessible only through HTTPS
rule-7c52a1ce-26cd-4cde-baa7-3bfb3703cf74 - Check whether Cloudant is accessible only through HTTPS
rule-f6197ee2-31bf-4d73-aacd-316c41a48df3 - Check whether Cloud Object Storage is accessible only by using private endpoints
* All Databases for Redis deployments are configured with replication to provide both data resilience and [high-availability](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-high-availability). Deployments contain a cluster with two data members in a primary/replica configuration and state is managed with a quorum of three [Redis sentinels](https://redis.io/topics/sentinel).
* If you deploy to an IBM Cloud Single-Zone Region (SZR), each database node resides on a different host in the data center.
* If you deploy to an IBM Cloud Multi-Zone Region (MZR), the nodes are spread over the region's availability zone locations.







 SOC 2 Type 2 Certification 

IBM provides a Service Organization Controls (SOC) 2 Type 2 report for Databases for Redis. The reports evaluate IBM's operational controls according to the criteria set by the American Institute of Certified Public Accountants (AICPA) Trust Services Principles. The Trust Services Principles define adequate control systems and establish industry standards for service providers such as IBM Cloud to safeguard their customers' data and information.

You can request an SOC 2 Type 2 report from the customer portal or contact your sales representative. Alternatively, you can open a support ticket with [IBM Cloud support](https://cloud.ibm.com/unifiedsupport/supportcenter)





 ISO 27017, ISO 27018 

Databases for Redis conforms to the guidelines for information security controls applicable to the provision and use of cloud services that are defined in [ISO 27017](https://www.iso.org/standard/43757.html) and [ISO 27018](https://www.iso.org/standard/76559.html).





 General Data Protection Regulation (GDPR) 

If you have an account with IBM Cloud, your personal data is held by IBM Cloud. The IBM Data Processing Addendum (Addendum) applies to the processing of client's personal data by IBM on behalf of client in order to provide IBM standard services.
[IBM DPA](https://www.ibm.com/support/customer/zz/en/dpa.html)
Rules of behavior must include user responsibilities and expected behavior with regard to asset/device use and handling practices, including but not limited to:



* Encryption usage
* Safeguarding office, desk, drawer keys for storing work resources (e.g., laptops, mobile devices, documents, data)
* Customer information must not be photographed, recorded, or taped.
* Text and instant messaging may only be used for valid business purposes
* Printing customer data only for authorized purposes
* Information security management must approve the use of any removable storage media used to store, process, or transmit customer data



Rules of behavior must include customer required restrictions on sending external emails, including but not limited to:



* Only sending external emails for authorized business purposes
* Never sending or forwarding customer-related content to personal email addresses
* All email exchanges with the customer must be encrypted via customer-approved solutions







 NIST supplemental guidance 

This control enhancement applies to organizational users. Organizations consider rules of behavior based on individual user roles and responsibilities, differentiating, for example, between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users including, for example, individuals who simply receive data/information from federal information systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for both organizational and non-organizational users can also be established in AC-8, System Use Notification. PL-4 b. (the signed acknowledgment portion of this control) may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior. Organizations can use electronic signatures for acknowledging rules of behavior.
rule-026e6d36-6a15-4623-846d-cab6f3b789d9 - Check whether Databases for Elasticsearch is accessible only by using private endpoints
rule-d634caeb-e5a6-467a-a4ac-8da8fd39f9ef - Check whether Databases for etcd is enabled with encryption
rule-42612696-2b8e-4fa7-8c17-78f191d2e1a0 - Check whether Databases for etcd is accessible only through HTTPS
rule-458decc2-a081-4c49-8f31-eeaf4833d8c8 - Check whether Databases for etcd is accessible only by using private endpoints
rule-4d7e56d6-f657-418c-9e49-6d248b2cf5a6 - Check whether Databases for PostgreSQL is enabled with encryption
rule-041ff30b-7167-4411-985d-5ad32ab6f850 - Check whether Databases for PostgreSQL is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-872db4fc-2f7c-4ba0-ace7-dc468f6813c7 - Check whether Databases for PostgreSQL is accessible only through HTTPS
rule-094495cf-c092-4dcb-96b8-3654c4bcf787 - Check whether Databases for PostgreSQL is accessible only by using private endpoints
rule-beb7b289-706b-4dc0-b01d-b1d15d4331e3 - Check whether Databases for MongoDB network access is restricted to a specific IP range
rule-04d856f1-68ce-4cba-b800-ba49f3c4f1a1 - Check whether Databases for Redis network access is restricted to specific IP range
SC-7 (10) - Prevent Unauthorized Exfiltration 



 Control requirements 

SC-7 (10) - 0
: The organization prevents the unauthorized exfiltration of information across managed interfaces.





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Accessing the public internet](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-internet)
* [Connecting application provider to the management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management)
* [Connectivity to IBM Cloud services with private endpoints](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-ibm-services)
* [Consumer connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-workload)
* [Creating and connecting the management and workload VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-create-vpcs)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port
* Check whether Virtual Private Cloud (VPC) has no public gateways attached
* Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning
* Check whether account has at least one VPN or Direct Link configured
For information on the services that are sending events to Activity Tracker, see [IBM Cloud services that generate Activity Tracker events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-cloud_services).

Depending on your compliance and organizational requirements, you can choose IBM Cloud Activity Tracker Event Routing or an IBM Cloud Activity Tracker hosted event search offering.



* Application environments seeking to maintain Financial Services (FS) validation status on IBM Cloud should use IBM Cloud Activity Tracker Event Routing .
* Application environments seeking compliance with PCI, SOC2, Privacy Shield and HIPAA should use an IBM Cloud Activity Tracker hosted event search offering.



[![Getting started with Event Routing](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/getting_started_routing.svg)](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started)[![Getting started with hosted event and search offerings](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/getting_started_event.svg)](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started-search)





 Security 

Consider the following information about security when you work with the IBM Cloud Activity Tracker service:



* IBM services that generate IBM Cloud Activity Tracker events follow the IBM Cloud security policy. For more information, see [Trust the security and privacy of IBM Cloud](https://www.ibm.com/cloud/security).
* The IBM Cloud Activity Tracker service captures user-initiated actions that change the state of IBM Cloud services. The information does not provide direct access to databases or applications.
* Only authorized users can view and monitor IBM Cloud Activity Tracker event logs. Each user is identified by their unique ID in the IBM Cloud.
* [Pushing and pulling images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images_push)



* [Enforcing access to your account over a private network](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_account)



[Encrypting images for content confidentiality](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt)



* [Before you begin](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt_prereqs)
* [Create the public-private key pair](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt_create)
* [Encrypt the image](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt_image)
* [Pull and decrypt the image](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt_pull)
* [Storing keys](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt_keys)
* [Next steps](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt_next)



[Managing your data](https://cloud.ibm.com/docs/Registry?topic=Registry-delete-datadelete-data)



* [How your data is stored](https://cloud.ibm.com/docs/Registry?topic=Registry-delete-datadata-storage)
* [Next steps](https://cloud.ibm.com/docs/schematics?topic=schematics-delete-blueprintsdelete-nextsteps)







 Security and compliance 

[Security](https://cloud.ibm.com/docs/schematics?topic=schematics-securitysecurity)



* [Secure access control](https://cloud.ibm.com/docs/schematics?topic=schematics-securitysecure-access-control)



[Compliance](https://cloud.ibm.com/docs/schematics?topic=schematics-compliancecompliance)



* [General Data Protection Regulation (GDPR) readiness](https://cloud.ibm.com/docs/schematics?topic=schematics-compliancecompliance-gdpr)
* [Privacy shield](https://cloud.ibm.com/docs/schematics?topic=schematics-compliancecompliance-privacy)
* [International Organization for Standardization (ISO)](https://cloud.ibm.com/docs/schematics?topic=schematics-complianceinternational-organization-for-standardization-iso)
* [SOC 2 Type 2 Certification](https://cloud.ibm.com/docs/schematics?topic=schematics-compliancesoc-2-type-2-certification)



[Managing security and compliance with Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-manage-security-compliancemanage-security-compliance)



* [Monitoring security and compliance posture with Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-manage-security-compliancemonitor-schematics)



* [Available goals for IBM Cloud Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-manage-security-complianceschematics-available-goals)
<br>To learn how to export metadata, see [Export the configuration of resources in a logging instance](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-reuse_resource_definitionsexport_config_res). 







 Identity and access management 



Table 3. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 Manage permissions Provide the ability to restrict access to resouces. <br>IBM is responsible for the security and compliance of IBM Log Analysis. Restrict access to resources by using Cloud IAM access policies by defining IAM policies to control which users within your account have access to the logging data. <br>[Learn more about controlling access through IAM](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-work_iam) 
 . 







 Security and regulation compliance 



Table 4. Responsibilities for security and regulation compliance

 Task IBM Responsibilities Your Responsibilities 

 Encrypt data Operate the Cloud Service encrypting data in motion and at rest per compliance specifications. Ensure encryption of archived data by configuring a COS bucket that has full control over the data encryption keys that are used. [IBM Cloud® Object Storage provides several options to encrypt your data.](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-encryption) 
 Meet security and compliance objectives Maintain controls that are commensurate to various industry compliance standards such as SOC2, PCI, HIPAA and Privacy Shield. Set up and maintain security and regulation compliance for your apps and data.
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-6nist-supplemental-guidance)



[SI-7 - Software, Firmware, and Information Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-7si-7)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-7control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-7implementation-guidance)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-7scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-7nist-supplemental-guidance)



[SI-8 - Spam Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-8si-8)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-8control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-si-8additional-ibm-cloud-for-financial-services-specifications)
Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies CM-3(2)(0), CM-4(0), CM-5(0), CM-9(a), CM-9(d), SA-10(b), SA-10(e), SA-15(a), SA-3(a), SA-3(d), SA-8(0), SI-2(2)(0), SI-2(a), SI-2(b), SI-2(d), and SI-7(0) Rule was added 
 Check whether DevSecOps Toolchain source code contains no secrets CM-3(2)(0), CM-4(0), CM-4(1)(0), CM-7(1)(a), CM-9(d), RA-5(1)(0), RA-5(2)(0), RA-5(3)(0), RA-5(a), RA-5(b), RA-5(c), RA-5(d), SA-10(e), SA-15(a), SA-3(a), SA-3(d), SA-8(0), SI-2(2)(0), SI-2(a), SI-2(b), SI-2(c), and SI-2(d) Rule was added