vania-janet/multiturn-rag-retrieval-data huggingface dataset:
5.2.8 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.9 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies). 
 5.4.2 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 5.5.1 IBM Cloud Kubernetes Service can optionally [enable image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a [pod or container securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.
5.2.8 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.9 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies). 
 5.4.2 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 5.5.1 IBM Cloud Kubernetes Service can optionally [enable enforcing image security](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portieris). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a pod or container securityContext. 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.
System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps 



* [Working with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-containers-openshift)
5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies). 
 5.4.2 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 5.5.1 IBM Cloud Kubernetes Service can optionally [enable image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/seccomp). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a [pod or container securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.
* [IBM Cloud platform roles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamplatform)
* [IBM Cloud service roles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamservice)
* [Code Engine CLI access requirements](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamcli-access-req)
* [Code Engine container registry requirements](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamcontainer-registry-access-req)
* [Code Engine service binding access requirements](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamservice-binding-access-req)
* [Code Engine access requirements for your toolchain](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamtoolchain-access-req)



[Securing your data in Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-mng-datamng-data)



* [How your data is stored and encrypted in Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-mng-datadata-storage)
* [Deleting your data in Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-mng-datadata-delete)



[Code Engine and security](https://cloud.ibm.com/docs/codeengine?topic=codeengine-securesecure)



* [Supported TLS versions and cipher suites](https://cloud.ibm.com/docs/codeengine?topic=codeengine-securesecure-tls)
* [Scenario comparisons](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-detailed-pricingibp-pricing-details-tabs)







 Security 

[Security](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security)



* [Security on the IBM Blockchain Platform console](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp)



* [IAM (Identity and Access Management)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-iam)
* [Ports](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-ports)
* [Key management](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-keys)
* [Membership Service Providers (MSPs)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-msp)
* [Access control lists (ACLs)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-acls)
* [API authentication](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-apis)



* [Best practices for security on the customer Kubernetes cluster](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes)
Satellite Location <br><br> * Maintain security and regulation compliance for the IBM Cloud-managed location control plane.<br> * Update the managed master components.<br> * Provide patch updates for the control plane components that run in the location worker nodes.<br> * Provide the ability to control access to locations through IBM Cloud IAM.<br><br><br> <br><br> * You are responsible for keeping your host infrastructure secure and compliant, including applying worker node patch updates to the hosts that run the location control plane.<br><br><br> 
 Satellite Host <br><br> * Provide patch updates for the hosts that run as worker nodes in Satellite clusters.<br> * Disable the ability to SSH into hosts after you assign the hosts to a location control plane or clusters, to enhance security.<br><br><br> <br><br> * You are responsible for keeping your host infrastructure secure and compliant, including applying worker node patch updates.<br> * You are responsible to encrypt the boot disk and any additional disks that you add to your hosts to keep data secure and meet regulatory requirements.<br><br><br> 
 Satellite Config <br><br> * Deploy apps consistently across clusters and locations.<br> * Provide the ability to control access to configurations through IBM Cloud IAM.<br><br><br> <br><br> * Create your Kubernetes configuration files by following the security standards that you want to comply to, such as by using security context constraints. You are responsible for the security and compliance of your apps.<br><br><br> 
 Satellite Link <br><br> * Establish a secure connection between IBM Cloud and Satellite locations by using the Satellite link connector.<br> * Provide the ability to control access to endpoints through IBM Cloud IAM.<br> * Provide the ability to monitor network traffic between your location and endpoints outside of your location.<br><br><br> <br><br> * Set up and audit [link endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) across locations.<br><br><br>
* [Security on Cloud Pak for Data](https://www.ibm.com/docs/SSQNUZ_4.6.x/cpd/plan/security.html)



Trademarks are listed in the [Trademarks](https://cloud.ibm.com/docs/overview?topic=overview-noticestrademarks) page for all IBM Cloud services.

Zoom

![Java integrated logo.](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/discovery-data/images/Java_Compatible.png)

Figure 2. Java logo
Databases <br><br> * [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-iam)<br> * [Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-iam)<br><br><br> 







 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 2. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Access Control (AC) [AC-3 Access Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3) <br>[AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5) <br>[AC-6 Least Privilege](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6) 







 Next steps 



* [Handling and securing secrets](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-4.1additional-ibm-cloud-for-financial-services-specifications)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-4.1nist-supplemental-guidance)



[PL-8 - Information Security Architecture](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-8pl-8)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-8control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-8nist-supplemental-guidance)







 Personnel Security (PS) 

[PS-1 - Personnel Security Policy and Procedures](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-1ps-1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-1control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-1nist-supplemental-guidance)



[PS-2 - Position Risk Designation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-2ps-2)
Implementation guidance: As a software provider, you must provide facilities to accomplish these goals as appropriate. As a simple example, if your software provides a database, you should provide the ability to create database users with different roles (e.g., viewer, editor, administrator).

Ideally, you should support integration with an external (to the application) identity and access management provider for validating users and their associated access group membership.

Most Relevant Control Groups or Controls:



Table 1. Related controls for zero trust

 Family Control 

 Access Control (AC) [AC-2 Account Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2) <br>[AC-3 Access Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3) <br>[AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5) <br>[AC-6 Least Privilege](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6) <br>[AC-14 Permitted Actions without Identification or Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-14) 







 3. Enable ability to capture audit events 

Requirement: Provide technical capability within the application to capture audit events.

Purpose & value: It is important that the operator has access to audit logs to be able to investigate abnormal activity as well to comply with regulatory audit requirements. With a proper audit logging system, an operator can be automatically alerted to potential problems. This allows the operator to be proactive and check into potential security issues shortly after they've occurred.

Implementation guidance: You must log critical events related to administering your software that can be accessed by the operator. Many examples of auditable events are listed in the AU-2 control from the IBM Cloud Framework for Financial Services, including:
Ensure all operator actions are executed through a bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-bastion-host)
* [8. Capture audit events and forward to a SIEM](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-audit-logs)
* [9. Ensure operational logging and monitoring is implemented](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-operational-logging-and-monitoring)
* [10. Follow secure development processes and ensure software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-development-processes)
* [11. Encrypt consumer data at rest and in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-encryption)
* [12. Implement business continuity and disaster recovery](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-bcdr)
* [13. Design your application for high availability (recommended)](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-high-availability)
* [14. Use endpoint detection and remediation (EDR) tooling to detect malicious code](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-endpoint-detection-remediation)
* [15.
Securing your environment with VPN server 

A client-to-site VPN server can help you secure your environment and meet compliance requirements.



 Using security groups and ACLs for boundary protection 

VPN servers support integration with VPC security groups and Access Control Lists (ACLs). For more information, see [About security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups) and [Setting up network ACLs](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls).

To protect your environment against unexpected or unauthorized communication, configure your ACL and security group rules to deny all traffic by default and allow only expected protocols, CIDRs, or ports. [Configuring security groups and ACLs for use with VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-security-groups) provides examples of rules that are needed for the VPN server to function properly. You can use additional rules to restrict access with a VPN server port to specific networks instead of Any or 0.0.0.0/0.





 Access control with VPN client authentication 

Client-to-site VPN servers support certificate authentication and user/passcode authentication. See [Setting up client-to-site authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-authentication) and [VPN client authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-vpn-planningclient-authentication) for more information on the configuration required with each method.

You can use both authentication methods together to authenticate client access. Use the following guidelines for best results.



 Authenticating with a username/passcode 

To authenticate with a username or passcode, be aware of the following:



* This option requires VPN client users to authenticate with your wanted MFA method before a valid passcode can be acquired and used for a VPN connection.
As projects deploy only approved architectures from the catalog, this ensures changes to workload accounts are subject to the governance provided by catalog onboarding and project configuration management.

This authorization model helps implement the zero trust security best practices that are required by many compliance programs, including [Financial Services Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-zero-trust).

Users should not be granted privileges to modify resources in the workload accounts.

As is [best practice](https://cloud.ibm.com/docs/account?topic=account-account_setuphow_access), users should be granted access to projects, catalogs, and observability tools within the account through access groups, trusted profiles, or both. An additional level of security can be obtained by ensuring that users normally do not have access to deploy changes to production. Users needing production deployment privileges must switch to a production trusted profile (which has privileges to deploy to production through projects), greatly reducing opportunity for mistakes that can affect production. Production trusted profiles should be configured with a short session duration and with privileges only for production deployments, eliminating the possibility that users will simply use this profile all the time.



 Additional Considerations 

Given that projects within the BU admin account will have access to both development and production artifacts, a concern is that experimental changes or development artifacts might inadvertently be deployed to production.

This concern can be mitigated by using a naming convention where accounts, trusted profiles, configurations, and key resources are named with an environment prefix or suffix. The naming convention makes it possible to see at a glance what resources are being proposed to deploy where during configuration and during the project approval flow.

In addition, fine grained access control to configurations within a project can be used to restrict the set of users are allowed to approve and deploy changes to production infrastructure.







 Rationale for centralized infrastructure as code management 

Centralizing management of deployable architectures and their configuration into a production administration account for each BU provides the following benefits:



* BU operators can manage their own workloads within the constraints that are imposed by the centralized organization

The application and infrastructure catalogs ensure that only approved, tested, and compliant deployable architectures are available.
* [Next steps](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-next-steps)



[Best practices and requirements for software](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-software)



* [1. Enable operators to properly configure your application to meet the controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-reference-architecture)
* [2. Provide account and access management to enable a zero-trust environment](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-zero-trust)
* [3. Enable ability to capture audit events](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-audit-logs)
* [4. Follow secure development processes and ensure software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-development-processes)
* [5. Ensure consumer data can be encrypted at rest and in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-encryption)
* [6. Enable software to be run in a highly available manner](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices-softwarebest-practices-high-availability)