vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[CP-10 (2) - Transaction Recovery](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10.2cp-10.2)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10.2control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10.2implementation-guidance)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10.2nist-supplemental-guidance)







 Identification and Authentication (IA) 

[IA-1 - Identification and Authentication Policy and Procedures](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-1ia-1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-1control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-1nist-supplemental-guidance)



[IA-2 - Identification and Authentication (organizational Users)](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2ia-2)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2control-requirements)
[standard method of PKCS #11 Cryptographic Token Interface](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959729) for error handling.





 Verifying that keys are protected by crypto units 

The PKCS #11 API works with generated key objects that can be stored, updated, and retrieved from a remote keystore on IBM Cloud. As an added level of protection, the key objects that are stored in IBM Cloud can also be checked to ensure that no tampering occurs.

Every symmetric key that is generated, derived, or unwrapped contains a digital fingerprint that is stored in a key attribute called CKA_CHECK_VALUE. This attribute is a 3-byte checksum for the key object itself.

After you generate, derive, or unwrap a key object, it is suggested that you store the initial checksum value (contents of the CKA_CHECK_VALUE attribute) along with any unique identifiers of the key object separately. The separately stored checksums can then be used to verify whether keys are tampered with or not.

To verify a key, perform an electronic codebook (ECB) encryption operation of a single block of null (0x00) bytes by using the key to be verified. If the first 3 bytes of the resulting cipher is identical to the value of the CKA_CHECK_VALUE key attribute that is stored locally for the same key, it indicates that the key object is not tampered with. The CKA_CHECK_VALUE key attribute cannot be used to obtain any part of the key value.

An example of how to retrieve checksum values for AES, DES2, and DES3 keys along with the verification of the key checksums can be found [here](https://github.com/IBM-Cloud/hpcs-pkcs11/blob/master/samples/pkcs11-checksum.c).





 PKCS 11 function list 

The PKCS #11 standard defines an API called Cryptoki. The following table lists the PKCS #11 Cryptoki API functions and descriptions.
* [Reference architectures](https://cloud.ibm.com/docs/framework-financial-servicesframework-reference-architectures) designed to facilitate compliance with the control requirements. In addition, resources are provided to [deploy infrastructure as code](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-deploy-infrastructure-as-code) in order to automate deployment and configuration of the reference architectures.
* Tools and IBM services, such as [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance), to enable parties to efficiently and effectively monitor compliance, remediate issues, and generate evidence of compliance.
* Ongoing governance of the framework documentation that considers new and changing regulations, as well as bank and public cloud requirements.





 Control requirements 

The technology-agnostic control requirements defined in the framework were built by the industry for the industry. The framework contains 565 control requirements that span 7 focus areas and 21 control families. The control requirements were initially based on [NIST 800-53 Rev 4](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search!/800-53?version=4.0) and have been enhanced based on feedback from leading industry partners.

See [IBM Cloud Framework for Financial Services - Control Requirements](https://cloud.ibm.com/docs/framework-financial-services-controls) for a complete description of all control requirements. Or, if you prefer, there is a [downloadable spreadsheet](https://cloud.ibm.com/media/docs/downloads/framework-financial-services/IBM_Cloud_Framework_for_Financial_Services_-_Control_Requirements_v1.1.0.xlsx) available as well.





 Framework guidance and reference architectures 



 Interpreting the framework guidance 

We refer to the entity that uses (consumes) an application as the consumer and the entity that develops or deploys (provides) an application as the application provider.
[Handling and securing secrets](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secretsshared-secrets)



* [Related controls in IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secretsrelated-controls)
* [Next steps](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secretsnext-steps)



[Consumer accounts for application provider workloads](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumershared-account-consumer)



* [App ID integrations with IBM Cloud services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumerapp-id-integrations)
* [Related controls in IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumerrelated-controls)
* [Next steps](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumernext-steps)



[Tagging IBM Cloud resources and managing access with tags](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resourcesshared-tagging-resources)



* [Example tagging scheme](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resourcesshared-tagging-resources-example-scheme)
* [Related controls in IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resourcesshared-tagging-resources-related-controls)
Resource ibm_resource The resource being measured by the service - typically an indentifying name or GUID 
 Resource Type ibm_resource_type The type of the resource being measured by the service 
 Resource group ibm_resource_group_name The resource group where the service instance was created 
 Scope ibm_scope The scope is the account, organization, or space GUID associated with this metric 
 Service name ibm_service_name Name of the service generating this metric 







 Additional attributes 

The following attributes are available for segmenting one or more attributes as described in the reference above. See the individual metrics for segmentation options.



Table 14: Additional attributes

 Attribute Attribute Name Attribute Description 

 Catalog in the Presto Server ibm_catalog Catalog in the Presto Server 
 Catalog name ibm_catalog_name Catalog name 
 Resource role ibm_resource_role Role in the resource group 
 Role associated with Catalog ibm_catalog_role Role associated with Catalog 
 Schema in the Presto Server ibm_schema Schema in the Presto Server 
 Service instance ibm_service_instance The service instance segment identifies the instance that the metric is associated with
Limitations and workarounds for Business Partner users 

Review the following considerations and limitations that Business Partner users can experience.



 High availability in stretched locations 

For Business Partner users, VMware Shared virtual data centers support highly availability for in-cloud replication from one virtual data center to another. However, ordering a Zerto Cloud Connector (ZCC) to replicate on-premises virtual machines (VMs) to IBM Cloud does not support high availability.





 Resetting passwords 

Business Partner users cannot use one virtual data center to reset the VMware Cloud Director account password for the entire data center region.

For Business Partner users, all virtual data centers in the same data center number group have the same password. Groups with the same data center number can reset the VMware Cloud Director account password from any virtual data center in the number group.

For example, PAR04- windows and PAR04- linux are in a group with the same data center number. When you reset the VMware Cloud Director password in either, the password is reset for any virtual data center in PAR04. The password is not reset for the PAR05 or PAR06 data center number groups.





 Modifying roles used for IAM integration 

Business Partner users cannot modify a role in VMware Cloud Director used for the IAM integration.

When the VMware Cloud Director version is updated, the new version can introduce new dependencies between rights. If the affected right is used by one of the roles created in VMware Cloud Director for the integration with IAM, you cannot modify that role in VMware Cloud Director.

An error similar to the following displays. Required implied right <right name 1> has not been selected for selected right <right name 2>

This occurs because the roles were created before the update of VMware Cloud Director and the roles do not have the latest information about their rights. Complete one of the following options to resolve this limitation.



* Reset the OpenID Connect configuration.
* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-7.1control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-7.1nist-supplemental-guidance)



[CM-8 - Information System Component Inventory](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8cm-8)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8nist-supplemental-guidance)



[CM-8 (1) - Updates During Installations / Removals](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8.1cm-8.1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8.1control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-8.1scc-fs-cloud-profile)
* [Consenter set](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-consenter)
* [Console](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-console)
* [Consortium](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-consortium)
* [CouchDB](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-couchdb)
* [Current state](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-current-state)
* [Dynamic membership](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-dynamic-memership)
* [Endorsement](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-endorsement)
* [Endorsement policy](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-endorsement-policy)
* [Genesis block](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-genesis-block)
* [Gossip](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-gossip)
* [HSM](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-hsm)
* [Hyperledger Fabric](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-hyperledger-fabric)
[Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_CopyObject Yes Creates a copy of an object. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_DestroyObject Yes Destroys an object. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_GetObjectSize Yes Obtains the size of an object in bytes. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_GetAttributeValue Yes Obtains an attribute value of an object. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_SetAttributeValue Yes Modifies an attribute value of an object. Only Boolean attributes can be modified. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_FindObjectsInit Yes Initializes an object search operation.
[Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_SetAttributeValue Yes Modifies an attribute value of an object. Only Boolean attributes can be modified. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_FindObjectsInit Yes Initializes an object search operation. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_FindObjects Yes Continues an object search operation. 
 [Object management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) C_FindObjectsFinal Yes Finishes an object search operation. 
 [Encryption](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959744) C_EncryptInit Yes Initializes an encryption operation. 
 [Encryption](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959744) C_Encrypt Yes Encrypts single-part data.
To work around this issue, replace line 37 podname="gateway" with podname="wd-discovery-gateway" in scripts/manage_custom_crawler.sh, and then rerun the deploy command.
* When you create a custom enrichment in the tooling, you must choose a field the enrichment should be applied to and click Apply. If no field is selected, then the Apply and reprocess button will be disabled for enrichments changes until the new enrichment has a field.
* If you apply the [Contracts](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-contracts-schema) enrichment or the [Understanding tables](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-understanding_tables) enrichment to a collection, you might receive the following error message when that collection is ingesting documents: The number of nested documents has exceeded the allowed limit of [X]. Contact the [IBM Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) to adjust the limit.
* When text is enriched with a custom dictionary, the output of entities.type should be the full facet path for the Dictionary enrichment. However, in this release, the full facet path will not be displayed. To work around this, reprocess the collection. For example, if the facet path is sample1.sample2, it will look like this before reprocessing:

{
"result" : {
"enriched_text" : [ !!!! !!! ! ! !
{
"entities" :
{
"text" : "capital",
"type" : "sample2",
...
"model_name" : "Dictionary:.sample1.sample2"}
...

And this after:

{
"result" : {
"enriched_text" :
{
"entities" :
{
"text" : "capital",
"type" : "sample1.sample2",
...
"ibp": []
},
"csr": {
"cn": "ca",
"keyrequest": {
"algo": "ecdsa",
"size": 256
},
"names": [
{
"C": "US",
"ST": "North Carolina",
"L": null,
"O": "Hyperledger",
"OU": "Fabric"
}
],
"hosts": [
"<<<MYHOST>>>",
"localhost"
],
"ca": {
"expiry": "131400h",
"pathlength": "<<<PATHLENGTH>>>"
}
},
"idemix": {
"rhpoolsize": 1000,
"nonceexpiration": "15s",
"noncesweepinterval": "15m"
},
"bccsp": {
"default": "SW",
"sw": {
"hash": "SHA2",
"security": 256,
"filekeystore": null
}
},
"intermediate": {
"parentserver": {
"url": null,
"caname": null
},
"enrollment": {
"hosts": null,
"profile": null,
"label": null
},
"tls": {
"certfiles": null,
"client": {
"certfile": null,
"keyfile": null
}
}
},
"cfg": {
"identities": {
"passwordattempts": 10,
"allowremove": true
}
},
"metrics": {
[IBM Cloud® App ID](https://cloud.ibm.com/docs/appid?topic=appid-getting-started) appid [Location-based events](https://cloud.ibm.com/docs/appid?topic=appid-at-events) 
 [IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) hs-crypto [Location-based events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events) 
 [IBM Cloud® Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started) secrets-manager [Location-based events](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-at-events) 







 Storage services 

The following table lists storage services that send auditing events:



Table 11. List of storage events

 Service CRN service name Events 

 [IBM Cloud® Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) cloud-object-storage [Global and location-based events ]](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at-events) 
 [Mass Data Migration](https://cloud.ibm.com/docs/mass-data-migration?topic=mass-data-migration-getting-started-tutorial) mass-data-migration [Events](https://cloud.ibm.com/docs/mass-data-migration?topic=mass-data-migration-at-events) 



[] IBM Cloud Object Storage (COS) generates global, and location-based events.



* By default, bucket management events such as the creation of a bucket are collected automatically.
* Collection of data events in your account is optional. You must configure each bucket to enable data events by selecting the option Track data events.
[AC-11 - Session Lock](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11ac-11)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11implementation-guidance)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11nist-supplemental-guidance)



[AC-11 (1) - Pattern-hiding Displays](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11.1ac-11.1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11.1control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11.1scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-11.1nist-supplemental-guidance)
: The name of the storage class.

ibm.io/parallel-count
: The maximum number of parallel requests that can be sent to the IBM Cloud Object Storage service instance for a single read or write operation. Storage classes with perf in their name are set up with a maximum of 20 parallel requests. Storage classes without perf are set up with two parallel requests by default.

ibm.io/s3fs-fuse-retry-count
: The maximum number of retries for a read or write operation before the operation is considered unsuccessful. All storage classes are set up with a maximum of five retries.

ibm.io/stat-cache-size
: The maximum number of records that are kept in the IBM Cloud Object Storage metadata cache. Every record can take up to 0.5 kilobytes. All storage classes set the maximum number of records to 100000 by default.

ibm.io/tls-cipher-suite
: The TLS cipher suite that must be used when a connection to IBM Cloud Object Storage is established via the HTTPS endpoint. The value for the cipher suite must follow the [OpenSSL format](https://www.openssl.org/docs/man1.1.1/man1/ciphers.html). If your worker nodes run an Ubuntu operating system, your storage classes are set up to use the AESGCMcipher suite by default. For worker nodes that run a Red Hat operating system, the ecdhe_rsa_aes_128_gcm_sha_256 cipher suite is used by default.

For more information about each storage class, see the [storage class reference](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_reference). If you want to change any of the pre-set values, create your own customized storage class.
5. Decide on a name for your bucket. The name of a bucket must be unique in IBM Cloud Object Storage. You can also choose to automatically create a name for your bucket by the IBM Cloud Object Storage plug-in. To organize data in a bucket, you can create subdirectories.
Filter String Prefix Rule Must contain a Prefix element 
 Prefix String None Filter Must be set to <Prefix/>. 
 Transition Container Days, StorageClass Rule Limit 1 transition rule, and a maximum of 1000 total rules. 
 Days Non-negative integer None Transition Must be a value equal to or greater than 0. 
 Date Date None Transistion Must be in ISO 8601 Format and the date must be in the future. 
 StorageClass String None Transition GLACIER or ACCELERATED 



Syntax

PUT https://{endpoint}/{bucket}?lifecycle path style
PUT https://{bucket}.{endpoint}?lifecycle virtual host style

<LifecycleConfiguration>
<Rule>
<ID>{string}</ID>
<Status>Enabled</Status>
<Filter>
<Prefix/>
</Filter>
<Transition>
<Days>{integer}</Days>
<StorageClass>{StorageClass}</StorageClass>
</Transition>
</Rule>
</LifecycleConfiguration>

Examples

Sample Request

PUT /images?lifecycle HTTP/1.1
Host: s3.us.cloud-object-storage.appdomain.cloud
Date: Wed, 7 Feb 2018 17:50:00 GMT
Authorization: authorization string
Content-Type: text/plain
Content-MD5: 1B2M2Y8AsgTpgAmY7PhCfg==
Content-Length: 305

<LifecycleConfiguration>
<Rule>
<ID>my-archive-policy</ID>
<Filter>
<Prefix/>
</Filter>
<Status>Enabled</Status>
<Transition>
<Days>20</Days>
<StorageClass>ACCELERATED</StorageClass>
</Transition>
</Rule>
</LifecycleConfiguration>

Sample Response

HTTP/1.1 200 OK
Date: Wed, 7 Feb 2018 17:51:00 GMT
Connection: close



* Java
* Python
* Node