NIST updates

Author: katarzyna-koltun-mx

content/en/docs/private-platform/nist-controls/ca/_index.md

@@ -0,0 +1,15 @@
+---
+title: "NIST 800-53 Security Assessment and Authorization for Private Mendix Platform"
+linktitle: "Security Assessment and Authorization"
+url: /private-mendix-platform/nist-controls-ca/
+description: "Documents the Private Mendix Platform's compliance with the Security Assessment and Authorization (CA) category of the NIST 800-53 security framework."
+weight: 10
+no_list: false 
+simple_list: true
+---
+
+## Introduction
+
+Documents in this section provide more information about Private Mendix Platform's compliance with the Security Assessment and Authorization (CA) category of the [NIST 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) security framework. For each applicable control, we have listed which party (Mendix or the customer) is responsible for which component or aspect.
+
+In general, Mendix is responsible for the Private Mendix Platform, Mendix Operator, Mendix Studio Pro, Mendix Runtime, and so on. Customer responsibilities are related to infra and organization processes. For more information, refer to detailed documentation below.

content/en/docs/private-platform/nist-controls/ca/pmp-nist-ca07.md

@@ -0,0 +1,87 @@
+---
+title: "CA-07 Continuous Monitoring"
+linktitle: "CA-07"
+url: /private-mendix-platform/nist-controls/ca-07/
+description: "Documents the Private Mendix Platform's compliance with the CA-07 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CA-07 control.
+
+| Control ID | CA-07 |
+| --- | --- |
+| Control category | CA - Security Assessment and Authorization |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Infra, Customer - Org |
+
+## Control
+
+The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:
+
+* Establishment of organization-defined metrics to be monitored
+* Establishment of organization-defined frequencies for monitoring and organization-defined frequencies for assessments supporting such monitoring
+* Ongoing security control assessments in accordance with the organizational continuous monitoring strategy
+* Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy
+* Correlation and analysis of security-related information generated by assessments and monitoring
+* Response actions to address results of the analysis of security-related information
+* Reporting the security status of organization and the information system to organization-defined personnel or roles at an organization-defined frequency. 
+
+### Supplemental Guidance
+
+Continuous monitoring programs facilitate ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess and analyze security controls and information security-related risks at a frequency sufficient to support organizational risk-based decisions. The results of continuous monitoring programs generate appropriate risk response actions by organizations. 
+
+Continuous monitoring programs also allow organizations to maintain the security authorizations of information systems and common controls over time in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security-related information on a continuing basis through reports or dashboards gives organizational officials the capability to make more effective and timely risk management decisions, including ongoing security authorization decisions. 
+
+Automation supports more frequent updates to security authorization packages, hardware, software, or firmware inventories, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of information systems.
+
+The following controls are related to this control:
+
+* CA-02
+* CA-05
+* CA-06
+* CM-03
+* CM-04
+* PM-06
+* PM-09
+* RA-05
+* SA-11
+* SA-12
+* SI-02
+* SI-04
+
+For more information, refer to the following:
+
+* OMB Memorandum 11-33
+* NIST Special Publications 800-37, 800-39, 800-53A, 800-115, and 800-137
+* US-CERT Technical Cyber Security Alerts
+* DoD Information Assurance Vulnerability Alerts
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control in an appropriate manner in their organization. This includes developing and maintaining a comprehensive continuous monitoring strategy that defines metrics, monitoring frequencies, and assessment procedures to ensure compliance with federal requirements. The customer must ensure that all continuous monitoring activities, including security control assessments, status reporting, and risk response actions, are documented, reviewed, and enforced within their environment.
+
+## Guidance
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-137, which provides guidelines for Information Security Continuous Monitoring (ISCM) for federal information systems, and NIST SP 800-53 Rev 4, which establishes the foundational continuous monitoring requirements. Customers operating within a FedRAMP or DoD SRG environment must ensure their continuous monitoring program is comprehensive, automated where possible, and aligned with organizational risk management strategies.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Develop and implement a continuous monitoring program.
+
+    The customer must develop a continuous monitoring strategy that defines the metrics to be monitored, monitoring frequencies, and assessment schedules.
+    
+    The Infra Implementer must implement the infrastructure in a way that complies with the continuous monitoring program, including deploying monitoring tools, configuring alerting thresholds, and enabling security event collection in accordance with NIST SP 800-137.
+
+2. Ensure application-level monitoring compliance.
+
+    The App Implementer must implement the Mendix app in a way that complies with the continuous monitoring program as dictated by the customer. This includes integrating application-level logging, health checks, and security metrics into the organization's centralized monitoring framework as required by NIST SP 800-53A assessment procedures.
+
+3. Maintain ongoing monitoring and reporting.
+
+    The Infra Operator and App Operator must ensure that the infrastructure and Mendix App remain in compliance with the customer's continuous monitoring program as it evolves. This includes performing regular security control assessments, correlating and analyzing security-related information, generating compliance reports, and executing response actions to address identified risks per OMB Memorandum 11-33.

content/en/docs/private-platform/nist-controls/ca/pmp-nist-ca09.md

@@ -0,0 +1,70 @@
+---
+title: "CA-09 Internal System Connections"
+linktitle: "CA-09"
+url: /private-mendix-platform/nist-controls/ca-09/
+description: "Documents the Private Mendix Platform's compliance with the CA-09 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CA-09 control.
+
+| Control ID | CA-09 |
+| --- | --- |
+| Control category | CA - Security Assessment and Authorization |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Infra, Customer - Org |
+
+## Control
+
+The organization:
+
+* Authorizes internal connections of organization-defined information system components or classes of components to the information system.
+* Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated. 
+
+### Supplemental Guidance
+
+This control applies to connections between organizational information systems and (separate) constituent system components (that is, intra-system connections) including, for example, system connections with mobile devices, notebook or desktop computers, printers, copiers, facsimile machines, scanners, sensors, and servers. 
+
+Instead of authorizing each individual internal connection, organizations can authorize internal connections for a class of components with common characteristics and/or configurations, for example, all digital printers, scanners, and copiers with a specified processing, storage, and transmission capability or all smart phones with a specific baseline configuration.
+
+The following controls are related to this control:
+
+* AC-03
+* AC-04
+* AC-18
+* AC-19
+* AU-02
+* AU-12
+* CA-07
+* CM-02
+* IA-03
+* SC-07
+* SI-04
+
+## Responsibility
+
+### Customer Responsibility
+
+Customer is responsible for implementing this control in an appropriate manner in their organization. This includes establishing policies and procedures for authorizing and documenting all internal connections between information system components to ensure compliance with federal requirements. The customer must ensure that interface characteristics, security requirements, and the nature of information communicated for each internal connection are documented, reviewed, and enforced within their environment.
+
+## Guidance
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-53 Rev 4 and FIPS 200, which establish requirements for authorizing and documenting internal system connections within federal information systems. Customers operating within a FedRAMP or DoD SRG environment must ensure all internal connections are formally authorized, documented with interface characteristics and security requirements, and monitored throughout their lifecycle.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Authorize and socument internal connections.
+
+    The customer must authorize and document all internal connections made by the Mendix app and associated infrastructure. For each connection, the documentation must include interface characteristics, security requirements, and the nature of the information communicated, in accordance with NIST SP 800-53 Rev 4 CA-09 requirements.
+
+2. Ensure authorized connections only.
+
+    The Infra Implementer and App Implementer must ensure the infrastructure and Mendix app only make authorized connections as documented by the customer. This includes implementing network segmentation, access control lists, and connection validation mechanisms to prevent unauthorized internal connections per NIST SP 800-53 AC-3 and SC-7.
+
+3. Maintain connection documentation over lifecycle.
+
+    The Infra Operator and App Operator must ensure that these internal connections and the associated documentation stay current over the lifecycle of the solution. This includes performing periodic reviews of authorized connections, updating documentation when connections change, and removing or re-authorizing connections as the system evolves.

content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm04.md

@@ -0,0 +1,122 @@
+---
+title: "CM-04 Security Impact Analysis"
+linktitle: "CM-04"
+url: /private-mendix-platform/nist-controls/cm-04/
+description: "Documents the Private Mendix Platform's compliance with the CM-04 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CM-04 control.
+
+| Control ID | CM-04 |
+| --- | --- |
+| Control category | CM - Configuration Management |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Infra, Customer - Org |
+
+## Control
+
+The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
+
+### Supplemental Guidance
+
+Organizational personnel with information security responsibilities (for example, Information System Administrators, Information System Security Officers, Information System Security Managers, and Information System Security Engineers) conduct security impact analyses. Individuals conducting security impact analyses possess the necessary skills and technical expertise to analyze the changes to information systems and the associated security ramifications.
+
+Security impact analysis may include, for example, reviewing security plans to understand security control requirements and reviewing system design documentation to understand control implementation and how specific changes might affect the controls. Security impact analyses may also include assessments of risk to better understand the impact of the changes and to determine if additional security controls are required. Security impact analyses are scaled in accordance with the security categories of the information systems.
+
+The following controls are related to this control:
+
+* CA-02
+* CA-07
+* CM-03
+* CM-09
+* SA-04
+* SA-05
+* SA-10
+* SI-02
+
+For more information, refer to NIST Special Publication 800-128.
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control in an appropriate manner in their organization. This includes assessing the overall security impacts of changes to the information system prior to implementation to ensure compliance with federal requirements. The customer must ensure that security impact analysis processes, roles, and documentation requirements are documented, reviewed, and enforced within their environment.
+
+#### Infra Implementer
+
+The Infra Implementer is responsible for detailing the infrastructure architecture and security structure to support security impact analysis.
+
+#### App Implementer
+
+The App Implementer is responsible for detailing the Mendix App architecture and security structure to support security impact analysis.
+
+#### Infra Operator
+
+The Infra Operator is responsible for assessing and reporting on the security impacts of potential infrastructure updates.
+
+#### App Operator
+
+The App Operator is responsible for assessing and reporting on the security impacts of potential Mendix app updates.
+
+## Guidance
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-53 Rev 4 and NIST SP 800-128, which establish requirements for analyzing the security impacts of changes to information systems prior to implementation. Customers operating within a FedRAMP or DoD SRG environment must ensure that all changes to the information system undergo security impact analysis by qualified personnel before they are applied to production environments.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Establish security impact analysis processes.
+
+    The customer must establish formal security impact analysis processes that require all changes to the information system to be evaluated for security implications prior to implementation. This includes defining roles and responsibilities for conducting analyses, approval workflows, and documentation requirements in accordance with NIST SP 800-128.
+
+2. Ensure architecture and security documentation
+
+    The Infra Implementer must detail the infrastructure architecture and security structure, and the App Implementer must detail the Mendix app architecture and security structure. This documentation must be maintained current to support effective security impact analysis of proposed changes per NIST SP 800-53 SA-5 requirements.
+
+3. Require security impact reporting for updates.
+
+    The Infra Operator must assess and report on the security impacts of potential infrastructure updates, and the App Operator must assess and report on the security impacts of potential Mendix App updates. All security impact assessments must be reviewed and approved by the Customer before changes are implemented.
+
+#### Infra Implementer
+
+The Infra Implementer is responsible for maintaining detailed documentation of the infrastructure architecture and security structure. This documentation serves as the baseline for security impact analysis when changes are proposed to the infrastructure.
+
+The Infra Implementer must perform the following tasks:
+
+* Create and maintain comprehensive documentation of the infrastructure architecture, including network diagrams, security boundaries, data flows, and security control implementations.
+* Maintain security configuration baselines for all infrastructure components, enabling comparison and impact assessment when changes are proposed.
+* Provide technical expertise and infrastructure documentation to support the customer's security impact analysis process when infrastructure changes are proposed.
+
+#### App Implementer
+
+The App Implementer is responsible for maintaining detailed documentation of the Mendix application architecture and security structure. This documentation supports security impact analysis when application changes are proposed.
+
+The App Implementer must perform the following tasks:
+
+* Create and maintain comprehensive documentation of the Mendix application architecture, including data models, security roles, access controls, and integration points.
+* Maintain documentation of all application-level security controls, including authentication mechanisms, authorization rules, input validation, and encryption configurations.
+* Provide technical expertise and application documentation to support the customer's security impact analysis process when application changes are proposed.
+
+#### Infra Operator
+
+The Infra Operator is responsible for assessing and reporting on the security impacts of potential infrastructure updates, including patches, configuration changes, and platform upgrades, before they are implemented.
+
+The Infra Operator must perform the following tasks:
+
+* Before applying infrastructure updates, analyze the potential security impacts by reviewing release notes, security advisories, and change documentation against the current infrastructure security configuration.
+* Document the results of security impact assessments and report findings to the customer for review and approval before implementing infrastructure changes.
+* Where possible, test infrastructure changes in non-production environments to validate that security controls remain effective after the change is applied.
+
+#### App Operator
+
+The App Operator is responsible for assessing and reporting on the security impacts of potential Mendix app updates, including application changes, dependency updates, and configuration modifications, before they are implemented.
+
+The App Operator must perform the following tasks:
+
+* Before applying Mendix application updates, analyze the potential security impacts by reviewing change documentation, dependency updates, and Mendix release notes against the current application security configuration.
+* Document the results of security impact assessments and report findings to the customer for review and approval before implementing application changes.
+* Test application changes in separate environments to validate that security controls remain effective and that no new vulnerabilities are introduced before promoting to production.