Merge pull request #11524 from mendix/kk-pmp-nist-updates-linking

Final NIST cleanups and fixes

Author: katarzyna-koltun-mx

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac01.md

@@ -38,7 +38,7 @@ The organizational risk management strategy is a key factor in establishing poli
 
 The following controls are related to this control:
 
-* PM-9.
+* PM-09
 
 For more information, refer to the NIST Special Publications 800-12 and 800-100.
 

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac02.md

@@ -44,7 +44,7 @@ The organization:
 
 ### Supplemental Guidance
 
- Information system account types include the following:
+Information system account types include the following:
 
 * Individual
 * Shared
@@ -73,27 +73,27 @@ The organization:
 
  The following controls are related to this control:
 
-* AC-3
-* AC-4
-* AC-5
-* AC-6
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
+* AC-04
+* AC-05
+* AC-06
 * AC-10
 * AC-17
 * AC-19
 * AC-20
-* AU-9
-* IA-2
-* IA-4
-* IA-5
-* IA-8
-* CM-5
-* CM-6
-* CM-11
-* MA-3
-* MA-4
-* MA-5
-* PL-4
-* SC-13.
+* AU-09
+* IA-02
+* IA-04
+* IA-05
+* IA-08
+* CM-05
+* CM-06
+* CM-011
+* MA-03
+* MA-04
+* MA-05
+* PL-04
+* SC-13
 
 ## Responsibility
 

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac0202.md

@@ -0,0 +1,42 @@
+---
+title: "AC-02 (02) Account Management - Removal Of Temporary / Emergency Accounts"
+linktitle: "AC-02 (02)"
+url: /private-mendix-platform/nist-controls/ac-0202/
+description: "Documents the Private Mendix Platform's compliance with the AC-02 (02) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-02 (02) control.
+
+| Control ID | AC-02 (02) |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Org |
+
+## Control
+
+The information system automatically removes or; disables temporary and emergency accounts after an: organization-defined time period for each type of account.
+
+### Supplemental Guidance
+
+This control enhancement requires the removal of both temporary and emergency accounts automatically after a predefined period of time has elapsed, rather than at the convenience of the systems administrator.
+
+## Responsibility
+
+### Customer Responsibility
+
+Private Mendix Platform does not provision temporary or emergency accounts outside of normal pre-provisioning and login (SSO) mechanisms.
+
+## Guidance
+
+### Customer Responsibility
+
+To effectively manage temporary and emergency accounts, organizations should:
+
+* Define specific time limits for each type of account based on operational needs and security requirements.
+* Configure the information system to automatically disable or remove these accounts once the defined period expires.
+* Regularly review account activity and ensure that no temporary or emergency account remains active beyond its authorized timeframe.
+* Document the procedures for account creation, monitoring, and removal to ensure compliance and accountability.

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac0207.md

@@ -0,0 +1,71 @@
+---
+title: "AC-02 (07) Account Management - Role-Based Schemes"
+linktitle: "AC-02 (07)"
+url: /private-mendix-platform/nist-controls/ac-0207/
+description: "Documents the Private Mendix Platform's compliance with the AC-02 (07) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-02 (07) control.
+
+| Control ID | AC-02 (07) |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Org |
+
+## Control
+
+The organization:
+
+* Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles.
+* Monitors privileged role assignments.
+* Takes organization-defined actions when privileged role assignments are no longer appropriate.
+
+### Supplemental Guidance
+
+Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, for example, key management, account management, network and system administration, database administration, and web administration.
+
+## Responsibility
+
+### Customer Responsibility
+
+Customers are responsible for defining and documenting their organization-specific privileged roles in alignment with job functions and the principle of least privilege, establishing formal processes for requesting, approving, and provisioning privileged access within Private Mendix Platform. They must conduct periodic access reviews to ensure role assignments remain appropriate, and supplement the platform's built-in monitoring audit logging  tools to capture a complete trail of privileged role changes. 
+
+Additionally, customers are responsible for defining and enforcing actions when privileged access is no longer appropriate — including integrating role revocation with Identity Provider (IdP) workflows to ensure timely de-provisioning upon employee offboarding or role changes, and establishing internal SLAs to govern the timeliness of such actions.
+
+## Guidance
+
+### Customer Responsibility
+
+Privileged access to Private Mendix Platform is controlled through Role-Based Access Control (RBAC) that is driven by the customer's Identity Provider (IdP):
+
+#### Authentication
+
+Users authenticate through the customer's IdP (for example, Azure AD, Entra ID, or other SAML 2.0 or OIDC-compliant provider). The platform does not maintain independent credential stores for end users.
+
+#### Role Assignment through IdP Claims or Groups
+
+The customer's IdP asserts group memberships or role claims during authentication. These IdP groups or claims are mapped to corresponding Private Mendix Platform roles. This ensures that the customer retains centralized control over who holds privileged roles. 
+
+#### Access Enforcement
+
+Upon authentication, the platform evaluates the user's IdP-asserted roles and grants or denies access to privileged actions accordingly. Users without the required privileged role mapping cannot access or execute privileged functions.
+
+#### Lifecycle Management
+
+When a user's group membership or role claim is modified or removed in the customer's IdP, their privileged access within Private Mendix Platform and Mendix applications is updated at the next authentication event. This ensures that privilege revocation is handled centrally through the IdP.
+
+## Proof and Remarks
+
+For more information on how Private Mendix Platform manages dynamic roles and groups, see [Dynamic Role Management in Private Mendix Platform](/private-mendix-platform/dynamic-role-management/#role-editing).
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-0207-1.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-0207-2.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-0207-3.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-0207-4.png" class="no-border" >}}

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac05.md

@@ -34,7 +34,7 @@ Separation of duties addresses the potential for abuse of authorized privileges
 
 The following controls are related to this control:
 
-* AC-3
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
 * AC-6
 * PE-3
 * PE-4

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac17.md

@@ -34,7 +34,7 @@ Remote access controls apply to information systems other than public web server
 The following controls are related to this control:
 
 * AC-2
-* AC-3
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
 * AC-18
 * AC-19
 * AC-20

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac18.md

@@ -30,7 +30,7 @@ Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 8
 The following controls are related to this control:
 
 * AC-2
-* AC-3
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
 * AC-17
 * AC-19
 * CA-3

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac19.md

@@ -51,7 +51,7 @@ Organizations are cautioned that the need to provide adequate security for mobil
 
 The following controls are related to this control:
 
-* AC-3
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
 * AC-7
 * AC-18
 * AC-20

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac20.md

@@ -35,7 +35,7 @@ This control does not apply to the use of external information systems to access
 
 The following controls are related to this control:
 
-* AC-3
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
 * AC-17
 * AC-19
 * CA-3

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac21.md

@@ -29,7 +29,7 @@ This control applies to information that may be restricted in some manner (for e
 
 The following controls are related to this control:
 
-* AC-3
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
 
 ## Responsibility