Merge pull request #11559 from mendix/kk-pmp-nist6

NIST updates

Author: katarzyna-koltun-mx

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac1101.md

@@ -0,0 +1,54 @@
+---
+title: "AC-11 (01) - Session Lock (Pattern-Hiding Displays)"
+linktitle: "AC-11 (01)"
+url: /private-mendix-platform/nist-controls/ac-1101/
+description: "Documents the Private Mendix Platform's compliance with the AC-11 (01) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-11 (01) control.
+
+| Control ID | AC-11 (01) |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership |  Mendix - Private Mendix Platform, Customer - Org |
+
+## Control
+
+The information system conceals, through the session lock, information previously visible on the display with a publicly viewable image.
+
+### Supplemental Guidance
+
+Publicly viewable images can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen, with the additional caveat that none of the images convey sensitive information.
+
+For more information, refer to OMB Memorandum 06-16.
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer administrator must configure this feature properly according to the organization's own access policy.
+
+## Guidance
+
+### Customer Responsibility
+
+Private Mendix Platform provides the setting to configure idleness detection. Administrators can enable **Detect User Idle**, then configure the **Maximum duration before session lock** and enable **Require Pin to unlock**. This setting will lock user’s session after setting duration passed and ask for Pin to unlock.
+
+## Proof and Remarks
+
+To configure the setting, go to **Admin > Settings > Identity & Access**:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-1101-1.png" class="no-border" >}}
+
+After the time specified in the **Maximum duration before session lock time** setting passes, the user needs to enter a PIN to unlock their session:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-1101-2.png" class="no-border" >}}
+
+For information about implementing the function in your Mendix apps by building a widget which runs a JavaScript snippet with idle detection API, refer to the following topics:
+
+* [Idle Detection API](https://developer.mozilla.org/en-US/docs/Web/API/Idle_Detection_API)
+* [Pluggable Widgets API](/apidocs-mxsdk/apidocs/pluggable-widgets-10/)

content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0507.md

@@ -0,0 +1,62 @@
+---
+title: "IA-05 (07) Sensitive Data in Installer"
+linktitle: "IA-05 (07)"
+url: /private-mendix-platform/nist-controls/ia-0507/
+description: "Documents the Private Mendix Platform's compliance with the IA-05 (07) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the IA-05 (07) control.
+
+| Control ID | IA-05 (07) |
+| --- | --- |
+| Control category | IA -  Identification and Authentication |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.
+
+### Supplemental Guidance
+
+Organizations exercise caution in determining whether embedded or stored authenticators are in encrypted or unencrypted form. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators. This is irrespective of whether that representation is perhaps an encrypted version of something else (for example, a password).
+
+## Responsibility
+
+### Mendix Responsibility
+
+Private Mendix Platform installation supports retrieving environment-sensitive data from external secret storage (for example, AWS Secrets Manager, Key Vault, and so on).  
+
+### Customer Responsibility
+
+The customer must set up the external secret manager and properly configure the corresponding secrets.
+
+## Guidance
+
+### Customer Responsibility
+
+The customer must implement an external secrets store to manage sensitive data:
+
+1. Set up and configure the secret storage provider, for example, HashiCorp Vault, AWS Secret Manager or Azure Key Vault.
+2. Install and configure a Kubernetes Secrets Store CSI driver, for example, AWS Secrets Manager CSI Secrets Store. This driver is installed globally for the entire cluster.
+3. Configure the keys at the external secret manager.
+4. When running the Private Mendix Platform installer, select **Use Secret Provider** for the storage plan, database plan, and admin password:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0507-1.png" class="no-border" >}}
+
+## Proof and Remarks
+
+Selecting AWS as the secret provider:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0507-2.png" class="no-border" >}}
+
+Selecting Azure Key Vault as the secret provider:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0507-3.png" class="no-border" >}}
+
+Selecting HashiCorp Vault as the secret provider:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0507-4.png" class="no-border" >}}

content/en/docs/private-platform/nist-controls/mp/pmp-nist-mp0504.md

@@ -0,0 +1,58 @@
+---
+title: "MP-05 (04) - Cryptographic Protection"
+linktitle: "MP-05 (04)"
+url: /private-mendix-platform/nist-controls/mp-0504/
+description: "Documents the Private Mendix Platform's compliance with the MP-05 (04) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the MP-05 (04) control.
+
+| Control ID | MP-05 (04) |
+| --- | --- |
+| Control category | MP - Media Protection |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
+
+### Supplemental Guidance
+
+This control enhancement applies to both portable storage devices (for example, USB memory sticks, compact disks, digital video disks, external or removable hard disk drives) and mobile devices with storage capability (for example, smart phones, tablets, e-readers).
+
+The following controls are related to this control:
+
+* MP-02
+
+For more information, refer to the FIPS Publication 199 and NIST Special Publication 800-60.
+
+## Responsibility
+
+### Shared Responsibility
+
+While the Mendix Runtime provides the capability for encryption at rest, the overall responsibility for defining, configuring, and ensuring compliance with data encryption policies when digital information is stored on devices transported outside of controlled areas lies with the customer, along with their App and Infra Implementers and Operators. 
+
+## Guidance
+
+### Shared Responsibility
+
+The Mendix Runtime provides the capability for encryption at rest of all data that is a part of the Mendix app, including data stored on mobile devices.  
+
+It is the responsibility of the Infra Implementer to ensure that encryption at rest is properly configured for the infrastructure and Private Mendix Platform.  
+
+It is the responsibility of the App Implementer to ensure the Mendix app is configured for encryption at rest, and also properly encrypts all data saved or stored manually by the user as directed by customer requirements.  
+
+It is the responsibility of the Infra Operator and the App Operator to ensure ongoing compliance with data encryption for information stored on digital media during transport outside of controlled areas as directed by the customer.
+
+## Proof and Remarks
+
+While the Mendix Runtime provides the capability for encryption at rest, the overall responsibility for defining, configuring, and ensuring compliance with data encryption policies when digital information is stored on devices transported outside of controlled areas lies with the customer, along with their App and Infra Implementers and Operators.  
+
+Additionally, mobile device encryption at rest is supported (Apple and Android), as well as custom file-storage encryption. For more information, refer to the following topics:
+
+* [Offline Data Security: Local Data Safety](/refguide/mobile/building-efficient-mobile-apps/offlinefirst-data/local-data-security/#local-data-safety)
+* [Updating Encryption Keys for S3 File Storage](/refguide/s3-encryption-key-update/)

content/en/docs/private-platform/nist-controls/pe/_index.md

@@ -0,0 +1,15 @@
+---
+title: "NIST 800-53 Physical and Environmental Protection Compliance for Private Mendix Platform"
+linktitle: "Physical and Environmental Protection"
+url: /private-mendix-platform/nist-controls-pe/
+description: "Documents the Private Mendix Platform's compliance with the Physical and Environmental Protection (PE) category of the NIST 800-53 security framework."
+weight: 10
+no_list: false 
+simple_list: true
+---
+
+## Introduction
+
+Documents in this section provide more information about Private Mendix Platform's compliance with the Physical and Environmental Protection (PE) category of the [NIST 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) security framework. For each applicable control, we have listed which party (Mendix or the customer) is responsible for which component or aspect.
+
+In general, Mendix is responsible for the Private Mendix Platform, Mendix Operator, Mendix Studio Pro, Mendix Runtime, and so on. Customer responsibilities are related to infra and organization processes. For more information, refer to detailed documentation below.

content/en/docs/private-platform/nist-controls/pe/pmp-nist-pe0301.md

@@ -0,0 +1,57 @@
+---
+title: "PE-03 (01) Information System Access"
+linktitle: "PE-03 (01)"
+url: /private-mendix-platform/nist-controls/pe-0301/
+description: "Documents the Private Mendix Platform's compliance with the PE-03 (01) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the PE-03 (01) control.
+
+| Control ID | PE-03 (01) |
+| --- | --- |
+| Control category | PE - Physical And Environmental Protection |
+| Requirement baseline | IL4 |
+| Responsibility and ownership | Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization enforces physical access authorizations to the information system in addition to the physical access controls for the facility at organization-defined physical spaces containing one or more components of the information system.
+
+### Supplemental Guidance
+
+This control enhancement provides additional physical security for those areas within facilities where there is a concentration of information system components (for example, server rooms, media storage areas, data and communications centers). 
+
+The following controls are related to this control:
+
+* PS-2
+
+## Responsibility
+
+### Shared Responsibility
+
+The responsibility for defining, implementing, and enforcing physical access controls, and ensuring Mendix applications respect them, lies with the Customer and their App and Infra Implementers. This is because Mendix is a software platform and does not own or manage the customer's physical infrastructure (buildings, data centers, hardware) where these controls are applied. Physical access controls are unique to each customer's environment, security policies, and regulatory obligations. 
+
+While Mendix Studio Pro allows the creation of applications that can integrate with and respect these controls, and Private Mendix Platform supports integration with the customer's Identity Provider (IdP), which may, in turn, leverage physical authentication methods like PKI cards, the customer is solely responsible for establishing and maintaining their physical security perimeter and the IdP configuration that enforces it.
+
+## Guidance
+
+### Shared Responsibility
+
+Studio Pro allows Mendix apps to be built that require and respect physical access control mechanisms such as PKI cards.
+
+It is the responsibility of the customer to indicate what physical controls are acceptable.
+
+It is the responsibility of the Infra Implementer to ensure access to infrastructure requires physical access authorization, and the App Implementer to ensure that the Mendix app requires physical access authorization as dictated by the customer.
+
+## Proof and Remarks
+
+Private Mendix Platform provides the integration points (OIDC, SAML) to connect to an Identity Provider. The IdP (for example, Microsoft Azure AD) must be configured to enforce and manage the actual physical access control mechanisms (like PKI cards) during the user authentication process. Mendix then consumes the authenticated user's identity from the IdP:
+
+{{< figure src="/attachments/private-platform/nist-pe/nist-pe-0301-1.png" class="no-border" >}}
+
+Specific Mendix applications can be configured to connect to the customer's IdP by the App Implementer or Operator by using [OIDC SSO](/appstore/modules/oidc/) or [SAML](/appstore/modules/saml/), both of which allow for physical authentication mechanisms through the customer's IdP.
+
+Additionally, it is possible to configure biometric authentication directly on native mobile applications (Apple and Android) using the [Native Mobile Resources](/appstore/modules/native-mobile-resources/#native-authentication-category) module. The module is platform-supported, that is, supported by Mendix.