Merge branch 'development' into production

Author: katarzyna-koltun-mx

content/en/docs/private-platform/nist-controls/_index.md

@@ -0,0 +1,15 @@
+---
+title: "NIST 800-53 Compliance for Private Mendix Platform"
+linktitle: "NIST 800-53 Compliance"
+url: /private-mendix-platform/nist-controls/
+description: "Documents the Private Mendix Platform's compliance with the NIST 800-53 security framework."
+weight: 10
+no_list: false 
+description_list: true
+---
+
+## Introduction
+
+Documents in this section provide more information about Private Mendix Platform's compliance with the [NIST 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) security framework. For each applicable control, we have listed which party (Mendix or the customer) is responsible for which component or aspect.
+
+In general, Mendix is responsible for the Private Mendix Platform, Mendix Operator, Mendix Studio Pro, Mendix Runtime, and so on. Customer responsibilities are related to infra and organization processes. For more information, refer to detailed documentation below.

content/en/docs/private-platform/nist-controls/ac/_index.md

@@ -0,0 +1,15 @@
+---
+title: "NIST 800-53 Access Control Compliance for Private Mendix Platform"
+linktitle: "Access Control"
+url: /private-mendix-platform/nist-controls-ac/
+description: "Documents the Private Mendix Platform's compliance with the Access Control (AC) category of the NIST 800-53 security framework."
+weight: 10
+no_list: false 
+description_list: false
+---
+
+## Introduction
+
+Documents in this section provide more information about Private Mendix Platform's compliance with the Access Control (AC) category of the [NIST 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) security framework. For each applicable control, we have listed which party (Mendix or the customer) is responsible for which component or aspect.
+
+In general, Mendix is responsible for the Private Mendix Platform, Mendix Operator, Mendix Studio Pro, Mendix Runtime, and so on. Customer responsibilities are related to infra and organization processes. For more information, refer to detailed documentation below.

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac01.md

@@ -0,0 +1,70 @@
+---
+title: "AC-01 Access Control Policy And Procedures"
+linktitle: "AC-01"
+url: /private-mendix-platform/nist-controls/ac-01/
+description: "Documents the Private Mendix Platform's compliance with the AC-01 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-01 control.
+
+| Control ID | AC-01 |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Org |
+
+## Control
+
+The organization:
+
+* Develops, documents, and disseminates to organization-defined personnel or roles:
+
+    * An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
+    * Procedures to facilitate the implementation of the access control policy and associated access controls
+
+* At an organization-defined frequency, reviews and updates the current:
+
+    * Access control policy
+    * Access control procedures
+
+### Supplemental Guidance
+
+This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. 
+
+The organizational risk management strategy is a key factor in establishing policy and procedures. 
+
+The following controls are related to this control:
+
+* PM-9.
+
+For more information, refer to the NIST Special Publications 800-12 and 800-100.
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control (policies abd procedures) in an appropriate manner in their organization.
+
+## Guidance
+
+### Customer Responsibility
+
+Private Mendix Platform offers integrations to customer IdP over industry-standard protocols for user pre-provisioning and single sign-on to platform services (web portal) and Studio Pro (local IDE). Customer ACPs are defined at IdP-level and honored through dynamic role mapping in Private Mendix Platform.
+
+Mendix provides integration hooks with the customer’s IDP, and allows management of the IDP in the following areas:
+
+* Mendix Runtime
+* Private Mendix Platform
+* Studio Pro
+* Customer-built applications
+
+## Proof and Remarks
+
+Private Mendix Platform offers integrations to customer IdP over industry-standard protocols - OIDC and SAML:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-01-1.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-01-2.png" class="no-border" >}}

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac02-1103.md

@@ -0,0 +1,52 @@
+---
+title: "AC-02 1103 Configurable Session Expiration and Auto-Logout for Users"
+linktitle: "AC-02 1103"
+url: /private-mendix-platform/nist-controls/ac-02-1103/
+description: "Documents the Private Mendix Platform's compliance with the AC-02 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-02 (05) control.
+
+| Control ID | AC-02 (05) |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership |  Mendix - Private Mendix Platform, Customer - Org |
+
+## Control
+
+The organization requires that users are logged out after an organization-defined period of inactivity.
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer administrator must configure this feature properly according to the organization's own access policy.
+
+## Guidance
+
+### Customer Responsibility
+
+The customer must configure this feature by performing the following steps:
+
+1. Log in to Private Mendix Platform as a user with the System Admin role.
+2. Go to **Settings > Identity & Access Settings**.
+3. In the **Session Duration** section, specify the number of hours in the **Set maximum period for automatic session expiration** field.
+4. Set the **Show notification before log user out** toggle to **ON**.
+
+## Proof and Remarks
+
+System Admin configures and enables the feature:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-02-1103-1.png" class="no-border" >}}
+
+The user is logged out after the configured time period:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-02-1103-2.png" class="no-border" >}}
+
+If the **Show notification** option is on, the user is alerted before they are logged out:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-02-1103-3.png" class="no-border" >}}

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac02.md

@@ -0,0 +1,123 @@
+---
+title: "AC-02 Account Management"
+linktitle: "AC-02"
+url: /private-mendix-platform/nist-controls/ac-02/
+description: "Documents the Private Mendix Platform's compliance with the AC-02 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-02 control.
+
+| Control ID | AC-02 |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Org |
+
+## Control
+
+The organization:
+
+* Identifies and selects the organization-defined information system accounts to support organizational missions or business functions.
+* Assigns account managers for information system accounts.
+* Establishes conditions for group and role membership.
+* Specifies authorized users of the information system, group and role membership, and access authorizations (that is, privileges) and other attributes (as required) for each account.
+* Requires approvals by an organization-defined personnel or roles for requests to create information system accounts.
+* Creates, enables, modifies, disables, and removes information system accounts in accordance with organization-defined procedures or conditions.
+* Monitors the use of information system accounts
+* Notifies account managers:
+
+    * When accounts are no longer required.
+    * When users are terminated or transferred.
+    * About individual information system usage or need-to-know changes.
+
+* Authorizes access to the information system based on:
+
+    * A valid access authorization
+    * Intended system usage
+    * Other attributes as required by the organization or associated missions/business functions
+
+* Reviews accounts for compliance with account management requirements at an organization-defined frequency.
+* Establishes a process for reissuing shared and group account credentials (if deployed) when individuals are removed from the group.
+
+ ### Supplemental Guidance
+
+ Information system account types include the following:
+ 
+ * Individual
+ * Shared
+ * Group
+ * System
+ * Guest or anonymous
+ * Emergency
+ * Developer, manufacturer, or vendor
+ * Temporary
+ * Service. 
+ 
+ Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. 
+ 
+ Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (for example, system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. 
+ 
+ Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (for example, scheduled maintenance, system upgrades) and mission/business requirements, (for example, time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. 
+ 
+ Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (for example, local logon accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic disabling or removal dates. 
+ 
+ Conditions for disabling or deactivating accounts include, for example: 
+ 
+ * When shared, group, emergency, or temporary accounts are no longer required
+ * When individuals are transferred or terminated. 
+ 
+ Some types of information system accounts may require specialized training. 
+ 
+ The following controls are related to this control:
+
+* AC-3
+* AC-4
+* AC-5
+* AC-6
+* AC-10
+* AC-17
+* AC-19
+* AC-20
+* AU-9
+* IA-2
+* IA-4
+* IA-5
+* IA-8
+* CM-5
+* CM-6
+* CM-11
+* MA-3
+* MA-4
+* MA-5
+* PL-4
+* SC-13.
+
+## Responsibility
+
+### Customer Responsibility
+
+When Single Sign-On (SSO) is used, account lifecycle management—including account creation, modification, deactivation, and access authorization—should be handled by the customer's Identity Provider (IdP) administrators. The customer is responsible for maintaining user accounts, group and role memberships, and access privileges within their IdP system. Our application relies on the information provided by the IdP and does not independently manage user account lifecycles.
+
+## Guidance
+
+### Customer Responsibility
+
+Private Mendix Platform offers integrations to customer IdP over industry-standard protocols for user pre-provisioning and single sign-on to platform services (web portal) and Studio Pro (local IDE). Customer ACPs are defined at IdP-level and honored through dynamic role mapping in Private Mendix Platform.
+
+Mendix provides integration hooks with the customer’s IDP, and allows management of the IDP in the following areas:
+
+* Mendix Runtime
+* Private Mendix Platform
+* Studio Pro
+* Customer-built applications
+
+## Proof and Remarks
+
+Private Mendix Platform offers integrations to customer IdP over industry-standard protocols - OIDC and SAML.
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-01-1.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-01-2.png" class="no-border" >}}

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac0201.md

@@ -0,0 +1,58 @@
+---
+title: "AC-02 (01) Account Management - Automated System Account Management"
+linktitle: "AC-02 (01)"
+url: /private-mendix-platform/nist-controls/ac-0201/
+description: "Documents the Private Mendix Platform's compliance with the AC-02 (01) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-02 (01) control.
+
+| Control ID | AC-02 (01) |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Customer - Org |
+
+## Control
+
+The organization employs automated mechanisms to support the management of information system accounts.
+
+### Supplemental Guidance
+
+The use of automated mechanisms can include, for example: 
+
+* Using email or text messaging to automatically notify account managers when users are terminated or transferred
+* Using the information system to monitor account usage
+* Using telephonic notifications to report atypical system account usage.
+
+## Responsibility
+
+### Customer Responsibility
+
+Management mechanisms towards customer accounts are set and controlled at the customer IdP-level. Customers have the flexibility to implement any alerts they require by utilizing their preferred audit and logging management system. This approach allows organizations to integrate alerting mechanisms that best fit their operational needs and compliance requirements, ensuring seamless monitoring and timely notifications within their existing infrastructure.
+
+## Guidance
+
+### Customer Responsibility
+
+The platform provides the necessary audit logs and event data that customers can ingest into their preferred monitoring solution to satisfy this control requirement.
+
+For example, organizations using Azure Entra ID (Azure AD), alerts can be configured through Azure AD’s built-in monitoring and security features. Specifically, customers can leverage Azure AD Identity Protection to set up risk-based alerts, use Azure Monitor and Log Analytics to create custom queries and alert rules based on sign-in and audit logs, and integrate with Microsoft Sentinel for advanced security incident detection and automated response. 
+
+Examples of customer-implemented alerts may include, but are not limited to:
+
+* Alerts on account creation or deletion events
+* Notifications for privilege escalation or role changes
+* Alerts for dormant or inactive accounts
+* Notifications for failed login attempts or account lockouts
+
+## Proof and Remarks
+
+Private Mendix Platform offers integrations to customer IdP over industry-standard protocols - OIDC and SAML:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-01-1.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-01-2.png" class="no-border" >}}

content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac0203.md

@@ -0,0 +1,39 @@
+---
+title: "AC-02 (03) Account Management (Disable Inactive Accounts)"
+linktitle: "AC-02 (03)"
+url: /private-mendix-platform/nist-controls/ac-0203/
+description: "Documents the Private Mendix Platform's compliance with the AC-02 (03) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-02 (03) control.
+
+| Control ID | AC-02 (03) |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership |  Mendix - Private Mendix Platform, Customer - Org |
+
+## Control
+
+The information system automatically disables inactive accounts after an organization-defined time period.
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer administrator must configure this feature properly according to the organization's own access policy.
+
+## Guidance
+
+### Customer Responsibility
+
+Private Mendix Platform provides the setting to configure **Inactivity Period for Automatic Account Disabling (Hours)** in admin mode. After the configured time has passed, the user account is not allowed to login until the admin reactivates this account. Set to 0 to disable this feature. 
+
+## Proof and Remarks
+
+Private Mendix Platform provides a setting to configure the inactivity period at **Settings > Identity & Access > Preferences**:
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-0203-1.png" class="no-border" >}}