Updates to NIST docs

katarzyna-koltun-mx · katarzyna-koltun-mx · commit 87336e1becb6 · 2026-05-26T11:02:26.000+02:00
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc0714.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc0714.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-07 (14) System and Communications Protection - Boundary Protection - Protects Against Unauthorized Physical Connections"
+linktitle: "SC-07 (14)"
 url: /private-mendix-platform/nist-controls/sc-0714/
 description: "Documents the Private Mendix Platform's compliance with the SC-07 (14) control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc08.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc08.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-08 System and Communications Protection - Transmission Confidentiality and Integrity"
+linktitle: "SC-08"
 url: /private-mendix-platform/nist-controls/sc-08/
 description: "Documents the Private Mendix Platform's compliance with the SC-08 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc0801.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc0801.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-08 (01) System and Communications Protection - Transmission Confidentiality and Integrity- Cryptographic or Alternate Physical Protection"
+linktitle: "SC-08 (01)"
 url: /private-mendix-platform/nist-controls/sc-0801/
 description: "Documents the Private Mendix Platform's compliance with the SC-08 (01) control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc0802.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc0802.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-08 (02) System and Communications Protection - Transmission Confidentiality and Integrity- Pre/Post Transmission Handling"
+linktitle: "SC-08 (02)"
 url: /private-mendix-platform/nist-controls/sc-0802/
 description: "Documents the Private Mendix Platform's compliance with the SC-08 (02) control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc10.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc10.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-10 System and Communications Protection - Network Disconnect"
+linktitle: "SC-10"
 url: /private-mendix-platform/nist-controls/sc-10/
 description: "Documents the Private Mendix Platform's compliance with the SC-10 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc12.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc12.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-12 System and Communications Protection - Cryptographic Key Establishment and Management"
+linktitle: "SC-12"
 url: /private-mendix-platform/nist-controls/sc-12/
 description: "Documents the Private Mendix Platform's compliance with the SC-12 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc13.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc13.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-13 System and Communications Protection - Cryptographic Protection"
+linktitle: "SC-13"
 url: /private-mendix-platform/nist-controls/sc-13/
 description: "Documents the Private Mendix Platform's compliance with the SC-13 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc17.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc17.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-17 System and Communications Protection - Public Key Infrastructure Certificates"
+linktitle: "SC-17"
 url: /private-mendix-platform/nist-controls/sc-17/
 description: "Documents the Private Mendix Platform's compliance with the SC-17 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc18.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc18.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-18 System and Communications Protection - Mobile Code"
+linktitle: "SC-18"
 url: /private-mendix-platform/nist-controls/sc-18/
 description: "Documents the Private Mendix Platform's compliance with the SC-18 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc20.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc20.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-20 System and Communications Protection - Secure Name and Address Resolution Service (Authoritative Source)"
+linktitle: "SC-20"
 url: /private-mendix-platform/nist-controls/sc-20/
 description: "Documents the Private Mendix Platform's compliance with the SC-20 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc21.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc21.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-21 System and Communications Protection - Secure Name and Address Resolution Service (Recursive or Caching Resolver)"
+linktitle: "SC-21"
 url: /private-mendix-platform/nist-controls/sc-21/
 description: "Documents the Private Mendix Platform's compliance with the SC-21 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc23.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc23.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-23 System and Communications Protection - Session Authenticity"
+linktitle: "SC-23"
 url: /private-mendix-platform/nist-controls/sc-23/
 description: "Documents the Private Mendix Platform's compliance with the SC-23 control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc2301.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc2301.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-23 (01) System and Communications Protection - Session Authenticity - Invalidate Session Identifiers at Logout"
+linktitle: "SC-23 (01)"
 url: /private-mendix-platform/nist-controls/sc-2301/
 description: "Documents the Private Mendix Platform's compliance with the SC-23 (01) control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc2303.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc2303.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-23 (03) System and Communications Protection - Session Authenticity - Unique Session Identifiers with Randomness"
+linktitle: "SC-23 (03)"
 url: /private-mendix-platform/nist-controls/sc-2303/
 description: "Documents the Private Mendix Platform's compliance with the SC-23 (03) control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc2305.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc2305.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-23 (05) System and Communications Protection - Session Authenticity - Allowed Certificate Authorities"
+linktitle: "SC-23 (05)"
 url: /private-mendix-platform/nist-controls/sc-2305/
 description: "Documents the Private Mendix Platform's compliance with the SC-23 (05) control of the NIST 800-53 framework."
 weight: 20
diff --git a/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc28.md b/content/en/docs/private-platform/nist-controls/sc/pmp-nist-sc28.md
@@ -1,5 +1,6 @@
 ---
 title: "SC-28 System and Communications Protection - Protection of Information at Rest"
+linktitle: "SC-28"
 url: /private-mendix-platform/nist-controls/sc-28/
 description: "Documents the Private Mendix Platform's compliance with the SC-28 control of the NIST 800-53 framework."
 weight: 20
@@ -143,61 +144,33 @@ This covers VCS PATs, build cluster tokens, registry passwords, SMTP passwords,
 
 ### External Secret Management: HashiCorp Vault
 
-PMP 1.24.2 introduced HashiCorp Vault as an external secret management backend. The public release note states:
+Since version 1.24.2 Private Mendix Platform supports Hashicorp Vault as an external secret management solution alongside the traditional database storage option.
 
-▎ "Private Mendix Platform now supports Hashicorp Vault as an external secret management solution alongside the traditional database storage option."
+The integration uses Vault's KV version 2 secrets engine with Kubernetes Auth Method (that is, password-less OIDC-based pod authentication). All Platform credentials (such as VCS PATs, build tokens, registry passwords, storage keys, SMTP passwords) can be stored externally in Vault, where they are protected by Vault's transit encryption at rest.
 
-The integration uses Vault's KV Version 2 secrets engine with Kubernetes Auth Method (passwordless OIDC-based pod authentication). All platform credentials (VCS PATs, build tokens, registry passwords, storage keys, SMTP passwords) can be externalized to Vault, where they are protected by Vault's transit encryption at rest.
+For more information, see the following documents:
 
-The public docs reference for the integration setup:
-https://docs.mendix.com/developerportal/deploy/secret-store-credentials/#hashicorp
+* [Configuring a Secret Store with HashiCorp Vault](/developerportal/deploy/secret-store-credentials/#hashicorp)
+* [Private Mendix Platform 1.24.2 Release Notes](/releasenotes/private-platform/1-24/#1242)
 
-PMP release note section: 1.24.2 New Features — #1242
+### External Secret Management: AWS Secrets Manager
 
-URL: https://docs.mendix.com/releasenotes/private-platform/1-24/#1242
+Private Mendix Platform supports AWS Secrets Manager as an alternative credential storage backend, accessed through IRSA (IAM Roles for Service Accounts). No static AWS credentials stored at rest. Credentials such as VCS PATs, build cluster tokens, and registry passwords are stored in AWS Secrets Manager (encrypted by AWS KMS) and fetched at runtime using the pod's assigned IAM role identity.
 
-External Secret Management: AWS Secrets Manager
+For more information, see [Retrieve Environment-Sensitive Data from a Secret Store](/developerportal/deploy/secret-store-credentials/).
 
-PMP supports AWS Secrets Manager as an alternative credential storage backend, accessed via IRSA (IAM Roles for Service Accounts) — no static AWS credentials stored at rest:
+### Read-Only Root Filesystem: Prevents Malicious Code from Writing to Storage
 
-▎ "AWS Secrets Manager: Credentials are stored in AWS Secrets Manager and accessed securely via
-▎ IAM roles"
+Starting in Mendix Operator 2.21.0, all system containers mount `readOnlyRootFilesystem: true` by default. Mendix app container images are locked down by default - they run as a non-root user, cannot request elevated permissions, and file ownership and permissions prevent modification of system and critical paths.
 
-Credentials such as VCS PATs, build cluster tokens, and registry passwords are stored in Secrets
-Manager (encrypted by AWS KMS) and fetched at runtime using the pod's assigned IAM role identity.
+This is an integrity protection control for information at rest inside the container filesystem, directly referenced in NIST SC-28 supplemental guidance as a *Write-Once-Read-Many* equivalent mechanism. Malicious code cannot modify the container's stored filesystem state.
 
-Public docs reference: https://docs.mendix.com/developerportal/deploy/secret-store-credentials/
+For more information, see [Read-only RootFS](/developerportal/deploy/private-cloud-cluster/#readonlyrootfs).
 
-Read-Only Root Filesystem: Prevents Malicious Code from Writing to Storage
+### EnableFileDocumentCaching Security Guard for Sensitive Data at Rest
 
-From Mendix Operator v2.21.0+, all system containers mount readOnlyRootFilesystem: true by default:
+The Mendix Runtime provides the [EnableFileDocumentCaching](/refguide/custom-settings/#EnableFileDocumentCaching) setting to prevent sensitive file documents from being cached to local disk. By default, caching is set to `false`. Customers are advised to only enable caching if they are sure that the file documents will not contain any sensitive information. This direct data-at-rest protection control at the runtime layer prevents sensitive `System.FileDocument` data from being written to the local container filesystem where it would exist at rest without encryption.
 
-▎ "Mendix app container images are locked down by default — they run as a non-root user, cannot
-▎ request elevated permissions, and file ownership and permissions prevent modification of system
-▎ and critical paths."
+### SC-28(1) - FIPS Mode: AES-256 and FIPS 140-2 Validated Cryptography
 
-This is an integrity protection control for information at rest inside the container filesystem — directly referenced in NIST SC-28 supplemental guidance as a "Write-Once-Read-Many" equivalent mechanism. Malicious code cannot modify the container's stored filesystem state.
-
-Section: Read-only RootFS — #read-only-rootfs
-
-URL: https://docs.mendix.com/developerportal/deploy/private-cloud-cluster/#read-only-rootfs
-
-EnableFileDocumentCaching Security Guard for Sensitive Data at Rest
-
-The Mendix Runtime provides an explicit control to prevent sensitive file documents from being
-cached to local disk:
-
-▎ "EnableFileDocumentCaching — Defines whether file documents should be cached. Only enable this
-▎ if you are sure that the file documents will not contain sensitive information."
-
-Default is off. This prevents sensitive System.FileDocument data from being written to the local
-container filesystem where it would exist at rest without encryption — a direct data-at-rest
-protection control at the runtime layer.
-
-Section: General Settings — #general-settings
-
-URL: https://docs.mendix.com/refguide/custom-settings/#general-settings
-
-SC-28(1) / FIPS Mode: AES-256 and FIPS 140-2 Validated Cryptography
-
-The sibling control SC-28(1) documents the cryptographic protection mechanisms available in PMP, including support for FIPS 140-2 validated modules when deployed in FIPS mode. PMP supports FIPS-compliant deployments on supported Kubernetes distributions, ensuring AES-256 is used for data at rest.
+The sibling control SC-28 (1) documents the cryptographic protection mechanisms available in Private Mendix Platform, including support for FIPS 140-2 validated modules when deployed in FIPS mode. Private Mendix Platform supports FIPS-compliant deployments on supported Kubernetes distributions, ensuring that AES-256 is used for data at rest.
