diff --git a/content/en/docs/private-platform/nist-controls/au/pmp-nist-au12.md b/content/en/docs/private-platform/nist-controls/au/pmp-nist-au12.md new file mode 100644 index 00000000000..3343ef6a002 --- /dev/null +++ b/content/en/docs/private-platform/nist-controls/au/pmp-nist-au12.md @@ -0,0 +1,225 @@ +--- +title: "AU-12 Audit Generation" +linktitle: "AU-12" +url: /private-mendix-platform/nist-controls/au-12/ +description: "Documents the Private Mendix Platform's compliance with the AU-12 control of the NIST 800-53 framework." +weight: 20 +--- + +## Introduction + +This document describes how Private Mendix Platform fulfills the AU-12 control. + +| Control ID | AU-12 | +| --- | --- | +| Requirement baseline | FEDRAMP MODERATE | +| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra | + +## Control + +The information system: + +* Provides audit record generation capability for the auditable events defined in AU-2a at organization-defined information system components. +* Allows organization-defined personnel or roles to select which auditable events are to be audited by specific components of the information system +* Generates audit records for the events defined in AU-2 with the content defined in AU-3. + +### Supplemental Guidance + +Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. + +The following controls are related to this control: + +* [AC-03](/private-mendix-platform/nist-controls/ac-03/) +* AU-02 +* AU-03 +* AU-06 +* AU-07 + +## Responsibility + +### Mendix Responsibility + +Mendix is responsible for implementing and maintaining this control at the platform level. + +### Customer Responsibility + +The customer is responsible for implementing this control in an appropriate manner in their organization. This includes defining which auditable events must be captured at the application and infrastructure levels to ensure compliance with federal requirements. The customer must ensure that audit generation policies, event selection criteria, and audit record content requirements are documented, reviewed, and enforced within their environment. + +#### Infra Implementer + +The Infra Implementer is responsible for configuring audit record generation capabilities at the infrastructure level as dictated by the customer. + +#### App Implementer + +The App Implementer is responsible for implementing audit record generation capabilities within the Mendix application as dictated by the customer. + +## Guidance + +### Mendix Responsibility + +For Private Mendix Platform, AU-12 is satisfied only in part at the platform layer. The Mendix Operator, Private Mendix Platform, and Mendix Runtime generate audit records for platform-level events such as operator actions, runtime activity, deployment operations, and platform configuration changes. Private Mendix Platform does not yet expose the full event-selection configurability contemplated by AU-12 for each platform component, which is why this control remains not fully satisfied. Application-specific audit logging for customer-developed Mendix apps is outside the scope of Private Mendix Platform itself and must be implemented by the customer and app implementer. + +The following configuration is required: + +1. Generate platform audit records by default. + + Configure the Mendix Operator, Private Mendix Platform, and Mendix Runtime so platform-level events such as operator actions, deployment activities, and configuration changes are emitted consistently as audit-relevant logs. + +2. Provide log export integration points. + + Ensure that Private Mendix Platform components can forward or expose their audit-relevant logs to the customer's centralized logging or SIEM destination so platform events can be retained, reviewed, and correlated with external records. + +3. Document platform audit coverage and gaps. + + Clearly document which platform events Private Mendix Platform generates today and which event-selection capabilities are not yet configurable so customers can address the remaining AU-12 requirements at the infrastructure and application layers. + +### Customer Responsibility + +This control is governed by NIST SP 800-53 Rev 4 and NIST SP 800-92, which establish requirements for audit record generation and log management for federal information systems. Customers operating within a FedRAMP or DoD SRG environment must ensure that audit generation capabilities are configured across all system components and that auditable events are selected in accordance with organizational security policies. + +To meet these requirements, the customer must carry out the following actions: + +1. Define auditable events and audit record content. + + The customer must define which events must be audited at each system component level, including the content that each audit record must contain per AU-3. This includes specifying audit requirements for the Infra Implementer at the infrastructure level and for the App Implementer at the application level, in accordance with NIST SP 800-92 guidelines. + +2. Ensure infrastructure audit generation. + + Direct the Infra Implementer to configure audit record generation capabilities at the infrastructure level, including operating system, network device, and cloud service audit logging. These capabilities must align with the events defined in AU-2 and the content requirements defined in AU-3. + +3. Ensure application audit generation. + + Direct the App Implementer to implement audit record generation within the Mendix application using the Audit Trail module and custom logging mechanisms. The application must generate audit records for all customer-defined auditable events with the required content fields per NIST SP 800-53 AU-3. + +### Infra Implementer + +The Infra Implementer is responsible for configuring audit record generation capabilities at the infrastructure level. This includes enabling audit logging on operating systems, network devices, cloud services, and container platforms that support the Mendix application deployment. The Infra Implementer must ensure that infrastructure components can generate audit records for the events defined by the customer and that these records contain the content specified in AU-3. + +The Infra Implementer must perform the following tasks: + +1. Enable infrastructure audit logging. + + Configure audit logging on all infrastructure components (operating systems, network devices, container platforms, cloud services) to generate audit records for the events defined by the Customer in accordance with AU-02. + +2. Configure audit record content. + + Ensure all infrastructure audit records contain the required content fields as defined in AU-03, including event type, timestamp, source, outcome, and identity of the subject or object involved in the event. + +3. Implement audit log forwarding. + + Configure infrastructure components to forward audit logs to the customer's centralized logging system, ensuring that audit records are available for correlation, analysis, and reporting. + +### App Implementer + +The App Implementer is responsible for implementing audit record generation within the Mendix application. This includes configuring the Audit Trail module or equivalent custom audit logging for application-specific events, and ensuring that audit records are directed to the appropriate logging infrastructure as dictated by the customer. + +This responsibility covers app behavior and business events inside customer-developed applications rather than Private Mendix Platform-level events. + +The App Implementer must perform the following tasks: + +1. Implement application audit logging. + + Configure the Mendix Audit Trail module and implement custom audit logging within the application to capture all customer-defined auditable events at the application level. + +2. Define audit record content. + + Ensure application-level audit records contain the required content fields per AU-3, including user identity, event type, timestamp, success or failure indication, and affected data objects. + +3. Configure audit log export. + + Direct application audit logs to the customer's centralized logging infrastructure, ensuring that application-level audit records can be correlated with platform and infrastructure audit records. + +## Proof and Remarks + +Private Mendix Platform activity logs are available in the Admin interface at **Manage > PLATFORM > Activity Logs (/link/manage/activity-log)**. + +### Recent Logs (Platform-Level Audit Records) + +Private Mendix Platform records and displays platform-level audit events in real time. The **Recent Logs*** tab shows entries with the following structure: + +| Field | Example Value | +| --- | --- | +| Category | `Admin` | +| Event Description | `The user USERNAME login` | +| Timestamp | `04-29-2026 05:01:27.659 (UTC-04:00)` | + +Example event types include the following: + +* `The user USERNAME login` - User authentication events, timestamped to millisecond precision +* `Updated Private Registry Password` - Administrative configuration change events + +The following filter capabilities are available: + +* Free-text keyword search across event descriptions +* Time range presets: + + * **All** + * **Last 24 Hours** + * **Last 7 days** + * **Last 30 days** + * **Last 90 days** + +{{< figure src="/attachments/private-platform/nist-au/nist-au-12-1.png" class="no-border" >}} + +### Archived Logs (Automatic Daily Backup) + +Private Mendix Platform automatically archives platform audit logs on a daily schedule. The **Archived Logs** tab shows values like in the following example: + +| Archived Date | Archived Period | File Size | +| --- | --- | --- | +| `04-30-2026, 08:39:42` | `04-29-2026 > 04-30-2026` | `17.056 Kb` | +| `04-14-2026, 08:09:34` | `04-13-2026 > 04-14-2026` | `3.764 Kb` | +| `04-10-2026, 09:44:56` | `04-09-2026 > 04-10-2026` | `4.091 Kb` | +| `04-04-2026, 08:16:10` | `04-03-2026 > 04-04-2026` | `6.396 Kb` | +| `03-31-2026, 08:00:00` | `03-30-2026 > 03-31-2026` | `1.03 Kb` | + +Each archived file can be individually downloaded by a Private Mendix Platform Admin. + +{{< figure src="/attachments/private-platform/nist-au/nist-au-12-2.png" class="no-border" >}} + +### Log Settings (Configurable Retention and Timezone) + +The **Log Settings** tab exposes two admin-configurable parameters: + +| Setting | Options | Example Value | +| --- | --- | --- | +| Retention period for backup logs | 1, 30, 90, 180, 365 days | 1 day | +| Timestamp timezone for display | Any IANA world timezone | (GMT-04:00) Santiago/America | + +{{< figure src="/attachments/private-platform/nist-au/nist-au-12-3.png" class="no-border" >}} + +### Create Custom Report (Export Capability) + +Private Mendix Platform provides an on-demand custom report export function accessible from the **Recent Logs** tab: + +| Setting | Options | +| --- | --- | +| Log level | Event; Summary (default); Complete | +| Export format | PDF (default); Doc2007; JSON; XML | +| Date range | Configurable start date and end date with time picker | + +This allows a Private Mendix Platform Admin to generate time-bounded audit reports in multiple formats for review, submission to auditors, or integration with external SIEM systems. + +{{< figure src="/attachments/private-platform/nist-au/nist-au-12-4.png" class="no-border" >}} + +### AU-12 Gap Analysis + +Private Mendix Platform's compliance with AU-12 currently has the following gaps: + +* There is no per-component event selection. + + AU-12(b) requires allowing authorized personnel to select which auditable events are captured by specific system components. Private Mendix Platform records a fixed set of platform-level administrative events and does not expose granular per-component event selection to administrators. + +* The AU-2 event list is not configurable at platform level. + + Private Mendix Platform does not implement the full AU-2 and AU-12 event catalog. The platform records a predefined list of events. There is no mechanism for an administrator to add or remove event types from the captured set. + +* Infrastructure-level audit generation is out of scope. + + Infrastructure-level audit logging (OS, network, container runtime) is the responsibility of the Infra Implementer and is outside of Private Mendix Platform's scope. + +* Application-level audit generation is the customer's responsibility. + + Audit logging for customer-developed Mendix apps is the responsibility of the customer and app Implementer using the Mendix Audit Trail module or custom instrumentation. Private Mendix Platform does not provide or aggregate application-layer events. + +The above evidence demonstrates that Private Mendix Platform satisfies a partial platform-scoped subset of AU-12 requirements. Full compliance requires coordinated implementation across Infra Implementer (infrastructure logs), and App Implementer along with the customer organization (application-level audit records). \ No newline at end of file diff --git a/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm08.md b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm08.md new file mode 100644 index 00000000000..175016b4dba --- /dev/null +++ b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm08.md @@ -0,0 +1,159 @@ +--- +title: "CM-08 - Information System Component Inventory" +linktitle: "CM-08" +url: /private-mendix-platform/nist-controls/cm-08/ +description: "Documents the Private Mendix Platform's compliance with the CM-08 control of the NIST 800-53 framework." +weight: 20 +--- + +## Introduction + +This document describes how Private Mendix Platform fulfills the CM-08 control. + +| Control ID | CM-08 | +| --- | --- | +| Control category | CM - Configuration Management | +| Requirement baseline | FEDRAMP MODERATE | +| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org | + +## Control + +The organization: +* Develops and documents an inventory of information system components that: + + * Accurately reflects the current information system. + * Includes all components within the authorization boundary of the information system. + * Is at the level of granularity deemed necessary for tracking and reporting. + * Includes organization-defined information deemed necessary to achieve effective information system component accountability. + +* Reviews and updates the information system component inventory at an organization-defined frequency. + +### Supplemental Guidance + +Organizations may choose to implement centralized information system component inventories that include components from all organizational information systems. In such situations, organizations ensure that the resulting inventories include system-specific information required for proper component accountability (for example, information system association, information system owner). + +Information deemed necessary for effective accountability of information system components includes, for example, hardware inventory specifications, software license information, software version numbers, component owners, and for networked components or devices, machine names and network addresses. Inventory specifications include, for example, manufacturer, device type, model, serial number, and physical location. + +The following controls are related to this control: +* CM-02 +* CM-06 +* PM-05 + +For more information, refer to NIST Special Publication 800-128. + +## Responsibility + +### Mendix Responsibility + +* Provide detailed documentation identifying the inventory of all components that are part of the following Mendix products: + + * Mendix Runtime + * Mendix Operator + * Studio Pro + * Private Mendix Platform + +* Update the component inventory documentation with each new version release of the above products. + +### Customer Responsibility + +Customer must define inventory granularity and required component details , establish a review frequency, and coordinate with infrastructure and application implementers and operators to keep both infrastructure and Mendix app inventories accurate and up to date. + +It is the responsibility of the Infra Implementer to provide a full system component list of the infrastructure, and the App Implementer to provide a full component list for the Mendix app. + +It is the responsibility of the Infra Operator to keep the infrastructure list up to date, and the App Operator to keep the Mendix app list up to date. + +## Guidance + +### Mendix Responsibility + +Mendix formally documents and identifies all components included in: + +* Mendix Runtime +* Mendix Operator +* Studio Pro +* Private Mendix Platform + +The documentation includes component names, versions, dependencies, and other information necessary for customers to maintain accountability over components within their authorization boundary. + +Whenever a new version of any of the above products is released, Mendix updates the corresponding component inventory documentation to reflect: + +* New components added +* Version changes +* Removed or deprecated components +* Updated dependencies + +### Customer Responsibility + +To meet this control requirement, the customer should follow the guidance below. + +#### Define Inventory Requirements + +The customer must define the level of detail and granularity required for their information system component inventory to achieve effective component accountability. This includes determining the scope of components to be tracked (all components within the authorization boundary), the types of information to be captured for each component (such as hardware specifications, software versions, network addresses, and ownership), and the appropriate granularity for tracking and reporting needs. These requirements should be documented based on the customer's own risk, compliance, and operational context. + +#### Establish Review and Update Frequency + +The customer must establish how often the component inventory is reviewed and updated. The frequency may be continuous (real-time), periodic (such as monthly or quarterly), or event-driven (triggered by system changes or incidents), depending on the customer's operational environment and compliance obligations. The customer should ensure that inventory updates occur as an integral part of component installations, removals, and system updates. + +#### Integrate Mendix Component Information + +The customer is responsible for obtaining and incorporating Mendix-provided component information into their own asset inventory. Mendix provides detailed component inventory documentation, including a Software Bill of Materials (SBOM), for Mendix Runtime, Mendix Operator, Studio Pro, and Private Mendix Platform, updated with each new version release. The customer can ingest this information into their asset inventory system. + +#### Coordinate with Implementation and Operations Teams + +The customer must work with Infra Implementer, App Implementer, Infra Operator and App Operator to maintain accurate inventories. + +##### Infra Implementer + +The Infra Implementer must perform for the following tasks: + +* Provide complete infrastructure component inventory. +* Document all virtual machines, containers, network devices. +* Specify Kubernetes cluster components and configurations. +* Include operating system versions and patch levels. + +##### App Implementer + +The App Implementer must perform for the following tasks: + +* Provide complete Mendix application component inventory. +* Document all deployed Mendix apps and their versions. +* List all Mendix modules, widgets, and third-party integrations. +* Specify custom code components and dependencies. + +##### Infra Operator + +The Infra Operator must perform for the following tasks: + +* Keep infrastructure inventory up to date as changes occur. +* Update inventory during patching, upgrades, and maintenance. +* Detect and report unauthorized infrastructure components. +* Maintain accuracy of network and system information. + +##### App Operator + +The App Operator must perform for the following tasks: + +* Keep Mendix app inventory up to date as apps are deployed or updated. +* Track app lifecycle (development, staging, production). +* Update inventory when apps are modified or decommissioned. +* Monitor for unauthorized application deployments. + +## Proof and Remarks + +[Conveyor](https://app.conveyor.com/profile/mendix) includes the following portals: + +* [Mendix Operator](https://app.conveyor.com/profile/mendix/d/mendix-operator/cwqIsc) +* [PMP Portal SBOM](https://app.conveyor.com/profile/mendix/d/pmp-portal-sbom/87vRAn) +* [Runtime](https://app.conveyor.com/profile/mendix/d/runtime/hiMac4) +* [Studio Pro Components](https://app.conveyor.com/profile/mendix/d/studio-pro-components/98TuRq) + +{{< figure src="/attachments/private-platform/nist-cm/nist-cm-0801-1.png" class="no-border" >}} + +For more information, refer to the following: + +* [Mendix on Kubernetes Release Notes](/releasenotes/developer-portal/mendix-for-private-cloud/) +* [LTS, MTS, and Monthly Releases](/releasenotes/studio-pro/lts-mts/) +* [Private Mendix Platform Release Notes](/releasenotes/private-platform/) +* [SBOM Generation](/refguide/sbom-generation/) + +{{< figure src="/attachments/private-platform/nist-cm/nist-cm-08-1.png" class="no-border" >}} \ No newline at end of file diff --git a/static/attachments/private-platform/nist-au/nist-au-12-1.png b/static/attachments/private-platform/nist-au/nist-au-12-1.png new file mode 100644 index 00000000000..c96a76fa0c5 Binary files /dev/null and b/static/attachments/private-platform/nist-au/nist-au-12-1.png differ diff --git a/static/attachments/private-platform/nist-au/nist-au-12-2.png b/static/attachments/private-platform/nist-au/nist-au-12-2.png new file mode 100644 index 00000000000..c82c23642d2 Binary files /dev/null and b/static/attachments/private-platform/nist-au/nist-au-12-2.png differ diff --git a/static/attachments/private-platform/nist-cm/nist-cm-08-1.png b/static/attachments/private-platform/nist-cm/nist-cm-08-1.png new file mode 100644 index 00000000000..147210658ec Binary files /dev/null and b/static/attachments/private-platform/nist-cm/nist-cm-08-1.png differ