diff --git a/content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac06.md b/content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac06.md
new file mode 100644
index 00000000000..223c425e271
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/ac/pmp-nist-ac06.md
@@ -0,0 +1,182 @@
+---
+title: "AC-06 Least Privilege"
+linktitle: "AC-06"
+url: /private-mendix-platform/nist-controls/ac-06/
+description: "Documents the Private Mendix Platform's compliance with the AC-06 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AC-06 control.
+
+| Control ID | AC-06 |
+| --- | --- |
+| Control category | AC - Access Control |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
+
+### Supplemental Guidance
+
+Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.
+
+* AC-02
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
+* AC-05
+* CM-06
+* CM-07
+* PL-02
+
+## Responsibility
+
+### Mendix Responsibility
+
+#### Private Mendix Platform Installation
+
+Private Mendix Platform supports least privilege by requiring explicit configuration of infrastructure, separating operational scopes, and allowing customers to enable only the functions they need. Private Mendix Platform is deployed into customer-managed Kubernetes environments with defined namespaces, storage, database, registry, and identity settings rather than relying on broad default access. Private Mendix Platform also supports least privilege through controlled authentication and secret management. Sensitive configuration, including database, storage, and administrator credentials, can be sourced from external secret providers.
+
+##### Build Agent
+
+Private Mendix Platform provides a build agent to orchestrate build pods. Build agent implements a secure, ​​least-privilege access model​​ for creating Pods within the Kubernetes cluster. The core concept is to ​​decouple the external user's permissions from the internal service's capabilities​​ by leveraging Kubernetes RBAC (Role-Based Access Control).
+
+##### Connected Mode Deployment
+
+This supports least privilege by centralizing deployment functions in the operator and agent model and limiting the number of users who need direct cluster administration rights. Initial cluster registration and operator installation may still require elevated infrastructure permissions, but ongoing application deployment and environment management can be delegated through Private Mendix Platform without granting broad cluster privileges to all app-level users.
+
+#### Private Mendix Platform Operation (Admin Access)
+
+Private Mendix Platform restricts administrative access through role separation, configurable role assignment, and enterprise identity integration. Administrative duties are divided between Company admin and System admin roles. This separation limits unnecessary access to platform-wide configuration.
+
+Private Mendix Platform further supports least privilege through Dynamic Role Management. Predefined roles such as Developer, Contributor, Operator, and Administrator can be assigned and customized for project, cluster, and CI/CD permissions. Roles are assigned through group membership and applied only to owned or associated resources, allowing access to align with organizational and operational boundaries.
+
+#### Private Mendix Platform Application Management
+
+Private Mendix Platform associates access with apps, groups, namespaces, and roles. App owners can invite users and assign roles, while inherited group roles are synchronized to owned or associated resources. This means the control plane does not require every user to have direct broad access to clusters or all applications. Instead, access is derived from resource ownership and group-based role assignment.
+
+### Customer Responsibility
+
+* The customer cluster admin uses the Private Mendix Platform installer to grant these permissions to the build agent component.
+* The customer must correctly install components related to connected mode deployment, such as Interactor, Collector, and Authenticator.
+* The customer's administrator must properly grant specific people access to the cluster and namespace management for connected mode deployment.
+* The customer must grant proper permissions to give the Private Mendix Platform `mxpc-cli` access to the destination Kubernetes cluster. After that, a piece of script must be executed with `mxpc-cli`.
+* Customers must configure Private Mendix Platform roles, group and app ownership, and approval workflows, so that CI/CD and deployment actions are performed only by explicitly authorized users and services
+* App implementers and App operators must connect to the customer's IdP of choice, use Private Mendix Platform roles, group ownership, environment separation, application-level security, and controlled approval-based deployment processes, so that users and teams receive only the minimum access required for development, operations, and production deployment.
+* Infrastructure implementers and operators are responsible for deploying Private Mendix Platform in a least-privilege environment by separating namespaces where required, scoping Kubernetes RBAC and service identities to only required functions, using managed identity and centralized secret management where supported, restricting access to infrastructure services and tokens, and disabling unused platform capabilities. Because Private Mendix Platform cluster integration relies on customer-created tokens and RBAC objects, customers must demonstrate that these permissions are explicitly limited and justified rather than broadly granted.
+
+## Guidance
+
+### Mendix Responsibility
+
+#### Build Agent
+
+By defining `​​ServiceAccounts`​​, ​​`Roles`​​, `​​RoleBindings​​`, and ​​security policies​​ in Helm charts, the Private Mendix Platform installer ensures that Kubernetes build agents operate under ​​the principle of least privilege​​. This reduces security risks while maintaining CI/CD functionality. 
+
+##### ServiceAccount
+
+```yaml
+apiVersion: v1
+automountServiceAccountToken: true
+kind: ServiceAccount
+metadata:
+  annotations:
+    meta.helm.sh/release-name: mxplatform-kube-agent
+    meta.helm.sh/release-namespace: build
+  creationTimestamp: "2025-06-12T02:18:33Z"
+  labels:
+    app.kubernetes.io/instance: mxplatform-kube-agent
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: mxplatform-kube-agent
+    app.kubernetes.io/version: 1.16.0
+    helm.sh/chart: mxplatform-kube-agent-0.1.0
+  name: mxplatform-kube-agent
+  namespace: build
+  resourceVersion: "89036755"
+  uid: 5a1d4e2d-5ac5-4e26-be59-8c95aabe62c9
+```
+
+#### Role
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    meta.helm.sh/release-name: mxplatform-kube-agent
+    meta.helm.sh/release-namespace: build
+  creationTimestamp: "2025-06-12T02:18:33Z"
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  name: pod-manager-role
+  namespace: build
+  resourceVersion: "89036756"
+  uid: 1ce6a19d-639f-4a17-84a4-91b526970df1
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+```
+
+#### RoleBinding
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    meta.helm.sh/release-name: mxplatform-kube-agent
+    meta.helm.sh/release-namespace: build
+  creationTimestamp: "2025-06-12T02:18:33Z"
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  name: pod-manager-role-binding
+  namespace: build
+  resourceVersion: "89036757"
+  uid: e873f68e-691c-495a-84d7-b43fbcca9609
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pod-manager-role
+subjects:
+- kind: ServiceAccount
+  name: mxplatform-kube-agent
+  namespace: build
+```
+
+### Customer Responsibility
+
+#### Connected Mode Deployment
+
+* Customers can use the installer to install components related to connected mode deployment.
+* The customer organization must employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish connected mode namespace configuration.
+* Customers can place one valid kubeconfig file which will grant `mxpc-cli` access to the destination cluster, and then execute the command line script shown in the **Installation** tab of the cluster namespace **Details** page in connected mode.
+
+## Proof and Remarks
+
+Private Mendix Platform provides a new **Build Utility** option to build customer Mendix applications.
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-06-1.png" class="no-border" >}}
+
+Kubernetes privilege credentials are removed from the build configuration.
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-06-2.png" class="no-border" >}}
+
+### Connected Mode Components Installation
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-06-3.png" class="no-border" >}}
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-06-4.png" class="no-border" >}}
+
+### Private Mendix Plaform Roles
+
+{{< figure src="/attachments/private-platform/nist-ac/nist-ac-06-5.png" class="no-border" >}}
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/ca/pmp-nist-ca05.md b/content/en/docs/private-platform/nist-controls/ca/pmp-nist-ca05.md
new file mode 100644
index 00000000000..70837ba7ec1
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/ca/pmp-nist-ca05.md
@@ -0,0 +1,110 @@
+---
+title: "CA-05 Plan of Action and Milestones"
+linktitle: "CA-05"
+url: /private-mendix-platform/nist-controls/ca-05/
+description: "Documents the Private Mendix Platform's compliance with the CA-07 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CA-05 control.
+
+| Control ID | CA-05 |
+| --- | --- |
+| Control category | CA - Security Assessment and Authorization |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra |
+
+## Control
+
+The organization:
+
+* Develops a plan of action and milestones for the information system to document the organization's planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system.
+* Updates existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities. 
+
+### Supplemental Guidance
+
+Plans of action and milestones are key documents in security authorization packages and are subject to federal reporting requirements established by OMB.
+
+The following controls are related to this control:
+
+* CA-02
+* CA-07
+* CM-04
+* PM-04
+
+For more information, refer to the OMB Memorandum 02-01 and NIST Special Publication 800-37.
+
+## Responsibility
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control in an appropriate manner in their organization. This includes developing and updating plans of action and milestones (POAMs) based on vulnerabilities found in the implemented Mendix App and associated infrastructure to ensure compliance with federal requirements. The customer must ensure that POAM processes, timelines, and remediation tracking are documented, reviewed, and enforced within their environment.
+
+The Infra Implementer is responsible for addressing specific infrastructure vulnerabilities as dictated by the POAM process.
+
+The App Implementer is responsible for addressing specific application vulnerabilities as dictated by the POAM process.
+
+The Infra Operator is responsible for ongoing remediation of infrastructure vulnerabilities identified through the POAM process.
+
+The App Operator is responsible for ongoing remediation of application vulnerabilities identified through the POAM process.
+
+## Guidance
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-37 and OMB Memorandum 02-01, which establish requirements for developing and maintaining plans of action and milestones as part of the security authorization process. Customers operating within a FedRAMP or DoD SRG environment must ensure that POAMs are developed for all identified weaknesses and updated based on ongoing security assessments and continuous monitoring activities.
+
+Mendix, as a managed platform provider, maintains its own internal vulnerability remediation processes and responds to vulnerabilities in the Mendix Operator, Private Mendix Platform, Mendix Runtime, and Studio Pro through documented security advisories and timely release cycles. However, the development and maintenance of the customer's system-wide POAM remains a customer responsibility.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Develop and maintain POAMs.
+
+    The customer must develop and update plans of action and milestones based on vulnerabilities found in the implemented Mendix App and associated infrastructure. POAMs must document planned remedial actions, responsible parties, and target completion dates in accordance with NIST SP 800-37 and OMB reporting requirements.
+
+2. Assign remediation responsibilities.
+
+    The customer must assign specific vulnerability remediation tasks to the Infra Implementer, App Implementer, Infra Operator, and App Operator, as dictated by the POAM process. Each party must address vulnerabilities in the components they own within the regulation-required timeframes. The customer should also track Mendix security advisories and platform updates as part of the overall POAM process.
+
+3. Update POAMs based on continuous monitoring.
+
+    The customer must update existing POAMs at organization-defined frequencies based on findings from security control assessments, security impact analyses, and continuous monitoring activities per NIST SP 800-37 and CA-07 continuous monitoring requirements.
+
+## Proof and Remarks
+
+### Mendix Platform Vulnerability Response Process
+
+While CA-05 is fundamentally a customer responsibility (developing and maintaining the organization's POAM), the customer must track Mendix's own vulnerability remediation as a component of the broader POAM. Mendix maintains documented vulnerability response and release procedures.
+
+### Mendix Security Advisories and Release Notes
+
+Mendix publishes security advisories and release notes for the Mendix Operator, Private Mendix Platform, Mendix Runtime, and Studio Pro that document:
+
+* Vulnerability identification (CVE IDs, severity levels, affected components)
+* Remediation status and timelines (when a fix will be available)
+* Required upgrade paths (which versions include the fix)
+* Technical details (to support customer impact analysis)
+
+For more information, see:
+
+* [Security Advisories](/releasenotes/security-advisories/)
+* [Private Mendix Platform Release Notes](/releasenotes/private-platform/)
+
+### Integration into Customer POAMs
+
+The customer must integrate Mendix security advisory information into their POAM process by:
+
+* Monitoring Mendix security releases and advisories
+* Assessing impact to customer-developed Mendix apps and Private Mendi Platform deployments
+* Planning remediation (applying updates to Mendix platform components within required timeframes)
+* Tracking status (documenting when Mendix platform updates have been deployed and validated)
+
+### Scope Clarification
+
+The customer is responsible for developing, maintaining, and executing the overall POAM for the information system.
+
+Mendix is responsible for publishing timely security advisories and providing patched releases for Mendix platform components.
+
+Infrastructure and Application Implementers and Operators are responsible for implementing specific remedial actions within their respective domains as directed by the customer's POAM.
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm05.md b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm05.md
index f679c22c03a..f06ba810deb 100644
--- a/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm05.md
+++ b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm05.md
@@ -61,6 +61,6 @@ To meet these requirements, the customer must carry out the following actions:
 
     The customer must ensure that both physical and logical access controls are in place for change management, including workflow automation, role-based access to deployment pipelines, and media library restrictions. The Infra Implementer, App Implementer, Infra Operator, and App Operator must respect the customer's change control restrictions throughout the system lifecycle per NIST SP 800-128.
 
-Maintain change access records and audit trails.
+3. Maintain change access records and audit trails.
 
     The customer must maintain records of all access granted for change purposes and periodically review these records to detect unauthorized changes. This includes implementing audit logging for all configuration change activities, conducting regular reviews of change access permissions, and enforcing separation of duties as required by PE-03 physical protection requirements.
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm0505.md b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm0505.md
new file mode 100644
index 00000000000..80f1897c864
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm0505.md
@@ -0,0 +1,135 @@
+---
+title: "CM-05 (05) Access Restrictions for Change - Limit Production or Operational Changes"
+linktitle: "CM-05 (05)"
+url: /private-mendix-platform/nist-controls/cm-0505/
+description: "Documents the Private Mendix Platform's compliance with the CM-05 (05) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CM-05 (05) control.
+
+| Control ID | CM-05 (05) |
+| --- | --- |
+| Control category | CM - Configuration Management |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization: 
+* Limits privileges to change information system components and system-related information within a production or operational environment.
+* Reviews and reevaluates privileges at an organization-defined frequency. 
+
+### Supplemental Guidance
+
+In many organizations, information systems support multiple core missions or business functions. Limiting privileges to change information system components with respect to operational systems is necessary because changes to a particular information system component may have far-reaching effects on mission or business processes supported by the system where the component resides. The complex, many-to-many relationships between systems and mission or business processes are in some cases, unknown to developers.
+
+The following controls are related to this control:
+
+* AC-02
+
+## Responsibility
+
+### Mendix Responsibility
+
+Mendix is responsible for implementing and maintaining this control at the platform level.
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control in an appropriate manner in their organization. This includes deciding what users and roles are allowed to change components within the system in production or operational environments, and performing timely reevaluations to ensure compliance with federal requirements. The customer must ensure that production change privileges, access reviews, and reevaluation schedules are documented, reviewed, and enforced within their environment.
+
+The Infra Implementer is responsible for ensuring that infrastructure changes to production and operational environments are properly restricted.
+
+The Infra Operator is responsible for ensuring that production and operational environment change controls remain current throughout the lifecycle of the system.
+
+## Guidance
+
+### Mendix Responsibility
+
+Private Mendix Platform allows the restriction of production environment deployments to specific users and/or roles. The platform's role-based access control system enables organizations to define which users can deploy to production environments, modify system configurations, and manage platform settings. Access restrictions are enforced through integration with the customer's Identity Provider supporting dynamic role mapping that honors the customer's access control policies.
+
+To configure this control, perform the following steps:
+
+1. Configure production deployment restrictions. 
+
+    Configure the Private Mendix Platform to restrict production environment deployments to specific authorized users and roles, ensuring that only approved personnel can deploy changes to operational environments.
+
+2. Implement role-based production access.
+
+    Use the platform's role-based security model to define and enforce granular privileges for production environment operations, including deployment, configuration changes, and data management activities.
+
+3. Enable production access auditing. 
+
+    Configure audit logging for all production environment access and change activities, enabling the customer to review and reevaluate privileges at the required frequency.
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-53 Rev 4 and NIST SP 800-128, which establish requirements for limiting and reviewing privileges to change information system components in production environments. Customers operating within a FedRAMP or DoD SRG environment must ensure that production change privileges are limited to authorized personnel and regularly reevaluated.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Define production change privilege policies.
+
+    The customer must decide what users and roles are allowed to change components within the system in production or operational environments. This includes defining separation of duties between development and production access, and establishing approval workflows for production changes in accordance with NIST SP 800-53 AC-2 and AC-6 least privilege principles.
+
+2. Ensure infrastructure production access restrictions.
+
+    The Infra Implementer must ensure that infrastructure changes to production and operational environments are properly restricted based on the customer's policies. The Infra Operator must ensure that production and operational environment change controls remain current throughout the lifecycle of the system, including when infrastructure components are added or modified.
+
+3. Perform regular privilege reevaluations.
+
+    The customer must review and reevaluate production change privileges at organization-defined frequencies to ensure that only currently authorized personnel retain the ability to make production changes. This includes removing privileges for personnel who have changed roles or left the organization, per NIST SP 800-53 AC-2 account management requirements.
+
+#### Infra Implementer
+
+The Infra Implementer is responsible for ensuring that infrastructure changes to production and operational environments are properly restricted. This includes configuring access controls on infrastructure management tools, deployment pipelines, and cloud service consoles to limit who can make production changes.
+
+The Infra Implementer must perform the following tasks:
+
+1. Implement infrastructure production access controls.
+
+    Configure access controls on all infrastructure management interfaces (cloud consoles, CLI tools, deployment pipelines) to restrict production environment changes to authorized users and roles only.
+
+2. Enforce separation of duties. 
+
+    Implement separation of duties between infrastructure development, testing and production operations, ensuring that infrastructure changes must go through formal approval before being applied to production.
+
+3. Configure infrastructure access auditing.
+
+    Enable comprehensive logging of all infrastructure access and change activities in production environments to support privilege reevaluation and compliance auditing.
+
+#### Infra Operator
+
+The Infra Operator is responsible for ensuring that production and operational environment change controls remain current and effective throughout the lifecycle of the system, including as infrastructure evolves and personnel changes occur.
+
+The Infra Operator must perform the following tasks:
+
+1. Maintain production access controls. 
+
+    Continuously review and update infrastructure production access controls as the system evolves, ensuring that access restrictions remain aligned with the customer's policies.
+
+2. Support privilege reevaluations. 
+
+    Provide regular reports on infrastructure production access privileges to the customer to support scheduled privilege reevaluations.
+
+3. Respond to access control changes. 
+
+    Promptly implement changes to production access privileges as directed by the customer, including revoking access for personnel who no longer require production access.
+
+## Proof and Remarks
+
+In Private Mendix Platform, different roles have different access rights. Only some roles can access resources such as making changes to related information within a production or operational environment.
+
+{{< figure src="/attachments/private-platform/nist-cm/nist-cm-0505-1.png" class="no-border" >}}
+
+For example, users with the Build Approval role can approve pipelines, and start or stop apps. However, they cannot create packages or change constant variables.
+
+{{< figure src="/attachments/private-platform/nist-cm/nist-cm-0505-2.png" class="no-border" >}}
+
+Users with the Contributor role can only contribute to the app, but they cannot access the deployment.
+
+{{< figure src="/attachments/private-platform/nist-cm/nist-cm-0505-3.png" class="no-border" >}}
+
+For more information, see [Dynamic Role Management in Private Mendix Platform](/private-mendix-platform/dynamic-role-management/).
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm0801.md b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm0801.md
new file mode 100644
index 00000000000..a84cd8a0870
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm0801.md
@@ -0,0 +1,93 @@
+---
+title: "CM-08 (01) - Information System Component Inventory (Updates During Installations or Removals)"
+linktitle: "CM-08 (01)"
+url: /private-mendix-platform/nist-controls/cm-0801/
+description: "Documents the Private Mendix Platform's compliance with the CM-08 (01) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CM-08 (01) control.
+
+| Control ID | CM-08 (01) |
+| --- | --- |
+| Control category | CM - Configuration Management |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.
+
+## Responsibility
+
+### Mendix Responsibility
+
+Mendix provides component inventory documentation for Mendix Runtime, Mendix Operator, Studio Pro, and Private Mendix Platform. With each new version release, Mendix updates this documentation to clearly identify all components, versions, and dependencies in that release. This allows customers to reference accurate component information when they perform installations, removals, or updates of Mendix products.
+
+### Customer Responsibility
+
+Inventory updates must be executed concurrently with component installations, removals, or system updates.
+
+The customer is responsible for establishing the processes and controls necessary to enable this capability, including the assignment of the following roles:
+
+* The Infra Implementer must supply the complete infrastructure component list.
+* The App Implementer must supply the complete Mendix application component list.
+* The Infra Operator must maintain the infrastructure list and apply updates whenever changes occur, including patching, upgrades, and maintenance activities.
+* The App Operator must maintain the Mendix application list and apply updates immediately upon deployment, modification, or decommission of any application component.
+
+Additionally, the customer must define the required level of granularity for the component inventory and establish the frequency of inventory reviews.
+
+## Guidance
+
+### Mendix Responsibility
+
+Mendix provides and maintains detailed component inventory documentation for the Mendix Runtime, Mendix Operator, Studio Pro, and Private Mendix Platform, and updates this documentation with each new version release.
+
+### Customer Responsibility
+
+To meet this control requirement, the customer should follow the guidance below.
+
+#### Integrate Inventory Updates into Change Management
+
+Every change request or ticket for an installation, removal, or update must include an inventory update as a required step before the ticket can be closed. Do not allow operational changes to be completed without verifying that the inventory accurately reflects the change.
+
+#### Define Synchronous Workflows
+
+Establish clear workflows for each type of change. For any installation, removal, or update, the inventory must be updated immediately after the change is completed and before the change ticket is closed. Accuracy of the updated inventory should be verified as part of the same workflow.
+
+#### Assign Clear Roles
+
+Ensure the following roles understand their inventory update obligations:
+
+* Infra Implementer - Responsible for providing a full system component list of the infrastructure.
+* App Implementer - Responsible for providing a full component list for the Mendix app.
+* Infra Operator - Responsible for updating infrastructure inventory during patching, upgrades, and maintenance activities.
+* App Operator - Responsible for updating Mendix application inventory during app deployments, updates, and removals.
+
+#### Leverage Mendix Documentation for Update Events
+
+When performing a Mendix platform update, the customer should:
+
+* Obtain the SBOM and release documentation for the new version from Mendix.
+* Compare it against the previous version to identify what has changed (new components, version bumps, removed components).
+* Update the customer's asset inventory to reflect these changes at the time the platform update is deployed.
+
+## Proof and Remarks
+
+[Conveyor](https://app.conveyor.com/profile/mendix) includes the following portals:
+
+* [Mendix Operator](https://app.conveyor.com/profile/mendix/d/mendix-operator/cwqIsc)
+* [PMP Portal SBOM](https://app.conveyor.com/profile/mendix/d/pmp-portal-sbom/87vRAn)
+* [Runtime](https://app.conveyor.com/profile/mendix/d/runtime/hiMac4)
+* [Studio Pro Components](https://app.conveyor.com/profile/mendix/d/studio-pro-components/98TuRq)
+
+{{< figure src="/attachments/private-platform/nist-cm/nist-cm-0801-1.png" class="no-border" >}}
+
+For more information, refer to the following:
+
+* [Mendix on Kubernetes Release Notes](/releasenotes/developer-portal/mendix-for-private-cloud/)
+* [LTS, MTS, and Monthly Releases](/releasenotes/studio-pro/lts-mts/)
+* [Private Mendix Platform Release Notes](/releasenotes/private-platform/)
+* [SBOM Generation](/refguide/sbom-generation/)
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05-1126.md b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05-1126.md
deleted file mode 100644
index c32b932fe88..00000000000
--- a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05-1126.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: "IA-05 1126 Sensitive Data in Installer"
-linktitle: "IA-05 1126"
-url: /private-mendix-platform/nist-controls/ia-05-1126/
-description: "Documents the Private Mendix Platform's compliance with the IA-05 1126 control of the NIST 800-53 framework."
-weight: 20
----
-
-## Introduction
-
-This document describes how Private Mendix Platform fulfills the IA-05 1126 control.
-
-| Control ID | IA-05 1126 |
-| --- | --- |
-| Control category | IA -  Identification and Authentication |
-| Requirement baseline | FEDRAMP MODERATE |
-| Responsibility and ownership | Mendix - Private Mendix Platform, Customer - Org |
-
-## Control
-
-The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.
-
-### Supplemental Guidance
-
-Organizations exercise caution in determining whether embedded or stored authenticators are in encrypted or unencrypted form. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators. This is independent of whether that representation is perhaps an encrypted version of something else (for example, a password).
-
-## Responsibility
-
-### Mendix Responsibility
-
-Private Mendix Platform installation supports retrieving environment-sensitive data from external secret storage (AWS secrets manager, Key Vault, and so on).
-
-### Customer Responsibility
-
-The customer must set up the external secret manager and properly configure the corresponding secrets.
-
-## Guidance
-
-### Customer Responsibility
-
-Customer must implement an external secrets store to manage sensitive data.
-
-1. Set up and configure the secret storage provider, for example, HashiCorp Vault, AWS Secret Manager or Azure Key Vault.
-2. Install and configure a Kubernetes Secrets Store CSI driver, for example, AWS Secrets Manager CSI Secrets Store. This driver is installed globally for the entire cluster.
-3. Configure keys at external secret manager.
-4. When installing Private Mendix Platform with the Installer, select **Use Secret Provider** for the storage plan and database plan.
-
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051126-1.png" class="no-border" >}}
-
-## Proof and Remarks
-
-Selecting **AWS** as the secret provider:
-
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051126-2.png" class="no-border" >}}
-
-Selecting **Azure Key Vault** as the secret provider:
-
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051126-3.png" class="no-border" >}}
-
-Selecting **HashiCorp Vault** as the secret provider:
-
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051126-4.png" class="no-border" >}}
diff --git a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05-1127.md b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05.md
similarity index 54%
rename from content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05-1127.md
rename to content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05.md
index cac0218d5bc..bccbedbb4fd 100644
--- a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05-1127.md
+++ b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia05.md
@@ -1,24 +1,24 @@
 ---
-title: "IA-05 1127 Idle session timeout and Configurable Time Limits"
-linktitle: "IA-05 1127"
-url: /private-mendix-platform/nist-controls/ia-05-1127/
-description: "Documents the Private Mendix Platform's compliance with the IA-05 1127 control of the NIST 800-53 framework."
+title: "IA-05 Implement an Idle Session Timeout, Make Time Limit Configurable"
+linktitle: "IA-05"
+url: /private-mendix-platform/nist-controls/ia-05/
+description: "Documents the Private Mendix Platform's compliance with the IA-05 control of the NIST 800-53 framework."
 weight: 20
 ---
 
 ## Introduction
 
-This document describes how Private Mendix Platform fulfills the IA-05 1127 control.
+This document describes how Private Mendix Platform fulfills the IA-05 control.
 
-| Control ID | IA-05 1127 |
+| Control ID | IA-05 |
 | --- | --- |
 | Control category | IA -  Identification and Authentication |
 | Requirement baseline | FEDRAMP MODERATE |
 | Responsibility and ownership | Mendix - Private Mendix Platform, Customer - Org |
 
-## Control {#control}
+## Control
 
-The information system prohibits the use of cached authenticators after an organization-defined time period.
+The information system prohibits the use of cached authenticators after and organization-defined time period.
 
 ## Responsibility
 
@@ -30,32 +30,30 @@ The customer is responsible for correctly configuring the settings to enable thi
 
 ### Customer Responsibility
 
-The customer must configure this feature by performing the following steps:
+The customer must configure this feature by performing the following actions in Private Mendix Platform:
 
-1. Log in to Private Mendix Platform as a user with the System Admin role.
+1. Log in as a user with the System Admin role.
 2. Go to **Settings > Identity & Access Settings**.
-3. In the **Idle Detect** section, enable the **Detect User Idle**.
+3. In the **Idle Detect** section, toggle **Detect User Idle** to **On**.
 
-    After this option is enabled, the following settings appear:
+    {{< figure src="/attachments/private-platform/nist-ia/nist-ia-05-1.png" class="no-border" >}}
+
+4. After enabling the option, configure the following additional settings:
 
     * **Maximum duration before session lock** - Enter a value to define how long a user can stay idle before the session is locked.
     * **Require PIN to unlock** - Choose whether a PIN is required to unlock the screen after it is locked due to inactivity. If enabled, users must set a PIN in their profile settings.
     * **Idle length for logout** - Enter a value to define how long a user can stay idle before being logged out.
 
-## Proof and Remarks
-
-The Private Mendix Platform admin enables the feature:
+5. Click **Save**.
 
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051127-1.png" class="no-border" >}}
-
-Private Mendix Platform will now detect the user being idle on the page: 
+## Proof and Remarks
 
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051127-2.png" class="no-border" >}}
+After the admin has enabled the feature and saved the configuration, Private Mendix Platform will detect users being idle. 
 
-After the specified interval, the screen is locked, and the user must click the **Unlock** button to restore the screen. If **Require PIN to unlock** is enabled, the user must also input their PIN.
+After the specified interval of idling, the screen will be locked, and the user will need to click **Unlock** to unlock it. If **Require PIN to unlock** is enabled, the user will also need to input their PIN.
 
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051127-3.png" class="no-border" >}}
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-05-3.png" class="no-border" >}}
 
-If the user remains idle after the screen is locked, after the specified interval, the user is logged out.
+If the user remains idle after the screen is locked, after the specified interval, the user will be logged out.
 
-{{< figure src="/attachments/private-platform/nist-ia/nist-ia-051127-4.png" class="no-border" >}}
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-05-4.png" class="no-border" >}}
diff --git a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0511.md b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0511.md
new file mode 100644
index 00000000000..f7c1a5430db
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0511.md
@@ -0,0 +1,67 @@
+---
+title: "IA-05 (11) Hardware Token-Based Authentication"
+linktitle: "IA-05 (11)"
+url: /private-mendix-platform/nist-controls/ia-0511/
+description: "Documents the Private Mendix Platform's compliance with the IA-05 (11) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the IA-05 (11) control.
+
+| Control ID | IA-05 (11) |
+| --- | --- |
+| Control category | IA -  Identification and Authentication |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Customer - Infra |
+
+## Control
+
+The information system, for hardware token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.
+
+### Supplemental Guidance
+
+Hardware token-based authentication typically refers to the use of PKI-based tokens, such as the U.S. Government Personal Identity Verification (PIV) card. Organizations define specific requirements for tokens, such as working with a particular PKI.
+
+## Responsibility
+
+### Mendix Responsibility
+
+The Mendix Runtime and the Private Mendix Platform provide configuration settings to leverage the customer's identity provider (IdP) and hardware token infrastructure to enable hardware token-based authentication.
+
+### Customer Responsibility
+
+The customer is responsible for ensuring that their identity provider (IdP) and hardware token-based authentication system meet required security and token quality standards, as well as maintaining proper integration and ongoing compliance across the infrastructure and applications.
+
+## Guidance
+
+### Mendix Responsibility
+
+The Mendix Runtime and Private Mendix Platform leverage the customer's identity provider (IdP) and hardware token-based system in order to provide hardware token-based authentication. 
+
+### Customer Responsibility
+
+It is the responsibility of the customer to ensure that their IdP and hardware token-based authentication system meets their token quality requirements.
+
+It is the responsibility of the Infra Implementer to integrate the infrastructure and Private Mendix Platform into the customer's IdP and hardware token-based system.
+
+It is the responsibility of the App Implementer to integrate the Mendix App into the customer's IdP and hardware token-based system.
+
+It is the responsibility of the Infra Operator and App Operator to ensure ongoing integration and compliance.
+
+## Proof and Remarks
+
+For more information about identity and access, see [Private Mendix Platform Functionalities - System Administrators](/private-mendix-platform/reference-guide/admin/system/#identity--access).
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0511-1.png" class="no-border" >}}
+
+IdP OICD configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-1.png" class="no-border" >}}
+
+IdP SAML configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-3.png" class="no-border" >}}
+
+For more information about hardware token-based authentication IdP bonding, see [What is Microsoft Entra certificate-based authentication?](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-certificate-based-authentication).
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia07.md b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia07.md
index 35c558e4ecd..c04b6f4ca1e 100644
--- a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia07.md
+++ b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia07.md
@@ -35,7 +35,7 @@ For more information, refer to the FIPS Publication 140, and [Cryptographic Modu
 
 ### Mendix Responsibility
 
-The Mendix Runtime and Private Mendix Platform need to allow integrate with the customer’s identity Provider (IdP) to help meet cryptographic module compliance requirements, such as FIPS 140.
+The Mendix Runtime and Private Mendix Platform need to allow integrate with the customer's identity Provider (IdP) to help meet cryptographic module compliance requirements, such as FIPS 140.
 
 ### Customer Responsibility
 
diff --git a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia08.md b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia08.md
new file mode 100644
index 00000000000..18d3fde73b0
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia08.md
@@ -0,0 +1,97 @@
+---
+title: "IA-08 Identification And Authentication (Non-Organizational Users)"
+linktitle: "IA-08"
+url: /private-mendix-platform/nist-controls/ia-08/
+description: "Documents the Private Mendix Platform's compliance with the IA-08 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the IA-08 control.
+
+| Control ID | IA-08 |
+| --- | --- |
+| Control category | IA -  Identification and Authentication |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Customer - Infra |
+
+## Control
+
+The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
+
+### Supplemental Guidance
+
+Non-organizational users include information system users other than organizational users explicitly covered by IA-02. These individuals are uniquely identified and authenticated for accesses other than those accesses explicitly identified and documented in AC-14. 
+
+In accordance with the E-Authentication E-Government initiative, authentication of non-organizational users accessing federal information systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations use risk assessments to determine authentication needs and consider scalability, practicality, and security in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk. IA-02 addresses identification and authentication requirements for access to information systems by organizational users.
+
+The following controls are related to this control:
+
+* AC-2
+* AC-14
+* AC-17
+* AC-18
+* IA-2
+* IA-4
+* IA-5
+* MA-4
+* RA-3
+* SA-12
+* SC-8
+
+For more information, refer to the following:
+
+* OMB Memoranda 04-04, 11-11, 10-06-2011
+* FICAM Roadmap and Implementation Guidance
+* FIPS Publication 201; NIST Special Publications 800-63, 800-116
+* National Strategy for Trusted Identities in Cyberspace
+* Web: [IDManagement](http://idmanagement.gov)
+
+## Responsibility
+
+### Mendix Responsibility
+
+The Mendix Runtime and Private Mendix Platform allow authorized non-organizational users to authenticate and log in through the customer's identity provider (IdP).
+
+### Customer Responsibility
+
+The customer is responsible for selecting an IdP that securely authenticates and identifies non-organizational users and for defining the permissions those users are allowed.
+
+## Guidance
+
+### Mendix Responsibility
+
+The Mendix Runtime and Private Mendix Platform allow for authorized non-organizational users to log in through the Customers identity provider (IdP).
+
+### Customer Responsibility
+
+It is the customer's responsibility to choose an IdP that allows for secure login and identification of non-organizational users.
+
+It is the responsibility of the Infra Implementer to integrate the customer's IdP with the infrastructure and Private Mendix Platform as well as ensure that non-organizational users only have the allowed permissions within the infrastructure and Private Mendix Platform.
+
+It is the responsibility of the App Implementer to integrate the customer's IdP into the Mendix app, as well as ensuring non-organizational users have the appropriate permissions (if any) within the Mendix app.
+
+It is the responsibility of the Infra Operator and the App Operator to ensure that the customer's IdP remains properly integrated and identifying non-organizational users, as well as ensuring that non-organizational users only have the permissions they are allowed as dictated by the customer.
+
+## Proof and Remarks
+
+For more information about identity and access, see [Private Mendix Platform Functionalities - System Administrators](/private-mendix-platform/reference-guide/admin/system/#identity--access).
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0511-1.png" class="no-border" >}}
+
+IdP OICD configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-1.png" class="no-border" >}}
+
+OICD client configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-2.png" class="no-border" >}}
+
+IdP SAML configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-3.png" class="no-border" >}}
+
+SAML client configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-4.png" class="no-border" >}}
diff --git a/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0801.md b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0801.md
new file mode 100644
index 00000000000..6ebbf73001c
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/ia/pmp-nist-ia0801.md
@@ -0,0 +1,69 @@
+---
+title: "IA-08 (01) Acceptance Of PIV Credentials from Other Agencies"
+linktitle: "IA-08 (01)"
+url: /private-mendix-platform/nist-controls/ia-0801/
+description: "Documents the Private Mendix Platform's compliance with the IA-08 (01) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the IA-08 (01) control.
+
+| Control ID | IA-08 (01) |
+| --- | --- |
+| Control category | IA -  Identification and Authentication |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Customer - Infra |
+
+## Control
+
+The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.
+
+### Supplemental Guidance
+
+This control enhancement applies to logical access control systems (LACS) and physical access control systems (PACS). Personal Identity Verification (PIV) credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. OMB Memorandum 11-11 requires federal agencies to continue implementing the requirements specified in HSPD-12 to enable agency-wide use of PIV credentials. Related controls: AU-2, PE-3, SA-4.
+
+The following controls are related to this control:
+
+* AU-02
+* PE-03
+* SA-04
+
+## Responsibility
+
+### Mendix Responsibility
+
+The Private Mendix Platform ensures proper integration with the customer's Identity Provider (IdP) is implemented and maintained to enable user authentication.
+
+### Customer Responsibility
+
+The customer is responsible for ensuring that the IdP supports PIV credentials from other federal agencies and for defining how it should be integrated with the infrastructure and varioius Mendix apps.
+
+## Guidance
+
+### Mendix Responsibility
+
+The Private Mendix Platform provides and maintains proper integration with the customer's Identity Provider (IdP) to support authentication of users.
+
+### Customer Responsibility
+
+It is the responsibility of the Infra Implementer to ensure the IdP supports PIV credentials from other federal agencies as directed by the customer.
+
+It is the responsibility of the App Implementer to ensure the Mendix App is properly integrated with the customer's IdP.
+
+It is the responsibility of the Infra Operator and App Operator to ensure ongoing compliance and proper integration with the customer's IdP.
+
+## Proof and Remarks
+
+For more information about identity and access, see [Private Mendix Platform Functionalities - System Administrators](/private-mendix-platform/reference-guide/admin/system/#identity--access).
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-0511-1.png" class="no-border" >}}
+
+IdP OICD configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-1.png" class="no-border" >}}
+
+IdP SAML configuration in Private Mendix Platform:
+
+{{< figure src="/attachments/private-platform/nist-ia/nist-ia-08-3.png" class="no-border" >}}
diff --git a/content/en/docs/private-platform/nist-controls/ir/pmp-nist-ir06.md b/content/en/docs/private-platform/nist-controls/ir/pmp-nist-ir06.md
new file mode 100644
index 00000000000..4204f520591
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/ir/pmp-nist-ir06.md
@@ -0,0 +1,64 @@
+---
+title: "IR-06 Incident Reporting"
+linktitle: "IR-06"
+url: /private-mendix-platform/nist-controls/ir-06/
+description: "Documents the Private Mendix Platform's compliance with the IR-06 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the IR-06 control.
+
+| Control ID | IR-06 |
+| --- | --- |
+| Control category | IR - Incident Response |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Customer - Infra |
+
+## Control
+
+The organization:
+
+* Requires personnel to report suspected security incidents to the organizational incident response capability within an organization-defined time period.
+* Reports security incident information to organization-defined authorities.
+
+### Supplemental Guidance
+
+The intent of this control is to address both specific incident reporting requirements within an organization and the formal incident reporting requirements for federal agencies and their subordinate organizations. Suspected security incidents include, for example, the receipt of suspicious email communications that can potentially contain malicious code. 
+
+The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Current federal policy requires that all federal agencies (unless specifically exempted from such requirements) report security incidents to the United States Computer Emergency Readiness Team (US-CERT) within specified time frames designated in the US-CERT Concept of Operations for Federal Cyber Security Incident Handling.
+
+The following controls are related to this control:
+
+* IR-04
+* IR-05
+* IR-08
+
+For more information, refer to the NIST Special Publication 800-61, and the [Cybersecurity and Infrastructure Security Agency](https://www.cisa.gov/) webpage.
+
+## Responsibility
+
+### Mendix Responsibility
+
+Mendix is responsible for monitoring, reporting, and responding to security incidents and vulnerabilities in the Mendix Runtime, Mendix Operator, Private Mendix Platform and Studio Pro, following applicable U.S. government regulations and adhering to the Mendix security incident management processes.
+
+### Customer Responsibility
+
+The customer is responsible for ensuring that security incidents and vulnerabilities within their scope are properly reported and addressed.
+
+## Guidance
+
+### Mendix Responsibility
+
+Mendix reports and responds to security incidents and vulnerabilities within the Mendix Runtime, Mendix Operator, Private Mendix Platform and Studio Pro in accordance with applicable U.S. government regulations and aligned with the Mendix security incident management processes.
+
+### Customer Responsibility
+
+It is the responsibility of the Customer, Infra Implementer, App Implementer, Infra Operator, and App Operator to report and respond to security incidents and vulnerabilities within their scope of work and responsibility.
+
+## Proof and Remarks
+
+Mendix meets or exceeds US Federal Regulations around CVE remediation times. See our Vulnerability Management policy in [Conveyor](https://app.conveyor.com/profile/mendix) for more information.
+
+{{< figure src="/attachments/private-platform/nist-ir/nist-ir-06-1.png" class="no-border" >}}
\ No newline at end of file
diff --git a/static/attachments/private-platform/nist-ac/nist-ac-06-1.png b/static/attachments/private-platform/nist-ac/nist-ac-06-1.png
new file mode 100644
index 00000000000..328b46dc9e0
Binary files /dev/null and b/static/attachments/private-platform/nist-ac/nist-ac-06-1.png differ
diff --git a/static/attachments/private-platform/nist-ac/nist-ac-06-2.png b/static/attachments/private-platform/nist-ac/nist-ac-06-2.png
new file mode 100644
index 00000000000..5217fc7d9f4
Binary files /dev/null and b/static/attachments/private-platform/nist-ac/nist-ac-06-2.png differ
diff --git a/static/attachments/private-platform/nist-ac/nist-ac-06-3.png b/static/attachments/private-platform/nist-ac/nist-ac-06-3.png
new file mode 100644
index 00000000000..f0760231115
Binary files /dev/null and b/static/attachments/private-platform/nist-ac/nist-ac-06-3.png differ
diff --git a/static/attachments/private-platform/nist-ac/nist-ac-06-4.png b/static/attachments/private-platform/nist-ac/nist-ac-06-4.png
new file mode 100644
index 00000000000..74299e2abe7
Binary files /dev/null and b/static/attachments/private-platform/nist-ac/nist-ac-06-4.png differ
diff --git a/static/attachments/private-platform/nist-ac/nist-ac-06-5.png b/static/attachments/private-platform/nist-ac/nist-ac-06-5.png
new file mode 100644
index 00000000000..7462542a942
Binary files /dev/null and b/static/attachments/private-platform/nist-ac/nist-ac-06-5.png differ
diff --git a/static/attachments/private-platform/nist-cm/nist-cm-0505-1.png b/static/attachments/private-platform/nist-cm/nist-cm-0505-1.png
new file mode 100644
index 00000000000..ec1842c9c49
Binary files /dev/null and b/static/attachments/private-platform/nist-cm/nist-cm-0505-1.png differ
diff --git a/static/attachments/private-platform/nist-cm/nist-cm-0505-2.png b/static/attachments/private-platform/nist-cm/nist-cm-0505-2.png
new file mode 100644
index 00000000000..aef358961bd
Binary files /dev/null and b/static/attachments/private-platform/nist-cm/nist-cm-0505-2.png differ
diff --git a/static/attachments/private-platform/nist-cm/nist-cm-0505-3.png b/static/attachments/private-platform/nist-cm/nist-cm-0505-3.png
new file mode 100644
index 00000000000..3aa32f79cbf
Binary files /dev/null and b/static/attachments/private-platform/nist-cm/nist-cm-0505-3.png differ
diff --git a/static/attachments/private-platform/nist-cm/nist-cm-0801-1.png b/static/attachments/private-platform/nist-cm/nist-cm-0801-1.png
new file mode 100644
index 00000000000..1410b8d78dd
Binary files /dev/null and b/static/attachments/private-platform/nist-cm/nist-cm-0801-1.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-05-1.png b/static/attachments/private-platform/nist-ia/nist-ia-05-1.png
index 49a8b3a43ec..b2015f4a093 100644
Binary files a/static/attachments/private-platform/nist-ia/nist-ia-05-1.png and b/static/attachments/private-platform/nist-ia/nist-ia-05-1.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-05-2.png b/static/attachments/private-platform/nist-ia/nist-ia-05-2.png
new file mode 100644
index 00000000000..5006852bc2d
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-05-2.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-05-3.png b/static/attachments/private-platform/nist-ia/nist-ia-05-3.png
new file mode 100644
index 00000000000..4a053f4c76e
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-05-3.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-05-4.png b/static/attachments/private-platform/nist-ia/nist-ia-05-4.png
new file mode 100644
index 00000000000..7efcd0a055a
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-05-4.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-08-1.png b/static/attachments/private-platform/nist-ia/nist-ia-08-1.png
new file mode 100644
index 00000000000..a172eebeb0c
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-08-1.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-08-2.png b/static/attachments/private-platform/nist-ia/nist-ia-08-2.png
new file mode 100644
index 00000000000..58b8484da46
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-08-2.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-08-3.png b/static/attachments/private-platform/nist-ia/nist-ia-08-3.png
new file mode 100644
index 00000000000..0c678c6dca8
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-08-3.png differ
diff --git a/static/attachments/private-platform/nist-ia/nist-ia-08-4.png b/static/attachments/private-platform/nist-ia/nist-ia-08-4.png
new file mode 100644
index 00000000000..18850d7e08c
Binary files /dev/null and b/static/attachments/private-platform/nist-ia/nist-ia-08-4.png differ
diff --git a/static/attachments/private-platform/nist-ir/nist-ir-06-1.png b/static/attachments/private-platform/nist-ir/nist-ir-06-1.png
new file mode 100644
index 00000000000..eb684565256
Binary files /dev/null and b/static/attachments/private-platform/nist-ir/nist-ir-06-1.png differ