Security, Compliance, and Governance
Security, Compliance, and Governance tests whether you can design identity, encryption, auditability, and evidence collection that satisfy auditors without blocking delivery.
Identity and least privilege
IBM Cloud IAM controls access through policies attached to access groups, service IDs, and trusted profiles. Scope policies to the resource group or specific resource. Use context-based restrictions to limit access by network zone. Human users should authenticate through federation, not shared API keys.
Protect data and prove it
Encrypt data at rest with Key Protect (BYOK) or Hyper Protect Crypto Services (customer-controlled keys). Use Secrets Manager for credentials. Enable Activity Tracker for audit events and VPC flow logs for network evidence. Security and Compliance Center evaluates resources against profiles and collects evidence.
Worked example
An auditor asks how production customer data is protected and who can administer it. Reasoning: show Key Protect keys with rotation, IAM access groups limited to the production resource group, context-based restrictions limiting admin access to the corporate network, Activity Tracker events retained, and SCC findings. Encryption at rest alone does not answer the access question.
Traps
Confusing authentication with authorization; granting account-wide administrator because scoping is tedious; assuming a provider certification covers your configuration; retaining audit logs for too short a period; treating compliance as a one-time project.