diff --git a/content/en/docs/private-platform/nist-controls/au/pmp-nist-au12.md b/content/en/docs/private-platform/nist-controls/au/pmp-nist-au12.md
new file mode 100644
index 00000000000..3343ef6a002
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/au/pmp-nist-au12.md
@@ -0,0 +1,225 @@
+---
+title: "AU-12 Audit Generation"
+linktitle: "AU-12"
+url: /private-mendix-platform/nist-controls/au-12/
+description: "Documents the Private Mendix Platform's compliance with the AU-12 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AU-12 control.
+
+| Control ID | AU-12 |
+| --- | --- |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra |
+
+## Control
+
+The information system:
+
+* Provides audit record generation capability for the auditable events defined in AU-2a at organization-defined information system components.
+* Allows organization-defined personnel or roles to select which auditable events are to be audited by specific components of the information system
+* Generates audit records for the events defined in AU-2 with the content defined in AU-3. 
+
+### Supplemental Guidance
+
+Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. 
+
+The following controls are related to this control:
+
+* [AC-03](/private-mendix-platform/nist-controls/ac-03/)
+* AU-02
+* AU-03
+* AU-06
+* AU-07
+
+## Responsibility
+
+### Mendix Responsibility
+
+Mendix is responsible for implementing and maintaining this control at the platform level.
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control in an appropriate manner in their organization. This includes defining which auditable events must be captured at the application and infrastructure levels to ensure compliance with federal requirements. The customer must ensure that audit generation policies, event selection criteria, and audit record content requirements are documented, reviewed, and enforced within their environment.
+
+#### Infra Implementer
+
+The Infra Implementer is responsible for configuring audit record generation capabilities at the infrastructure level as dictated by the customer.
+
+#### App Implementer
+
+The App Implementer is responsible for implementing audit record generation capabilities within the Mendix application as dictated by the customer.
+
+## Guidance
+
+### Mendix Responsibility
+
+For Private Mendix Platform, AU-12 is satisfied only in part at the platform layer. The Mendix Operator, Private Mendix Platform, and Mendix Runtime generate audit records for platform-level events such as operator actions, runtime activity, deployment operations, and platform configuration changes. Private Mendix Platform does not yet expose the full event-selection configurability contemplated by AU-12 for each platform component, which is why this control remains not fully satisfied. Application-specific audit logging for customer-developed Mendix apps is outside the scope of Private Mendix Platform itself and must be implemented by the customer and app implementer.
+
+The following configuration is required:
+
+1. Generate platform audit records by default.
+
+    Configure the Mendix Operator, Private Mendix Platform, and Mendix Runtime so platform-level events such as operator actions, deployment activities, and configuration changes are emitted consistently as audit-relevant logs.
+
+2. Provide log export integration points.
+
+    Ensure that Private Mendix Platform components can forward or expose their audit-relevant logs to the customer's centralized logging or SIEM destination so platform events can be retained, reviewed, and correlated with external records.
+
+3. Document platform audit coverage and gaps.
+
+    Clearly document which platform events Private Mendix Platform generates today and which event-selection capabilities are not yet configurable so customers can address the remaining AU-12 requirements at the infrastructure and application layers.
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-53 Rev 4 and NIST SP 800-92, which establish requirements for audit record generation and log management for federal information systems. Customers operating within a FedRAMP or DoD SRG environment must ensure that audit generation capabilities are configured across all system components and that auditable events are selected in accordance with organizational security policies.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Define auditable events and audit record content.
+
+    The customer must define which events must be audited at each system component level, including the content that each audit record must contain per AU-3. This includes specifying audit requirements for the Infra Implementer at the infrastructure level and for the App Implementer at the application level, in accordance with NIST SP 800-92 guidelines.
+
+2. Ensure infrastructure audit generation.
+
+    Direct the Infra Implementer to configure audit record generation capabilities at the infrastructure level, including operating system, network device, and cloud service audit logging. These capabilities must align with the events defined in AU-2 and the content requirements defined in AU-3.
+
+3. Ensure application audit generation.
+
+    Direct the App Implementer to implement audit record generation within the Mendix application using the Audit Trail module and custom logging mechanisms. The application must generate audit records for all customer-defined auditable events with the required content fields per NIST SP 800-53 AU-3.
+
+### Infra Implementer
+
+The Infra Implementer is responsible for configuring audit record generation capabilities at the infrastructure level. This includes enabling audit logging on operating systems, network devices, cloud services, and container platforms that support the Mendix application deployment. The Infra Implementer must ensure that infrastructure components can generate audit records for the events defined by the customer and that these records contain the content specified in AU-3.
+
+The Infra Implementer must perform the following tasks:
+
+1. Enable infrastructure audit logging.
+
+    Configure audit logging on all infrastructure components (operating systems, network devices, container platforms, cloud services) to generate audit records for the events defined by the Customer in accordance with AU-02.
+
+2. Configure audit record content.
+
+    Ensure all infrastructure audit records contain the required content fields as defined in AU-03, including event type, timestamp, source, outcome, and identity of the subject or object involved in the event.
+
+3. Implement audit log forwarding.
+
+    Configure infrastructure components to forward audit logs to the customer's centralized logging system, ensuring that audit records are available for correlation, analysis, and reporting.
+
+### App Implementer
+
+The App Implementer is responsible for implementing audit record generation within the Mendix application. This includes configuring the Audit Trail module or equivalent custom audit logging for application-specific events, and ensuring that audit records are directed to the appropriate logging infrastructure as dictated by the customer.
+
+This responsibility covers app behavior and business events inside customer-developed applications rather than Private Mendix Platform-level events.
+
+The App Implementer must perform the following tasks:
+
+1. Implement application audit logging.
+
+    Configure the Mendix Audit Trail module and implement custom audit logging within the application to capture all customer-defined auditable events at the application level.
+
+2. Define audit record content.
+
+    Ensure application-level audit records contain the required content fields per AU-3, including user identity, event type, timestamp, success or failure indication, and affected data objects.
+
+3. Configure audit log export.
+
+   Direct application audit logs to the customer's centralized logging infrastructure, ensuring that application-level audit records can be correlated with platform and infrastructure audit records.
+
+## Proof and Remarks
+
+Private Mendix Platform activity logs are available in the Admin interface at **Manage > PLATFORM > Activity Logs (/link/manage/activity-log)**.
+
+### Recent Logs (Platform-Level Audit Records)
+
+Private Mendix Platform records and displays platform-level audit events in real time. The **Recent Logs*** tab shows entries with the following structure:
+
+| Field | Example Value |
+| --- | --- |
+| Category | `Admin` |
+| Event Description | `The user USERNAME login` |
+| Timestamp | `04-29-2026 05:01:27.659 (UTC-04:00)` |
+
+Example event types include the following:
+
+* `The user USERNAME login` - User authentication events, timestamped to millisecond precision
+* `Updated Private Registry Password` - Administrative configuration change events
+
+The following filter capabilities are available:
+
+* Free-text keyword search across event descriptions
+* Time range presets: 
+
+    * **All**
+    * **Last 24 Hours**
+    * **Last 7 days**
+    * **Last 30 days**
+    * **Last 90 days**
+
+{{< figure src="/attachments/private-platform/nist-au/nist-au-12-1.png" class="no-border" >}}
+
+### Archived Logs (Automatic Daily Backup)
+
+Private Mendix Platform automatically archives platform audit logs on a daily schedule. The **Archived Logs** tab shows values like in the following example:
+
+| Archived Date | Archived Period | File Size |
+| --- | --- | --- |
+| `04-30-2026, 08:39:42` | `04-29-2026 > 04-30-2026` | `17.056 Kb` |
+| `04-14-2026, 08:09:34` | `04-13-2026 > 04-14-2026` | `3.764 Kb` |
+| `04-10-2026, 09:44:56` | `04-09-2026 > 04-10-2026` | `4.091 Kb` |
+| `04-04-2026, 08:16:10` | `04-03-2026 > 04-04-2026` | `6.396 Kb` |
+| `03-31-2026, 08:00:00` | `03-30-2026 > 03-31-2026` | `1.03 Kb` |
+
+Each archived file can be individually downloaded by a Private Mendix Platform Admin.
+
+{{< figure src="/attachments/private-platform/nist-au/nist-au-12-2.png" class="no-border" >}}
+
+### Log Settings (Configurable Retention and Timezone)
+
+The **Log Settings** tab exposes two admin-configurable parameters:
+
+| Setting | Options | Example Value |
+| --- | --- | --- |
+| Retention period for backup logs | 1,  30, 90, 180, 365 days | 1 day |
+| Timestamp timezone for display | Any IANA world timezone | (GMT-04:00) Santiago/America |
+
+{{< figure src="/attachments/private-platform/nist-au/nist-au-12-3.png" class="no-border" >}}
+
+### Create Custom Report (Export Capability)
+
+Private Mendix Platform provides an on-demand custom report export function accessible from the **Recent Logs** tab:
+
+| Setting | Options |
+| --- | --- |
+| Log level | Event; Summary (default); Complete |
+| Export format | PDF (default); Doc2007; JSON; XML |
+| Date range | Configurable start date and end date with time picker |
+
+This allows a Private Mendix Platform Admin to generate time-bounded audit reports in multiple formats for review, submission to auditors, or integration with external SIEM systems.
+
+{{< figure src="/attachments/private-platform/nist-au/nist-au-12-4.png" class="no-border" >}}
+
+### AU-12 Gap Analysis 
+
+Private Mendix Platform's compliance with AU-12 currently has the following gaps:
+
+* There is no per-component event selection.
+
+    AU-12(b) requires allowing authorized personnel to select which auditable events are captured by specific system components. Private Mendix Platform records a fixed set of platform-level administrative events and does not expose granular per-component event selection to administrators.
+
+* The AU-2 event list is not configurable at platform level. 
+
+    Private Mendix Platform does not implement the full AU-2 and AU-12 event catalog. The platform records a predefined list of events. There is no mechanism for an administrator to add or remove event types from the captured set.
+
+* Infrastructure-level audit generation is out of scope.
+
+    Infrastructure-level audit logging (OS, network, container runtime) is the responsibility of the Infra Implementer and is outside of Private Mendix Platform's scope.
+
+* Application-level audit generation is the customer's responsibility.
+
+    Audit logging for customer-developed Mendix apps is the responsibility of the customer and app Implementer using the Mendix Audit Trail module or custom instrumentation. Private Mendix Platform does not provide or aggregate application-layer events.
+
+The above evidence demonstrates that Private Mendix Platform satisfies a partial platform-scoped subset of AU-12 requirements. Full compliance requires coordinated implementation across Infra Implementer (infrastructure logs), and App Implementer along with the customer organization (application-level audit records).
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/au/pmp-nist-au1201.md b/content/en/docs/private-platform/nist-controls/au/pmp-nist-au1201.md
new file mode 100644
index 00000000000..2ad553d93f7
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/au/pmp-nist-au1201.md
@@ -0,0 +1,167 @@
+---
+title: "AU-12 (01) Audit Generation - System-Wide or Time-Correlated Audit Trail"
+linktitle: "AU-12 (01)"
+url: /private-mendix-platform/nist-controls/au-1201/
+description: "Documents the Private Mendix Platform's compliance with the AU-12 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the AU-12 (01) control.
+
+| Control ID | AU-12 (01) |
+| --- | --- |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra |
+
+## Control
+
+The information system compiles audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail. 
+
+### Supplemental Guidance
+
+Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.
+
+The following controls are related to this control:
+
+* AU-08
+* AU-12
+
+## Responsibility
+
+### Mendix Responsibility
+
+Mendix is responsible for implementing and maintaining this control at the platform level.
+
+### Customer Responsibility
+
+The customer is responsible for implementing this control in an appropriate manner in their organization. This includes defining which components must contribute to the system-wide audit trail and the acceptable time correlation tolerance to ensure compliance with federal requirements. The customer must ensure that audit trail compilation, time synchronization, and correlation requirements are documented, reviewed, and enforced within their environment.
+
+#### Infra Implementer
+
+The Infra Implementer is responsible for producing infrastructure audit logs at the right level and targeting those logs at the audit trail as dictated by the customer.
+
+#### App Implementer
+
+The App Implementer is responsible for creating custom audit logs as dictated by the customer and ensuring they can be targeted at the system-wide audit trail.
+
+## Guidance
+
+### Mendix Responsibility
+
+For Private Mendix Platform, this enhancement is implemented at the platform layer through timestamped activity logging, archival, and export capabilities. The logs are available through the Admin menu, at **Manage > Platform > Activity Logs**, platform events are recorded with millisecond precision timestamps and UTC offset, enabling reliable time ordering of platform records. 
+
+Private Mendix Platform also provides archived log files and custom report exports (including JSON/XML) that can be ingested into a customer SIEM for cross-component time correlation. Application-specific audit logs for customer-developed Mendix apps remain outside Private Mendix Platform's native scope and are implemented by the customer and app implementer.
+
+The following configuration is required:
+
+1. Enable platform audit collection and export.
+
+    Configure Private Mendix Platform and runtime log delivery so platform activity records can be exported or forwarded to the Customer's centralized audit trail or SIEM destination.
+
+2. Maintain time-correlated platform timestamps.
+
+    Ensure platform and runtime records use synchronized system time (as defined in AU-08), preserve timestamp precision, and retain timezone context so records can be reliably ordered and correlated.
+
+3. Configure retention, archive, and reporting controls.
+
+    Set log retention and timezone display settings in Private Mendix Platform Activity Log Settings, and operationalize archived log and custom report export workflows to support investigation and audit evidence generation.
+
+### Customer Responsibility
+
+This control is governed by NIST SP 800-53 Rev 4 and NIST SP 800-92, which establish requirements for compiling audit records into a time-correlated system-wide audit trail. Customers operating within a FedRAMP or DoD SRG environment must ensure that audit records from all system components can be compiled into a coherent, time-ordered audit trail within organizational tolerances.
+
+To meet these requirements, the customer must carry out the following actions:
+
+1. Define audit trail scope and time correlation tolerance.
+
+    The customer must define which components need to be audited, what depth of auditing is required, and where to put logs into a time-correlated audit trail. The acceptable tolerance for time correlation between individual audit records must be documented in accordance with NIST SP 800-53 AU-8 time stamp requirements.
+
+2. Direct infrastructure audit log compilation.
+
+    The Infra Implementer must produce infrastructure audit logs at the right level and target those logs at the audit trail as dictated by the customer. This includes configuring NTP synchronization across all infrastructure components to ensure time stamps are consistent within the defined tolerance per NIST SP 800-53 AU-8.
+
+3. Direct Application Audit Log Compilation.
+
+    The App Implementer must create custom audit logs as dictated by the customer, ensuring they can be targeted at the system-wide audit trail. Application-level audit records must include timestamps synchronized with the authoritative time source and formatted for correlation with infrastructure and platform records.
+
+### Infra Implementer
+
+The Infra Implementer is responsible for producing infrastructure audit logs at the appropriate level of detail and directing those logs to the system-wide audit trail as dictated by the Customer. This includes configuring time synchronization services, log aggregation, and log forwarding for all infrastructure components.
+
+The Infra Implementer must perform the following tasks:
+
+1. Configure time synchronization.
+
+    Implement NTP or PTP time synchronization across all infrastructure components to ensure audit record timestamps are within the customer's defined tolerance for time correlation.
+
+2. Enable infrastructure audit log forwarding.
+
+    Configure all infrastructure components (operating systems, network devices, container platforms, cloud services) to forward audit logs to the customer's centralized audit trail system.
+
+3. Validate time correlation.
+
+    Regularly verify that infrastructure audit record timestamps are within the defined tolerance and that log forwarding mechanisms are functioning correctly, ensuring uninterrupted contribution to the system-wide audit trail.
+
+### App Implementer
+
+The App Implementer is responsible for creating custom audit logs within Mendix applications as dictated by the Customer and ensuring these logs can be directed to the system-wide audit trail for time correlation with other system components.
+
+The App Implementer must perform the following tasks:
+
+1. Implement custom audit logging.
+
+    Use the Mendix Audit Trail module and custom microflows to create audit logs that capture all customer-defined auditable events within the application.
+
+2. Ensure timestamp accuracy.
+
+    Configure application audit logs to use the system's authoritative time source, ensuring timestamps are accurate and within the customer's defined tolerance for time correlation.
+
+3. Direct logs to audit trail.
+
+Configure the Mendix application to export audit logs to the customer's centralized audit trail system, ensuring application-level records can be correlated with platform and infrastructure records.
+
+## Proof and Remarks
+
+Private Mendix Platform activity logs are available in the Admin interface at **Manage > PLATFORM > Activity Logs (/link/manage/activity-log)**.
+
+### Time-Correlated Platform Records
+
+The **Recent Logs** tab shows platform records including the following:
+
+* Event operator (for example, Admin)
+* Event message (for example, `The user USERNAME login, Updated Private Registry Password`)
+* Timestamp with millisecond precision and UTC offset (for example, `04-29-2026 05:01:27.659 (UTC-04:00)`)
+
+These fields provide reliable time ordering for platform-level events and support AU-12(01) time-correlation intent.
+
+{{< figure src="/attachments/private-platform/nist-au/nist-au-12-1.png" class="no-border" >}}
+
+### Archive and Export Support for System-Wide Correlation
+
+In the **Archived Logs** tab, daily archived log artifacts with the archiving period and file size metadata are available and downloadable by administrators. In the **Create Custom Report** workflow, export options included PDF, Doc2007, JSON, and XML with configurable start and end date range.
+
+These capabilities allow Private Mendix Platform records to be exported and combined with infrastructure and application logs in an external enterprise log repository or SIEM to form a broader system-wide audit trail.
+
+### Log Configuration Controls
+
+The **Log Settings** tab exposes two admin-configurable parameters:
+
+| Setting | Options | Example Value |
+| --- | --- | --- |
+| Retention period for backup logs | 1,  30, 90, 180, 365 days | 1 day |
+| Timestamp timezone for display | Any IANA world timezone | (GMT-04:00) Santiago/America |
+
+These controls support operational consistency for audit analysis and time-correlation workflows.
+
+{{< figure src="/attachments/private-platform/nist-au/nist-au-12-3.png" class="no-border" >}}
+
+### Scope Clarification
+
+Private Mendix Platform provides the platform-layer contribution to AU-12 (01) and supports timestamp-based ordering and export. Full system-wide coverage across all components still requires the following:
+
+* The Infra Implementer must produce and forward infrastructure logs.
+* The App Implementer and customer must generate and forward application-level audit logs.
+
+With those integrations in place, IL4 AU-12 (01) can be met end-to-end across platform, infrastructure, and application components.
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm08.md b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm08.md
new file mode 100644
index 00000000000..175016b4dba
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/cm/pmp-nist-cm08.md
@@ -0,0 +1,159 @@
+---
+title: "CM-08 - Information System Component Inventory"
+linktitle: "CM-08"
+url: /private-mendix-platform/nist-controls/cm-08/
+description: "Documents the Private Mendix Platform's compliance with the CM-08 control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the CM-08 control.
+
+| Control ID | CM-08 |
+| --- | --- |
+| Control category | CM - Configuration Management |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization:
+* Develops and documents an inventory of information system components that:
+
+    * Accurately reflects the current information system.
+    * Includes all components within the authorization boundary of the information system.
+    * Is at the level of granularity deemed necessary for tracking and reporting.
+    * Includes organization-defined information deemed necessary to achieve effective information system component accountability.
+
+* Reviews and updates the information system component inventory at an organization-defined frequency.
+
+### Supplemental Guidance
+
+Organizations may choose to implement centralized information system component inventories that include components from all organizational information systems. In such situations, organizations ensure that the resulting inventories include system-specific information required for proper component accountability (for example, information system association, information system owner).
+
+Information deemed necessary for effective accountability of information system components includes, for example, hardware inventory specifications, software license information, software version numbers, component owners, and for networked components or devices, machine names and network addresses. Inventory specifications include, for example, manufacturer, device type, model, serial number, and physical location.
+
+The following controls are related to this control:
+* CM-02
+* CM-06
+* PM-05
+
+For more information, refer to NIST Special Publication 800-128.
+
+## Responsibility
+
+### Mendix Responsibility
+
+* Provide detailed documentation identifying the inventory of all components that are part of the following Mendix products:
+
+    * Mendix Runtime
+    * Mendix Operator
+    * Studio Pro
+    * Private Mendix Platform
+
+* Update the component inventory documentation with each new version release of the above products.
+
+### Customer Responsibility
+
+Customer must define inventory granularity and required component details , establish a review frequency, and coordinate with infrastructure and application implementers and operators to keep both infrastructure and Mendix app inventories accurate and up to date.  
+
+It is the responsibility of the Infra Implementer to provide a full system component list of the infrastructure, and the App Implementer to provide a full component list for the Mendix app.  
+
+It is the responsibility of the Infra Operator to keep the infrastructure list up to date, and the App Operator to keep the Mendix app list up to date.
+
+## Guidance
+
+### Mendix Responsibility
+
+Mendix formally documents and identifies all components included in:
+
+* Mendix Runtime
+* Mendix Operator
+* Studio Pro
+* Private Mendix Platform
+
+The documentation includes component names, versions, dependencies, and other information necessary for customers to maintain accountability over components within their authorization boundary.
+
+Whenever a new version of any of the above products is released, Mendix updates the corresponding component inventory documentation to reflect:
+
+* New components added
+* Version changes
+* Removed or deprecated components
+* Updated dependencies
+
+### Customer Responsibility
+
+To meet this control requirement, the customer should follow the guidance below.
+
+#### Define Inventory Requirements
+
+The customer must define the level of detail and granularity required for their information system component inventory to achieve effective component accountability. This includes determining the scope of components to be tracked (all components within the authorization boundary), the types of information to be captured for each component (such as hardware specifications, software versions, network addresses, and ownership), and the appropriate granularity for tracking and reporting needs. These requirements should be documented based on the customer's own risk, compliance, and operational context.
+
+#### Establish Review and Update Frequency
+
+The customer must establish how often the component inventory is reviewed and updated. The frequency may be continuous (real-time), periodic (such as monthly or quarterly), or event-driven (triggered by system changes or incidents), depending on the customer's operational environment and compliance obligations. The customer should ensure that inventory updates occur as an integral part of component installations, removals, and system updates.
+
+#### Integrate Mendix Component Information
+
+The customer is responsible for obtaining and incorporating Mendix-provided component information into their own asset inventory. Mendix provides detailed component inventory documentation, including a Software Bill of Materials (SBOM), for Mendix Runtime, Mendix Operator, Studio Pro, and Private Mendix Platform, updated with each new version release. The customer can ingest this information into their asset inventory system.
+
+#### Coordinate with Implementation and Operations Teams
+
+The customer must work with Infra Implementer, App Implementer, Infra Operator and App Operator to maintain accurate inventories.
+
+##### Infra Implementer
+
+The Infra Implementer must perform for the following tasks:
+
+* Provide complete infrastructure component inventory.
+* Document all virtual machines, containers, network devices.
+* Specify Kubernetes cluster components and configurations.
+* Include operating system versions and patch levels.
+
+##### App Implementer
+
+The App Implementer must perform for the following tasks:
+
+* Provide complete Mendix application component inventory.
+* Document all deployed Mendix apps and their versions.
+* List all Mendix modules, widgets, and third-party integrations.
+* Specify custom code components and dependencies.
+
+##### Infra Operator
+
+The Infra Operator must perform for the following tasks:
+
+* Keep infrastructure inventory up to date as changes occur.
+* Update inventory during patching, upgrades, and maintenance.
+* Detect and report unauthorized infrastructure components.
+* Maintain accuracy of network and system information.
+
+##### App Operator
+
+The App Operator must perform for the following tasks:
+
+* Keep Mendix app inventory up to date as apps are deployed or updated.
+* Track app lifecycle (development, staging, production).
+* Update inventory when apps are modified or decommissioned.
+* Monitor for unauthorized application deployments.
+
+## Proof and Remarks
+
+[Conveyor](https://app.conveyor.com/profile/mendix) includes the following portals:
+
+* [Mendix Operator](https://app.conveyor.com/profile/mendix/d/mendix-operator/cwqIsc)
+* [PMP Portal SBOM](https://app.conveyor.com/profile/mendix/d/pmp-portal-sbom/87vRAn)
+* [Runtime](https://app.conveyor.com/profile/mendix/d/runtime/hiMac4)
+* [Studio Pro Components](https://app.conveyor.com/profile/mendix/d/studio-pro-components/98TuRq)
+
+{{< figure src="/attachments/private-platform/nist-cm/nist-cm-0801-1.png" class="no-border" >}}
+
+For more information, refer to the following:
+
+* [Mendix on Kubernetes Release Notes](/releasenotes/developer-portal/mendix-for-private-cloud/)
+* [LTS, MTS, and Monthly Releases](/releasenotes/studio-pro/lts-mts/)
+* [Private Mendix Platform Release Notes](/releasenotes/private-platform/)
+* [SBOM Generation](/refguide/sbom-generation/)
+
+{{< figure src="/attachments/private-platform/nist-cm/nist-cm-08-1.png" class="no-border" >}}
\ No newline at end of file
diff --git a/content/en/docs/private-platform/nist-controls/sa/pmp-nist-sa0905.md b/content/en/docs/private-platform/nist-controls/sa/pmp-nist-sa0905.md
new file mode 100644
index 00000000000..5ab5f847acf
--- /dev/null
+++ b/content/en/docs/private-platform/nist-controls/sa/pmp-nist-sa0905.md
@@ -0,0 +1,85 @@
+---
+title: "SA-09 (05) - Information Location"
+linktitle: "SA-09 (05)"
+url: /private-mendix-platform/nist-controls/sa-0905/
+description: "Documents the Private Mendix Platform's compliance with the SA-09 (05) control of the NIST 800-53 framework."
+weight: 20
+---
+
+## Introduction
+
+This document describes how Private Mendix Platform fulfills the SA-09 (05) control.
+
+| Control ID | SA-09 (05) |
+| --- | --- |
+| Control category | SA - System and Services Acquisition |
+| Requirement baseline | FEDRAMP MODERATE |
+| Responsibility and ownership | Mendix - Private Mendix Platform, Mendix - Operator,  Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org |
+
+## Control
+
+The organization restricts the location of information processing, information or data, and information system services to organization-defined locations based on organization-defined requirements or conditions.
+
+## Responsibility
+
+### Mendix Responsibility
+
+Mendix provides several systems as a part of the Private Mendix Platform that are able to operate on various computer infrastructures (cloud, virtual machine) that may be operated within whatever environment the customer chooses.
+
+All of these systems (Private Mendix Platform, Mendix Runtime, Mendix Operator, Studio Pro, database & file storage for Mendix Applications) comply with these conditions.
+
+### Customer Responsibility
+
+* The Infra Implementer is responsible for ensuring the underlying cloud infrastructure (for example, AWS Region) and storage services are provisioned within organization-approved geographic locations.
+* The App Implementer is responsible for ensuring that all Mendix App data storage and processing configurations comply with the organization's residency requirements.
+* The Infra and App Operators are responsible for maintaining the system within the defined locations throughout its lifecycle.
+
+## Guidance
+
+### Customer Responsibility
+
+* Infrastructure agnostic design - Mendix provides a platform architecture that does not require external data backhauling, enabling the customer to maintain complete sovereignty over the information processing location.
+* Deployment transparency - Mendix provides the necessary deployment requirements (for example, Private Mendix Platform and Runtime requirements) so that the customer can accurately specify and provision the infrastructure in the approved locations.
+
+## Proof and Remarks
+
+### Regional Data Residency and Sovereignty Enforcement
+
+#### Infrastructure Location Control (Infra Implementer)
+
+* Regional lock - Evidence from Terraform, AWS, or Azure Console showing that the EKS cluster and all associated persistent volumes (EBS and EFS) are provisioned exclusively within the region.
+
+    In Terraform code, the configuration of the provider is the highest-level proof.
+
+    ```text
+    # Prove that all resources are initialized only within the specified area.
+    provider "aws" {
+      region = "us-gov-west-1" 
+    }
+    ```
+
+* Network sovereignty - Architectural diagrams confirming that no data leaves the organization-defined VPC boundary for external processing by the vendor.
+
+    For more information, refer to the follpwing documents:
+
+    * [AWS PrivateLink for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html)
+    * [Set up private access to an Amazon S3 bucket through a VPC endpoint](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/set-up-private-access-to-an-amazon-s3-bucket-through-a-vpc-endpoint.html)
+
+#### Platform Residency Configuration (App Implementer)
+
+* Private deployment evidence - The following screenshot from the Private Mendix Platform installation environment shows that the Mendix Runtime and Operator are running on internal nodes, ensuring that "Information System Services" originate only from approved locations.
+
+    The AWS EKS node does not have a public IP address assigned, which proves that the POD is running on an VPC internal node.
+
+    {{< figure src="/attachments/private-platform/nist-sa/nist-sa-0905-1.png" class="no-border" >}}
+
+* Data storage mapping - Documentation identifying that application databases (PostgreSQL/RDS) and file storage are mapped to regional-specific service endpoints.
+
+    For more information, see [Amazon RDS API and interface VPC endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/vpc-interface-endpoints.html).
+
+#### Governance and Architectural Validation
+
+* Private Cloud Architecture - The system leverages the Private Cloud deployment model. As validated by [Mendix on Kubernetes](/developerportal/deploy/private-cloud/#standalone-architecture), all core service components, including the Mendix Operator and application Runtime, are deployed locally within the customer-managed Kubernetes environment.
+* Prerequisites and compliance - The organization adheres to the [Private Mendix Platform Prerequisites](/private-mendix-platform/prerequisites/), which mandate that the customer provides the underlying infrastructure (Database, Storage, Cluster), thereby ensuring complete control over the data residency.
+* Secure installation guidance - The deployment follows the [Private Mendix Platform Quickstart Guide](/private-mendix-platform/quickstart/), ensuring that the installation process is confined to the pre-authorized cloud environment.
+* Regional compliance - It is the customer's responsibility to identify and select the authorized cloud regions (for example, AWS GovCloud) that meet their specific data sovereignty requirements. The customer must ensure that the installation environment is restricted to these approved regions during the initial provisioning phase.
diff --git a/static/attachments/private-platform/nist-au/nist-au-12-1.png b/static/attachments/private-platform/nist-au/nist-au-12-1.png
new file mode 100644
index 00000000000..c96a76fa0c5
Binary files /dev/null and b/static/attachments/private-platform/nist-au/nist-au-12-1.png differ
diff --git a/static/attachments/private-platform/nist-au/nist-au-12-2.png b/static/attachments/private-platform/nist-au/nist-au-12-2.png
new file mode 100644
index 00000000000..c82c23642d2
Binary files /dev/null and b/static/attachments/private-platform/nist-au/nist-au-12-2.png differ
diff --git a/static/attachments/private-platform/nist-au/nist-sa-0905-1.png b/static/attachments/private-platform/nist-au/nist-sa-0905-1.png
new file mode 100644
index 00000000000..ff6b6981d23
Binary files /dev/null and b/static/attachments/private-platform/nist-au/nist-sa-0905-1.png differ
diff --git a/static/attachments/private-platform/nist-cm/nist-cm-08-1.png b/static/attachments/private-platform/nist-cm/nist-cm-08-1.png
new file mode 100644
index 00000000000..147210658ec
Binary files /dev/null and b/static/attachments/private-platform/nist-cm/nist-cm-08-1.png differ