SA-08 - Security Engineering Principles

Last modified: August 14, 2026

Introduction

This document describes how Private Mendix Platform fulfills the SA-08 control.

Control ID SA-08
Control category SA - System and Services Acquisition
Requirement baseline FEDRAMP MODERATE
Responsibility and ownership Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra, Customer - Org

Control

The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

Responsibility

Mendix Responsibility

Mendix applies security engineering principles in the design and development of the Private Mendix Platform core components, ensuring the platform architecture supports layered protections and secure-by-design standards.

Customer Responsibility

  • The customer is responsible for identifying, defining, and agreeing upon the specific system security engineering principles that must be applied to the system to meet their unique mission and regulatory requirements.
  • The Infra Implementer is responsible for applying security engineering principles to the underlying infrastructure (AWS GovCloud, EKS), including the delineation of physical and logical security boundaries.
  • The App Implementer is responsible for ensuring that the PMP platform configuration, custom integrations, and managed application environments adhere to sound security architecture principles.
  • The Infra and App Operators are responsible for ensuring security principles are maintained during system modifications, upgrades, and ongoing maintenance.

Guidance

Customer Responsibility

  • Layered protections - Implement defense-in-depth strategies, such as combining network-level Security Groups with application-level Service Mesh (Istio) encryption.
  • Boundary delineation - Clearly define and enforce logical boundaries between different trust zones (for example, Ingress Gateway, Management Sidecars, and Runtime Pods).
  • Threat modeling - Perform risk-based analysis to identify attack vectors and implement compensating controls (for example, mTLS, RBAC) to reduce risk to acceptable levels.

Proof and Remarks

Application of Layered Security Engineering Principles

Defense-in-Depth and Boundary Delineation (Infra Implementer)

  • Network segmentation - Implementation of a multi-tier VPC architecture where EKS nodes are hosted in private subnets, with an Istio Ingress Gateway serving as the sole hardened entry point (Port 443). For more information, refer to the following topics:

  • Workload isolation - Use of Kubernetes Namespaces and NetworkPolicies to delineate logical boundaries between different environment tiers (for example, Testing, Staging, Production) and to isolate Private Mendix Platform management traffic from other cluster workloads. For more information, see Network Policies.

Secure Platform Implementation (App Implementer)

  • Administrative traffic isolation - Configuration of the Private Mendix Platform to offload administrative functions (Ports 8800/8900) to dedicated sidecars, ensuring that the management plane is logically separated from the application data plane (Port 8080).

    For more information, refer to the following topics:

  • Hardened control plane - Deployment of the Mendix Operator using a Zero-Port model, ensuring that all platform lifecycle operations are performed through secure outbound API requests, minimizing the inbound attack surface.

Compensating Controls and Lifecycle Resilience