PS.1.1 Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only …

Statement

Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.

Example 1:

Store all source code and configuration-as-code in a code repository, and restrict access to it based on the nature of the code. For example, open-source code intended for public access may need its integrity and availability protected; other code may also need its confidentiality protected.

Example 2:

Use version control features of the repository to track all changes made to the code with accountability to the individual account.

Example 3:

Use commit signing for code repositories.

Example 4:

Have the code owner review and approve all changes made to the code by others.

Example 5:

Use code signing to help protect the integrity of executables.

Example 6:

Use cryptography (e.g., cryptographic hashes) to help protect file integrity.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final