PS.1.1 Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only …

Statement

Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.

Example 1:

Store all source code and configuration-as-code in a code repository, and restrict access to it based on the nature of the code. For example, open-source code intended for public access may need its integrity and availability protected; other code may also need its confidentiality protected.

Example 2:

Use version control features of the repository to track all changes made to the code with accountability to the individual account.

Example 3:

Use commit signing for code repositories.

Example 4:

Have the code owner review and approve all changes made to the code by others.

Example 5:

Use code signing to help protect the integrity of executables.

Example 6:

Use cryptography (e.g., cryptographic hashes) to help protect file integrity.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final