حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 14 بند
CI/CD Pipeline Security Review
قائمة التحقق هذه باللغة الإنجليزية.
Reviews the security of a CI/CD pipeline covering source integrity, build environment hardening, artifact signing, secrets, and deployment controls per software supply chain guidance.
SLSAOWASPNIST 800-53
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Source & Access Control
- Is branch protection enforced with required reviews before merge to protected branches? *
- Is access to the CI/CD system governed by SSO, MFA, and least privilege? *
- Are commits signed and verified to ensure source integrity?
- Are third-party pipeline plugins/actions pinned to specific versions or hashes? *
Build Environment
- Are build runners ephemeral and isolated between jobs? *
- Is the build defined as code and produced from version-controlled configuration? *
- Are dependencies pulled from trusted, internal proxy registries? *
- Is provenance/attestation generated to record how artifacts were built?
Secrets & Credentials
- Are pipeline secrets stored in a managed secrets store rather than in code or variables? *
- Is short-lived, OIDC-based federation used instead of long-lived cloud keys?
- Is secret scanning enabled to detect committed credentials? *
Artifact & Deployment Integrity
- Are build artifacts and container images cryptographically signed (e.g., Sigstore/cosign)? *
- Are signatures and provenance verified before deployment? *
- Are SAST, SCA, and container scans gated in the pipeline before release? *
نزّل قائمة تحقق CI/CD Pipeline Security Review كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.