simpl.
Sign in
Cybersecurity GRC 14 items

CI/CD Pipeline Security Review

Reviews the security of a CI/CD pipeline covering source integrity, build environment hardening, artifact signing, secrets, and deployment controls per software supply chain guidance.

SLSAOWASPNIST 800-53

Free PDF · enter your email to download.

Source & Access Control

  • Is branch protection enforced with required reviews before merge to protected branches? *
  • Is access to the CI/CD system governed by SSO, MFA, and least privilege? *
  • Are commits signed and verified to ensure source integrity?
  • Are third-party pipeline plugins/actions pinned to specific versions or hashes? *

Build Environment

  • Are build runners ephemeral and isolated between jobs? *
  • Is the build defined as code and produced from version-controlled configuration? *
  • Are dependencies pulled from trusted, internal proxy registries? *
  • Is provenance/attestation generated to record how artifacts were built?

Secrets & Credentials

  • Are pipeline secrets stored in a managed secrets store rather than in code or variables? *
  • Is short-lived, OIDC-based federation used instead of long-lived cloud keys?
  • Is secret scanning enabled to detect committed credentials? *

Artifact & Deployment Integrity

  • Are build artifacts and container images cryptographically signed (e.g., Sigstore/cosign)? *
  • Are signatures and provenance verified before deployment? *
  • Are SAST, SCA, and container scans gated in the pipeline before release? *

Download the full CI/CD Pipeline Security Review checklist

Get it as a clean, printable PDF — free.