GRC Cybersécurité 13 points
Secrets Management & Credential Hygiene Audit
Cette liste de contrôle est en anglais.
Audits how application secrets, API keys, and credentials are stored, rotated, and prevented from leaking into code and pipelines.
CIS v8NIST 800-53OWASP
PDF ou Word gratuit · saisissez votre e-mail pour le télécharger.
Secret Storage
- Are secrets stored in a dedicated secrets manager or vault rather than in code? *
- Are secrets encrypted at rest with access restricted by policy? *
- Are hardcoded secrets and credentials prohibited in source repositories? *
- Are configuration files and environment variables free of plaintext secrets?
Rotation & Lifecycle
- Are secrets rotated on a defined schedule or automatically? *
- Are secrets rotated promptly after suspected exposure or personnel changes? *
- Are short-lived, dynamically generated credentials used where supported?
Detection & Prevention
- Is automated secret scanning enabled on repositories and commits? *
- Are pre-commit hooks or pipeline gates used to block secret commits? *
- Is there a defined process to revoke and remediate leaked secrets? *
Access & Auditing
- Is access to secrets granted on a least-privilege, per-application basis? *
- Are secret access events logged and monitored? *
- Are secrets injected at runtime rather than baked into build artifacts? *
Téléchargez la liste de contrôle Secrets Management & Credential Hygiene Audit complète
Obtenez-la gratuitement en PDF propre et imprimable, ou en document Word modifiable.