साइबर सुरक्षा GRC 13 आइटम
Secrets Management & Credential Hygiene Audit
यह चेकलिस्ट अंग्रेज़ी में है।
Audits how application secrets, API keys, and credentials are stored, rotated, and prevented from leaking into code and pipelines.
CIS v8NIST 800-53OWASP
मुफ़्त PDF या Word · डाउनलोड करने के लिए अपना ईमेल दर्ज करें।
Secret Storage
- Are secrets stored in a dedicated secrets manager or vault rather than in code? *
- Are secrets encrypted at rest with access restricted by policy? *
- Are hardcoded secrets and credentials prohibited in source repositories? *
- Are configuration files and environment variables free of plaintext secrets?
Rotation & Lifecycle
- Are secrets rotated on a defined schedule or automatically? *
- Are secrets rotated promptly after suspected exposure or personnel changes? *
- Are short-lived, dynamically generated credentials used where supported?
Detection & Prevention
- Is automated secret scanning enabled on repositories and commits? *
- Are pre-commit hooks or pipeline gates used to block secret commits? *
- Is there a defined process to revoke and remediate leaked secrets? *
Access & Auditing
- Is access to secrets granted on a least-privilege, per-application basis? *
- Are secret access events logged and monitored? *
- Are secrets injected at runtime rather than baked into build artifacts? *
पूरी Secrets Management & Credential Hygiene Audit चेकलिस्ट डाउनलोड करें
इसे साफ़-सुथरे, प्रिंट करने योग्य PDF या संपादन योग्य Word दस्तावेज़ के रूप में मुफ़्त पाएँ।