simpl.
로그인
사이버보안 GRC 14개 항목

CI/CD Pipeline Security Review

이 체크리스트는 영어로 제공됩니다.

Reviews the security of a CI/CD pipeline covering source integrity, build environment hardening, artifact signing, secrets, and deployment controls per software supply chain guidance.

SLSAOWASPNIST 800-53

무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.

Source & Access Control

  • Is branch protection enforced with required reviews before merge to protected branches? *
  • Is access to the CI/CD system governed by SSO, MFA, and least privilege? *
  • Are commits signed and verified to ensure source integrity?
  • Are third-party pipeline plugins/actions pinned to specific versions or hashes? *

Build Environment

  • Are build runners ephemeral and isolated between jobs? *
  • Is the build defined as code and produced from version-controlled configuration? *
  • Are dependencies pulled from trusted, internal proxy registries? *
  • Is provenance/attestation generated to record how artifacts were built?

Secrets & Credentials

  • Are pipeline secrets stored in a managed secrets store rather than in code or variables? *
  • Is short-lived, OIDC-based federation used instead of long-lived cloud keys?
  • Is secret scanning enabled to detect committed credentials? *

Artifact & Deployment Integrity

  • Are build artifacts and container images cryptographically signed (e.g., Sigstore/cosign)? *
  • Are signatures and provenance verified before deployment? *
  • Are SAST, SCA, and container scans gated in the pipeline before release? *

CI/CD Pipeline Security Review 체크리스트 전체 다운로드

인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.