# Ensure Pin Deployment Configuration Manifests to Verified Versions

- Source: https://support.icompaas.com/support/solutions/articles/62000234926-ensure-pin-deployment-configuration-manifests-to-verified-versions
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**   
Level 1

**Description:**   
All deployment configuration manifests—such as Kubernetes YAML files, Helm charts, or other infrastructure definitions—must reference specific, immutable versions or hashes of the artifacts and dependencies they deploy. This prevents accidental or malicious deployment of unverified or unintended changes by ensuring that only validated versions are used during deployment.

**Rationale:**    
Pinning deployment manifests to fixed, verified versions increases deployment reliability and security by eliminating risks associated with automatic updates to latest or floating versions. It enhances traceability and auditability, supports rollback, and reduces exposure to untested or compromised configurations.

**Impact:** **Pros:**  

-   Prevents unexpected changes during deployment.  
      
    
-   Improves security by deploying only verified versions.  
      
    
-   Enhances traceability and accountability.  
      
    
-   Facilitates rollback to known good states.  
      
    

**Cons:**

-   Requires disciplined version management and update processes.  
      
    
-   May slow down updates if version pinning is not managed efficiently.  
      
    

**Default value:**  
Many deployment manifests may use floating tags like “latest” or unpinned references, increasing risk.

**Audit:**  
Inspect deployment manifests to verify usage of specific version tags, commit hashes, or checksums for all referenced artifacts and dependencies.

**Remediation:**  
Update deployment manifests to reference fixed versions or immutable identifiers. Implement policies and automation to enforce version pinning and verification before deployment.

**References:**

1.   [https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
    
2.   [https://helm.sh/docs/chart\_best\_practices/dependencies/#version-pinning](https://helm.sh/docs/chart_best_practices/dependencies/#version-pinning)
    
3.   [https://www.cisecurity.org/controls/application-software-security/](https://www.cisecurity.org/controls/application-software-security/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.