# Ensure Restrict Permissions for Triggering Build Processes

- Source: https://support.icompaas.com/support/solutions/articles/62000235018-ensure-restrict-permissions-for-triggering-build-processes
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  
Level 1

**Description:**  
Access to initiate or trigger build processes should be limited strictly to authorized personnel and automated systems that require it. Minimizing this access reduces the risk of unauthorized or malicious build executions that could compromise software integrity or release unintended code.

**Rationale:**  
Restricting build triggering permissions enforces the principle of least privilege, preventing unauthorized users from manipulating build workflows or injecting malicious code. It helps maintain the integrity of the software supply chain and supports audit and compliance requirements.

**Impact:****Pros:**

-   Reduces risk of unauthorized or malicious build triggers.  
      
    
-   Enhances control and accountability over build processes.  
      
    
-   Supports compliance with security policies and standards.  
      
    

**Cons:**

-   Requires careful role and permission management.  
      
    
-   May cause delays if authorized personnel are not available.  
      
    

**Default value:**  
Build triggering permissions may be overly permissive by default, increasing security risks.

**Audit:**  
Review access control lists and permissions related to build triggering. Verify that only designated users and systems have the ability to start builds. Check logs for unauthorized build trigger attempts.

**Remediation:**  
Implement role-based access control (RBAC) to limit build trigger permissions. Periodically review and update access rights. Educate teams on secure build process management.

**References:**

1.  Jenkins Security Best Practices: [https://www.jenkins.io/doc/book/security/](https://www.jenkins.io/doc/book/security/)
    
2.  GitLab CI/CD Permissions: [https://docs.gitlab.com/ee/ci/permissions/](https://docs.gitlab.com/ee/ci/permissions/)
    
3.  CIS Controls v8, Control 5 - Account Management: [https://www.cisecurity.org/controls/account-management/](https://www.cisecurity.org/controls/account-management/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.