# Ensure Track and Review Modifications to Pipeline Configuration Files

- Source: https://support.icompaas.com/support/solutions/articles/62000235019-ensure-track-and-review-modifications-to-pipeline-configuration-files
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  
Level 1

**Description:**  
All modifications to pipeline configuration files (e.g., YAML, JSON, or scripts defining build/deployment workflows) must be tracked using version control and subjected to formal review processes. This ensures accountability, traceability, and quality control over changes affecting automated build and deployment pipelines.

**Rationale:**  
Tracking and reviewing pipeline file changes help prevent accidental misconfigurations, unauthorized modifications, and security risks that could disrupt software delivery or introduce vulnerabilities. It promotes collaboration and compliance with organizational standards.

**Impact:****Pros:**

-   Enhances pipeline security and reliability.  
      
    
-   Provides audit trail and accountability for changes.  
      
    
-   Reduces risk of build or deployment failures.  
      
    
-   Supports compliance with security policies and best practices.  
      
    

**Cons:**

-   Requires discipline in change management processes.  
      
    
-   May introduce delays if reviews are not timely.  
      
    

**Default value:**  
Pipeline files may be modified without formal tracking or review in some environments, increasing risk.

**Audit:**  
Review version control history for pipeline files. Verify that changes undergo peer or security reviews prior to merging. Check logs for unauthorized or undocumented modifications.

**Remediation:**  
Enforce version control usage for pipeline files. Implement pull request or merge request review policies specifically for these files. Educate teams on the importance of reviewing pipeline changes.

**References:**

1.  GitHub Actions Workflow Files: [https://docs.github.com/en/actions/using-workflows](https://docs.github.com/en/actions/using-workflows)
    
2.  GitLab CI/CD Pipeline Configuration: [https://docs.gitlab.com/ee/ci/yaml/](https://docs.gitlab.com/ee/ci/yaml/)
    
3.  CIS Controls v8, Control 6 - Maintenance, Monitoring, and Analysis of Audit Logs: [https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/](https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.