# Ensure Store Build and Pipeline Outputs in Isolated and Secure Repositories

- Source: https://support.icompaas.com/support/solutions/articles/62000235020-ensure-store-build-and-pipeline-outputs-in-isolated-and-secure-repositories
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  
Level 1

**Description:**  
All outputs generated by build or deployment pipelines—such as artifacts, logs, and reports—must be stored in dedicated, secured storage repositories that are separate from source code and pipeline configuration files. This separation safeguards outputs from unauthorized access or tampering.

**Rationale:**  
Isolating pipeline outputs enhances security by limiting exposure to sensitive data, preventing accidental overwrites, and enabling stricter access controls. It supports integrity, confidentiality, and auditability of build artifacts and related data.

**Impact:****Pros:**

-   **Protects artifacts and logs from unauthorized modification or access.  
      
    **
    
-   **Enables focused access control policies on output data.  
      
    **
    
-   **Improves traceability and audit capabilities.  
      
    **
    
-   **Supports compliance with security and data protection regulations.  
      
    **
    

**Cons:**

-   **May require additional storage management and costs.  
      
    **
    
-   **Introduces complexity in storage configuration and maintenance.  
      
    **
    

**Default value:****  
Outputs may be stored alongside source or pipeline files without segregation, increasing risk.**

**Audit:****  
Verify storage locations for build outputs are separate and secured. Review access controls and encryption settings on output repositories. Check logs for unauthorized access attempts.**

**Remediation:****  
Configure pipelines to write outputs to isolated storage with strict permissions. Use encryption at rest and in transit. Document storage policies and train relevant teams.**

**References:**

1.  **OWASP Secure Storage Guidelines: [https://cheatsheetseries.owasp.org/cheatsheets/Secure\_Storage\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secure_Storage_Cheat_Sheet.html)**
    
2.  **CIS Controls v8, Control 14 - Controlled Access Based on the Need to Know: [https://www.cisecurity.org/controls/controlled-access-based-on-the-need-to-know/](https://www.cisecurity.org/controls/controlled-access-based-on-the-need-to-know/)**
    
3.  **NIST SP 800-53 AC-3 Access Enforcement: [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.