What this control covers
The entity demonstrates a commitment to integrity and ethical values.
Why it matters
Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.
How to implement
AWS
Use CodeBuild with VPC-isolated build environments and CodeArtifact for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with AWS Signer.
Azure
Use Azure DevOps Pipelines with mandatory approvals on production environments and Microsoft Defender for DevOps for secret scanning across GitHub/ADO/GitLab in one pane.
GitHub
Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.
Evidence to collect
code_repo_scan— See the iCompaas Evidence library for the canonical source for this evidence type.infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Commitment to Integrity and Ethical Values (Original component: Control Environment).
Quick checklist
- Commitment — Integrity / Ethical Values
- Security — Integrity / Ethical Values
- Secure — Integrity / Ethical Values